@mohasinac/appkit 4.71.0 → 4.72.0

package/dist/_internal/server/features/seo/static-params.js

@@ -51,8 +51,6 @@ import { getAdminDb } from "../../../../providers/db-firebase/index.js";
 import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore.js";
 import { BLOG_POSTS_COLLECTION, BLOG_POST_FIELDS } from "../../../../features/blog/schemas/firestore.js";
 import { CATEGORIES_COLLECTION, CATEGORY_FIELDS } from "../../../../features/categories/schemas/firestore.js";
-import { BEYS_COLLECTION } from "../../../../features/beys/schemas/firestore.js";
-import { PART_GLOSSARY_COLLECTION, ALL_PART_SLOTS } from "../../../../features/parts/schemas/firestore.js";
 import { PRODUCT_FIELDS } from "../../../../constants/field-names.js";
 import { serverLogger } from "../../../../monitoring/server-logger.js";
 import { PRODUCT_DETAIL_LISTING_TYPES } from "./product-detail-types.js";
@@ -173,56 +171,3 @@ export function blogPostSlugs() {
  * because the route is dynamic. The id IS the slug here, so the shared
  * `slugsFrom` projection applies unchanged.
  */
-export function beyDetailSlugs() {
-    return slugsFrom("bey", (db) => db.collection(BEYS_COLLECTION));
-}
-/**
- * `/parts/[classification]/[code]` — 2,488 part reference pages.
- *
- * Two params, so this cannot use `slugsFrom`: the document id is
- * `{slot}--{tail}` and the route splits it across both segments. The URL
- * segment IS the slot (`partSlotFromSegment` is an identity lookup against
- * `ALL_PART_SLOTS`), so the split is the whole derivation.
- *
- * 🛑 Ids carrying no `--`, or an unrecognised slot, are SKIPPED rather than
- * guessed at — a prerendered param that does not resolve is a build-time 404
- * baked into the output. The count of skips is logged so a generator change
- * that breaks the id shape is visible rather than silently halving the set.
- */
-export async function partDetailParams() {
-    try {
-        const snap = await getAdminDb()
-            .collection(PART_GLOSSARY_COLLECTION)
-            .select()
-            .limit(MAX_PRERENDER)
-            .get();
-        const slots = new Set(ALL_PART_SLOTS);
-        let skipped = 0;
-        const params = [];
-        for (const doc of snap.docs) {
-            const sep = doc.id.indexOf("--");
-            const classification = sep === -1 ? "" : doc.id.slice(0, sep);
-            const code = sep === -1 ? "" : doc.id.slice(sep + 2);
-            if (!code || !slots.has(classification)) {
-                skipped++;
-                continue;
-            }
-            params.push({ classification, code });
-        }
-        if (skipped > 0) {
-            serverLogger.warn(`generateStaticParams: "part" skipped ${skipped} glossary id(s) that are not {slot}--{tail}`, { section: "part", skipped });
-        }
-        if (snap.size >= MAX_PRERENDER) {
-            serverLogger.warn(`generateStaticParams: "part" hit the ${MAX_PRERENDER}-document prerender budget; the remainder render on demand`, { section: "part" });
-        }
-        return params;
-    }
-    catch (err) {
-        void normalizeError(err);
-        serverLogger.error('generateStaticParams: "part" failed and prerendered 0 pages', {
-            section: "part",
-            error: err,
-        });
-        return [];
-    }
-}

package/dist/_internal/server/features/shared/listing-data-factory.js

@@ -4,7 +4,7 @@ import { safeRead } from "../../../../errors/safe-read.js";
 import { loadProductFeaturesForStore } from "../../../../features/products/repository/loadProductFeatures.js";
 import { isPubliclyVisible } from "../../../shared/listing-types/availability.js";
 // Returns a React.cache()-wrapped fetch gated on one listing type.
-// The guard prevents cross-type URL collisions (e.g. /auctions/classified-slug returning wrong product).
+// The guard prevents cross-type URL collisions (e.g. /collector-drops/classified-slug returning wrong product).
 //
 // 🛑 THE STATUS GATE IS LOAD-BEARING, AND ITS ABSENCE WAS A LIVE LEAK.
 //
@@ -17,8 +17,8 @@ import { isPubliclyVisible } from "../../../shared/listing-types/availability.js
 // URL, and because the admin row updated correctly every time, the moderator had
 // no way to notice.
 //
-// One gate here covers SIX detail routes — auction, classified, digital-code,
-// live, pre-order, prize-draw — which is why it belongs in the factory rather
+// One gate here covers SIX detail routes — collector drop, classified, digital-code,
+// live, pre-order, clearance — which is why it belongs in the factory rather
 // than in each page.
 //
 // `isPubliclyVisible` is the same predicate every public LIST query uses, and it

package/dist/_internal/server/features/site-settings/actions.d.ts

@@ -7,8 +7,44 @@ export declare function updateActionConfigDomain(actionId: string, enabled: bool
  * Toggle a single nav item's enabled state in siteSettings.navConfig.
  * Also recomputes the derived disabledRoutes[] array from all current nav items.
  * The `allNavItems` argument is the full { id, href } list so we can derive disabledRoutes.
+ *
+ * Preserves the item's existing `order` (3B-1b backlog item 4) — this only
+ * ever writes `enabled`, so a plain `{ enabled }` replacement would silently
+ * drop a prior reorder every time an item is hidden/shown again.
  */
 export declare function updateNavConfigDomain(navId: string, enabled: boolean, allNavItems: Array<{
     id: string;
     href: string;
 }>): Promise<void>;
+/**
+ * Bulk-write per-item `order` into siteSettings.navConfig, for one nav
+ * group's reordered item list. Writes the WHOLE ordered list at once (like
+ * `fieldOrder: string[]` elsewhere) rather than one id at a time, because
+ * "move item X up" is a change to every sibling's relative order, not just
+ * X's — a single-item patch would need the caller to already know the new
+ * order of every other item anyway.
+ *
+ * Preserves each item's existing `enabled` state — reordering must never
+ * silently re-enable (or disable) an item. Does NOT touch `disabledRoutes`:
+ * that array is derived from PUBLIC nav items only (see
+ * `updateNavConfigDomain` above), and reorder is dashboard-sidebar-only
+ * today (3B-1b backlog item 4) — a dashboard item was never eligible to
+ * appear in `disabledRoutes` in the first place.
+ */
+export declare function updateNavOrderDomain(orderedIds: string[]): Promise<void>;
+/**
+ * Admin-created NEW nav entries (overhaul brief, Table D — safe version).
+ * `item` is copied from the caller's closed, pre-registered candidate list
+ * (`ActionDef`s with a real `href`) — this function trusts the caller the
+ * same way `updateNavConfigDomain` trusts `allNavItems`, it does not
+ * re-validate the href against anything, because there is no free-text
+ * path into this function for a malformed value to take.
+ */
+export declare function addNavEntryDomain(group: "admin" | "store" | "user", item: {
+    id: string;
+    href: string;
+    label: string;
+    requiredPermission?: string;
+}): Promise<void>;
+/** The removal half — see `addNavEntryDomain`. */
+export declare function removeNavEntryDomain(navId: string): Promise<void>;

package/dist/_internal/server/features/site-settings/actions.js

@@ -12,12 +12,17 @@ export async function updateActionConfigDomain(actionId, enabled) {
  * Toggle a single nav item's enabled state in siteSettings.navConfig.
  * Also recomputes the derived disabledRoutes[] array from all current nav items.
  * The `allNavItems` argument is the full { id, href } list so we can derive disabledRoutes.
+ *
+ * Preserves the item's existing `order` (3B-1b backlog item 4) — this only
+ * ever writes `enabled`, so a plain `{ enabled }` replacement would silently
+ * drop a prior reorder every time an item is hidden/shown again.
  */
 export async function updateNavConfigDomain(navId, enabled, allNavItems) {
     const current = await siteSettingsRepository.getSingleton();
+    const existingOrder = current.navConfig?.[navId]?.order;
     const merged = {
         ...(current.navConfig ?? {}),
-        [navId]: { enabled },
+        [navId]: { enabled, ...(existingOrder !== undefined ? { order: existingOrder } : {}) },
     };
     const disabledRoutes = allNavItems
         .filter((item) => (merged[item.id]?.enabled ?? true) === false)
@@ -27,3 +32,54 @@ export async function updateNavConfigDomain(navId, enabled, allNavItems) {
         disabledRoutes,
     });
 }
+/**
+ * Bulk-write per-item `order` into siteSettings.navConfig, for one nav
+ * group's reordered item list. Writes the WHOLE ordered list at once (like
+ * `fieldOrder: string[]` elsewhere) rather than one id at a time, because
+ * "move item X up" is a change to every sibling's relative order, not just
+ * X's — a single-item patch would need the caller to already know the new
+ * order of every other item anyway.
+ *
+ * Preserves each item's existing `enabled` state — reordering must never
+ * silently re-enable (or disable) an item. Does NOT touch `disabledRoutes`:
+ * that array is derived from PUBLIC nav items only (see
+ * `updateNavConfigDomain` above), and reorder is dashboard-sidebar-only
+ * today (3B-1b backlog item 4) — a dashboard item was never eligible to
+ * appear in `disabledRoutes` in the first place.
+ */
+export async function updateNavOrderDomain(orderedIds) {
+    const current = await siteSettingsRepository.getSingleton();
+    const merged = {
+        ...(current.navConfig ?? {}),
+    };
+    orderedIds.forEach((id, index) => {
+        merged[id] = { enabled: merged[id]?.enabled ?? true, order: index };
+    });
+    await siteSettingsRepository.updateSingleton({
+        navConfig: merged,
+    });
+}
+/**
+ * Admin-created NEW nav entries (overhaul brief, Table D — safe version).
+ * `item` is copied from the caller's closed, pre-registered candidate list
+ * (`ActionDef`s with a real `href`) — this function trusts the caller the
+ * same way `updateNavConfigDomain` trusts `allNavItems`, it does not
+ * re-validate the href against anything, because there is no free-text
+ * path into this function for a malformed value to take.
+ */
+export async function addNavEntryDomain(group, item) {
+    const current = await siteSettingsRepository.getSingleton();
+    const existing = current.navCustomEntries ?? [];
+    if (existing.some((e) => e.id === item.id))
+        return;
+    await siteSettingsRepository.updateSingleton({
+        navCustomEntries: [...existing, { ...item, group }],
+    });
+}
+/** The removal half — see `addNavEntryDomain`. */
+export async function removeNavEntryDomain(navId) {
+    const current = await siteSettingsRepository.getSingleton();
+    await siteSettingsRepository.updateSingleton({
+        navCustomEntries: (current.navCustomEntries ?? []).filter((e) => e.id !== navId),
+    });
+}

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -30,16 +30,16 @@
  * subset.
  */
 import type { SiteSettingsDocument } from "../../../../features/admin/schemas/firestore";
-import type { MediaVideoWatermark } from "../../../../features/media/MediaVideo";
+import type { MediaVideoWatermark } from "../../../../ui/components/MediaVideo";
 import type { PublicSiteSettings } from "../../../shared/features/site-settings/types";
 /**
  * Document fields with a proven `useSiteSettings()` reader. Every entry below
  * was traced to a call site; anything without one belongs in the private list,
  * because an unused public field is pure attack surface.
  */
-export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "support", "navConfig", "actionConfig", "background", "watermark", "disabledRoutes", "chat", "search"];
+export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "support", "navConfig", "actionConfig", "background", "watermark", "disabledRoutes", "chat", "assistant", "search", "enabledLocales"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["rateChanges", "id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging", "whatsappFeed"];
+export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["rateChanges", "id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "maintenance", "laborRate", "adSettings", "integrations", "platformLimits", "collectorDropConfig", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging", "whatsappFeed"];
 export interface ToPublicSiteSettingsOptions {
     /**
      * The resolved marker → wordmark → text watermark chain. Injected because

package/dist/_internal/server/features/site-settings/adapters.js

@@ -1,4 +1,5 @@
 import { closedSurfacePrefixes, hiddenSurfaceRoutes, } from "../../../shared/listing-types/hidden-surfaces.js";
+import { isCategoryTypeEnabled } from "../../../shared/listing-types/feature-flags.js";
 /**
  * Document fields with a proven `useSiteSettings()` reader. Every entry below
  * was traced to a call site; anything without one belongs in the private list,
@@ -7,7 +8,7 @@ import { closedSurfacePrefixes, hiddenSurfaceRoutes, } from "../../../shared/lis
 export const PUBLIC_SITE_SETTINGS_FIELDS = [
     "contact", // user/orders/[id]/payment — contact.whatsappNumber (narrowed: no address/upiVpa)
     "payment", // CheckoutRouteClient — payment.otpCheckoutThreshold (narrowed)
-    "listings", // useListingTypeFlags + LayoutShellClient nav filter — narrowed to listings.{listingTypes,browsePages}; categoryTypes has no client reader
+    "listings", // useListingTypeFlags + LayoutShellClient nav filter — narrowed to listings.{listingTypes,browsePages,bundlesEnabled}; categoryTypes has no client reader
     "notificationChannels", // NARROWED: only {email,whatsapp,sms}.enabled — see the projection below
     "announcementBar", // the homepage banner (AdminSiteSettingsView edits it)
     /*
@@ -50,6 +51,9 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
     // render a "Message seller" CTA at all. Narrowed to `enabled` only; there is
     // nothing else in the group.
     "chat",
+    // The customer-assistant kill switch — <AssistantWidget>/<AssistantPageView>,
+    // both client components. Narrowed to `enabled` only, same shape as `chat`.
+    "assistant",
     /*
      * useSearchIndex — the kill switch for the browser-side search artifact.
      *
@@ -64,6 +68,10 @@ export const PUBLIC_SITE_SETTINGS_FIELDS = [
      * leaves search working rather than dark — see the schema note.
      */
     "search",
+    // 2B — the language-switcher's own kill switch. A guest reads this before
+    // signing in (the switcher lives in the public header), same reasoning as
+    // `search` above.
+    "enabledLocales",
 ];
 /** Everything else, with the reason it stays server-side. */
 export const PRIVATE_SITE_SETTINGS_FIELDS = [
@@ -90,11 +98,18 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
     "commissions", // internal economics; the buyer-facing subset ships via toBuyerFacingFees
     "emi", // ditto — surchargeSellerSharePercent is a platform/seller revenue split
     "gst", // GSTIN, registered legal name and address
+    // Site-wide maintenance window. Deliberately NOT exposed through this
+    // projection — `GET /api/maintenance` is the one sanctioned, narrow public
+    // read (its own header explains why: different freshness, different
+    // fail-open/fail-closed contract, different cost than this payload). This
+    // field's value reaching the public settings response would be a SECOND,
+    // slower-cached copy of the same fact with the opposite failure contract.
+    "maintenance",
     "laborRate", // internal procurement cost basis
     "adSettings", // providerCredentials + unpublished ad inventory; /api/ads serves the filtered public view
     "integrations", // analytics/tag IDs are injected server-side into markup, not fetched by the client
     "platformLimits", // server-enforced caps; no client reader
-    "auctionConfig", // read by AuctionDetailPageView, a Server Component doing its own settings read
+    "collectorDropConfig", // read by CollectorDropDetailPageView, a Server Component doing its own settings read
     "siteName", // delivered as an SSR prop / rendered server-side
     "tagline", // admin chrome only
     "motto", // rendered server-side
@@ -102,7 +117,6 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
     "favicon", // emitted by generateMetadata, server-side
     "seo", // consumed by generateMetadata, server-side
     "socialLinks", // rendered server-side in the footer
-    "features", // rendered server-side
     "shipping", // rendered server-side
     "returns", // rendered server-side
     "faq", // faq.variables are interpolated server-side by /api/faqs
@@ -122,7 +136,7 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
     /*
      * The WhatsApp catalogue feed kill switch. Read ONLY by
      * `/whatsapp/{storeSlug}/feed.csv`, which is a server route doing its own
-     * settings read — the same shape as `auctionConfig` above.
+     * settings read — the same shape as `collectorDropConfig` above.
      *
      * 🛑 Deliberately NOT public, unlike its sibling `search`. That one is public
      * because its reader is a GUEST's search box, so a server-only flag could not
@@ -153,6 +167,11 @@ export function toPublicSiteSettings(doc, opts) {
             // Read by LayoutShellClient to drop nav/footer links into a closed
             // section. `categoryTypes` is still withheld — it has no client reader.
             browsePages: doc.listings?.browsePages,
+            // One derived boolean, not the raw `categoryTypes` map — closes the
+            // bundles nav/proxy drift (the nav had no way to agree with
+            // `src/proxy.ts`'s own `closedSurfacePrefixes` 404 gate) without
+            // reopening `categoryTypes` as a whole.
+            bundlesEnabled: isCategoryTypeEnabled("bundle", doc),
         },
         /*
          * 🛑 Narrowed to the three booleans a client reads, not the group by
@@ -231,6 +250,17 @@ export function toPublicSiteSettings(doc, opts) {
          * together deliberately so the difference is visible rather than looking
          * like one of them is a mistake.
          *
+         * `chat` is a feature nobody has turned on yet; absent means off. The
+         * customer assistant is already a shipped primary path; absent means ON,
+         * and only an explicit `false` disables it. Same reasoning `search`
+         * below uses for the identical reason.
+         */
+        assistant: { enabled: doc.assistant?.enabled !== false },
+        /*
+         * 🛑 `!== false`, the opposite of `chat` above, and the two sit together
+         * deliberately so the difference is visible rather than looking like one
+         * of them is a mistake.
+         *
          * `chat` is a feature nobody has turned on yet; absent means off. This is
          * a kill switch on a path that is already the primary one; absent means
          * ON, and only an explicit `false` disables it. Normalised here rather
@@ -238,5 +268,10 @@ export function toPublicSiteSettings(doc, opts) {
          * cannot accidentally re-derive it with `??`.
          */
         search: { indexEnabled: doc.search?.indexEnabled !== false },
+        // Fails OPEN to the full declared set — a missing/failed read must not
+        // narrow the switcher to fewer locales than the site actually ships.
+        enabledLocales: doc.enabledLocales && doc.enabledLocales.length > 0
+            ? doc.enabledLocales
+            : undefined,
     };
 }

package/dist/_internal/server/features/sticker-trace/promote-to-listings.js

@@ -193,7 +193,7 @@ export async function promoteStickerSheetToListings(input) {
         featured: false,
         tags: ["stickers"],
         condition: "new",
-        listingType: "stickers",
+        listingType: "art-and-stickers",
         groupTitle: sheet.title,
         sourceStickerSheetId: sheet.id,
     }));
@@ -221,7 +221,7 @@ export async function promoteStickerSheetToListings(input) {
             featured: false,
             tags: ["stickers"],
             condition: "new",
-            listingType: "stickers",
+            listingType: "art-and-stickers",
             sourceStickerSheetId: sheet.id,
             sourceStickerPartOrdinal: part.ordinal,
         }));

package/dist/_internal/server/features/sticker-trace/sweep.d.ts

@@ -0,0 +1,13 @@
+export interface SweepResult {
+    scanned: number;
+    timedOut: number;
+}
+/**
+ * Mark every `queued`/`running` run older than the threshold as `failed`.
+ *
+ * Reuses `emitTerminalFailure` rather than calling `markFailed` directly —
+ * the sweep found the run because its RTDB channel went quiet, and a terminal
+ * write there (not just Firestore) is what stops a client still subscribed to
+ * a dead run's channel from watching a bar that will never move again.
+ */
+export declare function sweepStuckStickerTraceRuns(now: Date): Promise<SweepResult>;

package/dist/_internal/server/features/sticker-trace/sweep.js

@@ -0,0 +1,49 @@
+/*
+ * WHY: `shard.ts` and `progress.ts` both document the same gap from the inside
+ *      — a shard or the coordinator can die without ever reaching its own
+ *      `catch`/`finally` (GCF hard-kills at `timeoutSeconds`), and "nothing
+ *      sweeps it" is recorded as a known, unclosed hole. This closes it.
+ * WHAT: Find runs sitting in `queued` or `running` long past any realistic
+ *       completion time, and give them the terminal failure they never got.
+ *
+ * 🛑 The threshold is NOT the per-function `timeoutSeconds`. A healthy run
+ * queues, waits for a cold start, runs the coordinator (<=540s) and its shards
+ * (<=300s, in parallel) before a finalizer closes it out — 20 minutes is
+ * generous above that whole chain, not a tight bound on any one stage.
+ *
+ * EXPORTS: sweepStuckStickerTraceRuns
+ *
+ * @tag domain:sticker-trace
+ * @tag layer:server
+ * @tag pattern:none
+ * @tag access:server
+ * @tag consumers:jobs/core/stickerTraceSweep
+ * @tag sideEffects:firestore,rtdb
+ */
+import { stickerTraceRunsRepository } from "../../../../features/sticker-trace/repository/sticker-trace-runs.repository.js";
+import { TraceRunStatusValues } from "../../../../features/sticker-trace/schemas/firestore.js";
+import { emitTerminalFailure } from "./progress.js";
+const STUCK_THRESHOLD_MS = 20 * 60 * 1000;
+/**
+ * Mark every `queued`/`running` run older than the threshold as `failed`.
+ *
+ * Reuses `emitTerminalFailure` rather than calling `markFailed` directly —
+ * the sweep found the run because its RTDB channel went quiet, and a terminal
+ * write there (not just Firestore) is what stops a client still subscribed to
+ * a dead run's channel from watching a bar that will never move again.
+ */
+export async function sweepStuckStickerTraceRuns(now) {
+    const cutoff = new Date(now.getTime() - STUCK_THRESHOLD_MS);
+    const stuck = [
+        ...(await stickerTraceRunsRepository.listStuckByStatus(TraceRunStatusValues.QUEUED, cutoff)),
+        ...(await stickerTraceRunsRepository.listStuckByStatus(TraceRunStatusValues.RUNNING, cutoff)),
+    ];
+    for (const run of stuck) {
+        await emitTerminalFailure(run.id, {
+            stage: run.stage ?? "queued",
+            code: "RUN_TIMED_OUT",
+            message: "This run stopped reporting progress for over 20 minutes and was marked failed. Retry it — a transient crash in the processing pipeline, not your parameters, caused this.",
+        }, run);
+    }
+    return { scanned: stuck.length, timedOut: stuck.length };
+}

package/dist/_internal/server/features/stores/activation.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The `jobType` registered in `JOB_RUNNERS`.
+ *
+ * 🛑 A constant shared by the enqueue and the registry, because a `jobType` is
+ * a STRING KEY matched by equality: a typo at either end produces a job
+ * document that is written, picked up, matched against nothing, and marked
+ * failed with "unknown job type" — which reads as a runner fault.
+ */
+export declare const STORE_VENDOR_REGISTER_JOB: "settlementVendorRegister";
+/**
+ * Everything that must happen when a store becomes `active`.
+ *
+ * Today that is exactly one thing. It is a named function rather than two lines
+ * in the route so a second activation side effect has somewhere to go that is
+ * not "another block in the admin PATCH handler" — and so there is one place to
+ * look when asking what approving a store does.
+ */
+export declare function onStoreActivated(input: {
+    storeSlug: string;
+    /** The admin who approved it, for the job's `requestedBy`. */
+    actorUid: string;
+}): Promise<void>;

package/dist/_internal/server/features/stores/activation.js

@@ -0,0 +1,73 @@
+/*
+ * WHY: Approving a store is the moment it becomes able to sell, and under split
+ *      settlement it is therefore the moment its owner has to become a VENDOR
+ *      of the collecting aggregator — otherwise the first multi-vendor cart
+ *      containing their goods is refused, with the buyer told to come back
+ *      later and nobody told why.
+ *
+ *      The hook is `storeRepository.setStatus`'s `ACTIVE` branch, and it is
+ *      NOT in that method. A repository is the data layer and no repository
+ *      here imports another feature's; `enqueueJob` pulls the jobs repository
+ *      and the Admin Auth SDK with it, which is the Turbopack import-chain trap
+ *      (Root Cause #6/#18). And a job enqueued from inside a write primitive
+ *      would fire for a reseed, a backfill and a tester fixture, none of which
+ *      is an approval.
+ *
+ * WHAT: The one named side effect of a store becoming active.
+ *
+ * 🛑 IT MUST `enqueueJob`, NEVER call the gateway inline. Vendor registration
+ * is an outbound HTTPS call on a path an admin is waiting on, against Rule #6's
+ * 10s sync-function ceiling — and the admin PATCH route has already done two
+ * Firestore reads and up to three writes by the time it gets here.
+ *
+ * 🛑 BEST-EFFORT. A failed enqueue must never fail an approval that has already
+ * published the store: the approval is the decision, registration is
+ * bookkeeping that can be re-run. It is REPORTED rather than swallowed, so a
+ * systematic failure shows up as a pattern (Root Cause #59), and the job is
+ * idempotent — `vendorId` is the store slug, so a repeat is the same call.
+ *
+ * EXPORTS: STORE_VENDOR_REGISTER_JOB, onStoreActivated
+ *
+ * @tag domain:stores,payments
+ * @tag layer:server
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:api/admin/stores/[uid]
+ * @tag sideEffects:enqueues a job
+ */
+import { enqueueJob } from "../../../../features/jobs/actions/enqueue-job.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { serverLogger } from "../../../../monitoring/index.js";
+/**
+ * The `jobType` registered in `JOB_RUNNERS`.
+ *
+ * 🛑 A constant shared by the enqueue and the registry, because a `jobType` is
+ * a STRING KEY matched by equality: a typo at either end produces a job
+ * document that is written, picked up, matched against nothing, and marked
+ * failed with "unknown job type" — which reads as a runner fault.
+ */
+export const STORE_VENDOR_REGISTER_JOB = "settlementVendorRegister";
+/**
+ * Everything that must happen when a store becomes `active`.
+ *
+ * Today that is exactly one thing. It is a named function rather than two lines
+ * in the route so a second activation side effect has somewhere to go that is
+ * not "another block in the admin PATCH handler" — and so there is one place to
+ * look when asking what approving a store does.
+ */
+export async function onStoreActivated(input) {
+    if (!input.storeSlug)
+        return;
+    try {
+        await enqueueJob({
+            jobType: STORE_VENDOR_REGISTER_JOB,
+            payload: { storeSlug: input.storeSlug },
+            requestedBy: input.actorUid,
+        });
+    }
+    catch (err) {
+        const normalized = normalizeError(err);
+        serverLogger.warn("onStoreActivated: settlement-vendor registration could not be enqueued — " +
+            "the store is approved; re-approve or re-run the job to register it", { storeSlug: input.storeSlug, error: normalized.message });
+    }
+}

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -27,7 +27,7 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  */
 export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "supportsShippingProtection", "supportsSaleProtection", "allowSharedPurchase", "sharedPurchaseHandlingFee", "sharedPurchaseExtraShippingPerDestination", "isVerified", "sellerTier", "standing", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["whatsappNotifySubscribed", "whatsappFeedEnabled", "trustedSeller", "acceptsPoints", "searchTxt", "updatedAt", "adminNotes", "statusHistory", "statusHistoryTruncated", "tierLockedByAdmin", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["whatsappNotifySubscribed", "whatsappFeedEnabled", "trustedSeller", "acceptsPoints", "searchTxt", "updatedAt", "adminNotes", "statusHistory", "statusHistoryTruncated", "tierLockedByAdmin", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt", "gstin", "legalName", "registeredAddress", "pan", "settlementVendors"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -251,6 +251,28 @@ export const PRIVATE_STORE_FIELDS = [
     "gstin",
     "legalName",
     "registeredAddress",
+    /*
+     * ── Split-settlement identity (Phase 3) ──────────────────────────────────
+     *
+     * 🛑 `pan` is the one field on this document whose disclosure has a LEGAL
+     * dimension rather than a commercial one. It is a government identity number
+     * for the seller, collected for exactly one purpose — onboarding them as a
+     * vendor with a splitting payment aggregator — and it has exactly one reader,
+     * `settlementVendorRegister`, which runs in a Firebase Function. It is
+     * ciphertext at rest (`STORE_PII_FIELDS`), so what this entry prevents is not
+     * a plaintext leak but an `enc:v1:…` blob in every store payload: still
+     * needless exposure, on the same reasoning that strips the raw credential
+     * blobs from `GET /api/admin/site`.
+     *
+     * 🛑 `settlementVendors` names an external account identifier inside this
+     * business's aggregator relationship, per gateway, with a refusal reason
+     * attached. Published, it would advertise which sellers an aggregator has
+     * declined — a fact about them we were told in confidence and that says
+     * nothing about their goods. It also has no public reader, which is this
+     * file's bar on its own.
+     */
+    "pan",
+    "settlementVendors",
 ];
 /** `createdAt` is `Date` on the document and `string` on the client types. */
 function toIsoString(value) {

package/dist/_internal/server/features/stores/data.d.ts

@@ -5,7 +5,7 @@ export declare const listStoreProductsInitial: (storeId: string, page?: number)
     items: import("../../../..").ProductDocument[];
     total: number;
 }>;
-export declare const listStoreAuctionsInitial: (storeId: string, page?: number) => Promise<{
+export declare const listStoreCollectorDropsInitial: (storeId: string, page?: number) => Promise<{
     items: import("../../../..").ProductDocument[];
     total: number;
 }>;

package/dist/_internal/server/features/stores/data.js

@@ -11,7 +11,7 @@ export const getStoreForDetail = cache(async (slug) => {
 });
 // Collapse of three near-identical 14-line functions via factory — export names unchanged.
 export const listStoreProductsInitial = makeGetStoreListingsInitial("standard", STORES_PRODUCTS_PAGE_SIZE);
-export const listStoreAuctionsInitial = makeGetStoreListingsInitial("auction", STORES_PRODUCTS_PAGE_SIZE);
+export const listStoreCollectorDropsInitial = makeGetStoreListingsInitial("collector-drop", STORES_PRODUCTS_PAGE_SIZE);
 export const listStorePreOrdersInitial = makeGetStoreListingsInitial("pre-order", STORES_PRODUCTS_PAGE_SIZE);
 /** Stores for sitemap generation. */
 export const listSitemapStores = cache(async () => {

package/dist/_internal/server/features/stores/index.d.ts

@@ -1,6 +1,7 @@
-export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores, } from "./data";
+export { getStoreForDetail, listStoreProductsInitial, listStoreCollectorDropsInitial, listStorePreOrdersInitial, listSitemapStores, } from "./data";
 export { STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, } from "../../../shared/features/stores/config";
 export { renderStoreOgImage, renderStoreOg, type StoreOgData } from "./og";
 export { resolveStoreFields, resolveStoreFieldsMany, type ProductStoreFields, } from "./denormalize";
 export { toStoreDetail, toStoreListItem, PUBLIC_STORE_FIELDS, PRIVATE_STORE_FIELDS, type ToStoreDetailOptions, type ToStoreListItemOptions, type StoreProjectionSource, } from "./adapters";
+export { onStoreActivated, STORE_VENDOR_REGISTER_JOB } from "./activation";
 export { resolveStoreTabs, getDefaultStoreTabPath, type ResolvedStoreTabs, type StoreTabLink, } from "./tabs";

package/dist/_internal/server/features/stores/index.js

@@ -1,6 +1,12 @@
-export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores, } from "./data.js";
+export { getStoreForDetail, listStoreProductsInitial, listStoreCollectorDropsInitial, listStorePreOrdersInitial, listSitemapStores, } from "./data.js";
 export { STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, } from "../../../shared/features/stores/config.js";
 export { renderStoreOgImage, renderStoreOg } from "./og.js";
 export { resolveStoreFields, resolveStoreFieldsMany, } from "./denormalize.js";
 export { toStoreDetail, toStoreListItem, PUBLIC_STORE_FIELDS, PRIVATE_STORE_FIELDS, } from "./adapters.js";
+/*
+ * The one named side effect of a store becoming active. Exported because the
+ * consumer owns the admin PATCH route, which is `setStatus`'s sole dispatcher
+ * and therefore the only place this can be called from today.
+ */
+export { onStoreActivated, STORE_VENDOR_REGISTER_JOB } from "./activation.js";
 export { resolveStoreTabs, getDefaultStoreTabPath, } from "./tabs.js";