@mohasinac/appkit 4.71.0 → 4.72.0

package/dist/_internal/shared/actions/action-registry.js

@@ -22,6 +22,7 @@
  * intentionally sparse so the W-2..W-4 sweeps can fill them surface-by-
  * surface without merge churn here.
  */
+import { rolesOf, holdsAnyRole } from "../../../features/auth/role-predicates.js";
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 /** Pluck an `ActionDef` by resource + id. Returns null when missing. */
 export function action(tree, resource, id) {
@@ -30,17 +31,32 @@ export function action(tree, resource, id) {
         return null;
     return bucket[id] ?? null;
 }
-/** Permission gate — returns true when the role may perform the action.
- *  Admin always passes. No `permissions` field = anyone authed passes. */
-export function canPerformAction(def, role) {
-    if (role === "admin")
+/**
+ * Gate — returns true when this user may perform the action.
+ *
+ * Admin always passes (admin sees and does everything). No `roles` field =
+ * anyone authenticated passes.
+ *
+ * 🛑 Reads the role SET (1.44). Was `role === "admin"` on a scalar plus
+ * `def.permissions.includes(role)`, so an action allowed to `["admin","seller"]`
+ * was refused to an admin+seller whose scalar resolved to the other value —
+ * and a `["admin","moderator"]` action was invisible to the `employee` that
+ * `moderator` folds into.
+ *
+ * Accepts a user carrier or a bare role string, so no caller has to change.
+ */
+export function canPerformAction(def, user) {
+    const carrier = typeof user === "string" ? { role: user } : (user ?? undefined);
+    const held = carrier ? rolesOf(carrier) : [];
+    const isAuthed = Boolean(typeof user === "string" ? user : user?.role || user?.roles?.length);
+    if (held.includes("admin"))
         return true;
-    if (!def.permissions || def.permissions.length === 0) {
-        return Boolean(role); // anyone authed
+    if (!def.roles || def.roles.length === 0) {
+        return isAuthed; // anyone authed
     }
-    if (!role)
+    if (!isAuthed)
         return false;
-    return def.permissions.includes(role);
+    return holdsAnyRole(carrier, def.roles);
 }
 /** Filter the registry to actions scoped to the given listingType. */
 export function actionsForListingType(tree, listingType) {
@@ -81,7 +97,7 @@ export const ACTIONS = {
             ariaLabel: "Book this ad slot for the selected month",
             description: "Reserves one placement for one month at the listed flat fee. The creative is reviewed by a person before it appears anywhere.",
             kind: "primary",
-            permissions: ["user"],
+            roles: ["user"],
             confirmation: {
                 title: "Book this slot?",
                 body: "This reserves the placement for the whole month at the listed price. Cancelling later does not release the month for someone else to buy.",
@@ -95,7 +111,7 @@ export const ACTIONS = {
             ariaLabel: "Cancel this ad booking",
             description: "Stops the creative running. 🛑 Does NOT free the month — the slot stays yours for the period you booked; releasing it is a separate admin act with a refund behind it.",
             kind: "danger",
-            permissions: ["user"],
+            roles: ["user"],
             confirmation: {
                 title: "Cancel this booking?",
                 body: "Your ad stops running. The month is NOT released for another advertiser, and this does not issue a refund on its own.",
@@ -109,7 +125,7 @@ export const ACTIONS = {
             ariaLabel: "Approve this ad creative so it can render",
             description: "Clears the creative to render for its booked month. Approval is of THIS creative — an edit returns it to review.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Approve this creative?",
                 body: "It will render on the public site for its booked month once the booking is paid.",
@@ -123,7 +139,7 @@ export const ACTIONS = {
             ariaLabel: "Reject this ad creative and tell the advertiser why",
             description: "Sends it back with your note. A note is REQUIRED — without one the advertiser resubmits the same creative and you review it twice.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject this creative?",
                 body: "The advertiser sees your note and can submit a new creative against the same booking. The slot stays theirs.",
@@ -153,7 +169,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new listing",
             description: "Create a listing of any type.",
             kind: "primary",
-            permissions: ["admin", "seller"],
+            roles: ["admin", "seller"],
         },
         edit: {
             iconKey: "edit",
@@ -162,7 +178,7 @@ export const ACTIONS = {
             ariaLabel: "Edit listing",
             description: "Edit this listing.",
             kind: "secondary",
-            permissions: ["admin", "seller"],
+            roles: ["admin", "seller"],
         },
         delete: {
             iconKey: "delete",
@@ -171,7 +187,7 @@ export const ACTIONS = {
             ariaLabel: "Delete listing",
             description: "Permanently delete this listing.",
             kind: "danger",
-            permissions: ["admin", "seller"],
+            roles: ["admin", "seller"],
             confirmation: {
                 title: "Delete this listing?",
                 body: "This cannot be undone. Orders that already reference it keep their own copy of the title, price and image, so past orders stay readable.",
@@ -182,7 +198,7 @@ export const ACTIONS = {
          * Clone — ADMIN ONLY, and no confirmation.
          *
          * `POST /api/store/products/[id]/duplicate` already strips identity,
-         * analytics, auction bid state and group membership, titles the copy
+         * analytics, collector drop bid state and group membership, titles the copy
          * "… (Copy)" and forces `status: "draft"`. So it creates a draft and
          * destroys nothing: a confirm dialog on a non-destructive action trains
          * people to dismiss confirm dialogs.
@@ -198,7 +214,7 @@ export const ACTIONS = {
             ariaLabel: "Duplicate this listing as a draft",
             description: "Copy this listing into a new draft, without its bids, analytics or group membership.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "add-to-cart": {
             iconKey: "cart",
@@ -207,7 +223,7 @@ export const ACTIONS = {
             ariaLabel: "Add to cart",
             description: "Add a standard listing to the buyer's cart.",
             kind: "primary",
-            listingTypeScope: ["standard", "pre-order", "prize-draw", "digital-code", "live"],
+            listingTypeScope: ["standard", "pre-order", "clearance", "digital-code", "live"],
         },
         "buy-now": {
             iconKey: "cart",
@@ -272,50 +288,50 @@ export const ACTIONS = {
             /*
              * Scope corrected 2026-08-31: this was `["classified"]`, but the button it
              * labels (`MakeOfferButton`) mounts on every type whose capability says
-             * `canMakeOffer` — which is standard, art and stickers as well. On
+             * `canMakeOffer` — which is standard and art-and-stickers as well. On
              * classified specifically it is the ONLY purchase path, and a seller who
              * has not opted into haggling receives a request to buy at the asking
              * price rather than a lower offer.
              */
             description: "Propose a price to the seller, or request to buy at the asking price.",
             kind: "secondary",
-            listingTypeScope: ["standard", "classified", "art", "stickers"],
+            listingTypeScope: ["standard", "classified", "art-and-stickers"],
         },
     },
-    AUCTION: {
+    COLLECTOR_DROP: {
         "place-bid": {
             iconKey: "bid",
-            id: "auction.place-bid",
+            id: "collectorDrop.place-bid",
             label: "Place bid",
-            description: "Submit a bid on an auction listing.",
+            description: "Submit a bid on a collector drop listing.",
             kind: "primary",
-            listingTypeScope: ["auction"],
+            listingTypeScope: ["collector-drop"],
         },
         "buy-it-now": {
             iconKey: "cart",
-            id: "auction.buy-it-now",
+            id: "collectorDrop.buy-it-now",
             label: "Buy It Now",
-            description: "Claim the listing at the buy-now price (SB-UNI-H). Offered while the auction is unsold, before its end date, and while the buy-now price still beats the standing bid. Places a bid at that price plus a 1h locked cart line — the auction stays live until the buyer pays.",
+            description: "Claim the listing at the buy-now price (SB-UNI-H). Offered while the collector drop is unsold, before its end date, and while the buy-now price still beats the standing bid. Places a bid at that price plus a 1h locked cart line — the collector drop stays live until the buyer pays.",
             kind: "secondary",
-            listingTypeScope: ["auction"],
+            listingTypeScope: ["collector-drop"],
         },
         "watch": {
             iconKey: "view",
-            id: "auction.watch",
-            label: "Watch auction",
-            ariaLabel: "Watch this auction",
-            description: "Subscribe to bid activity and ending-soon alerts for this auction.",
+            id: "collectorDrop.watch",
+            label: "Watch collector drop",
+            ariaLabel: "Watch this collector drop",
+            description: "Subscribe to bid activity and ending-soon alerts for this collector drop.",
             kind: "ghost",
-            listingTypeScope: ["auction"],
+            listingTypeScope: ["collector-drop"],
         },
         "unwatch": {
             iconKey: "hide",
-            id: "auction.unwatch",
+            id: "collectorDrop.unwatch",
             label: "Watching",
-            ariaLabel: "Stop watching this auction",
-            description: "Unsubscribe from bid activity alerts for this auction.",
+            ariaLabel: "Stop watching this collector drop",
+            description: "Unsubscribe from bid activity alerts for this collector drop.",
             kind: "ghost",
-            listingTypeScope: ["auction"],
+            listingTypeScope: ["collector-drop"],
         },
     },
     PRE_ORDER: {
@@ -350,30 +366,30 @@ export const ACTIONS = {
             },
         },
     },
-    PRIZE_DRAW: {
+    CLEARANCE: {
         "buy-now": {
             iconKey: "cart",
-            id: "prize-draw.buy-now",
+            id: "clearance.buy-now",
             label: "Buy now",
-            description: "Purchase a prize-draw entry directly (buyout — skips cart, goes to checkout).",
+            description: "Purchase a clearance entry directly (buyout — skips cart, goes to checkout).",
             kind: "primary",
-            listingTypeScope: ["prize-draw"],
+            listingTypeScope: ["clearance"],
         },
         "enter-draw": {
             iconKey: "confirm",
-            id: "prize-draw.enter-draw",
-            label: "Enter draw",
-            description: "Purchase an entry into the prize draw.",
+            id: "clearance.enter-draw",
+            label: "Claim a lot",
+            description: "Buy a lot — you receive a real item, allocated at random.",
             kind: "secondary",
-            listingTypeScope: ["prize-draw"],
+            listingTypeScope: ["clearance"],
         },
         "reveal-code": {
             iconKey: "view",
-            id: "prize-draw.reveal-code",
+            id: "clearance.reveal-code",
             label: "Reveal code",
-            description: "Reveal the buyer's prize-draw redemption code.",
+            description: "Reveal the buyer's clearance redemption code.",
             kind: "primary",
-            listingTypeScope: ["prize-draw"],
+            listingTypeScope: ["clearance"],
         },
     },
     /*
@@ -428,7 +444,7 @@ export const ACTIONS = {
             ariaLabel: "Edit bundle",
             description: "Edit this bundle.",
             kind: "secondary",
-            permissions: ["admin", "seller"],
+            roles: ["admin", "seller"],
             categoryTypeScope: ["bundle"],
         },
         delete: {
@@ -438,7 +454,7 @@ export const ACTIONS = {
             ariaLabel: "Delete bundle",
             description: "Permanently delete this bundle.",
             kind: "danger",
-            permissions: ["admin", "seller"],
+            roles: ["admin", "seller"],
             categoryTypeScope: ["bundle"],
             confirmation: {
                 title: "Delete this bundle?",
@@ -447,6 +463,24 @@ export const ACTIONS = {
                 confirmKind: "danger",
             },
         },
+        /*
+         * Phase 10 ("widget descriptors") — non-destructive, no confirmation.
+         * Records an `adminRow` RecentEntry via `recordVisit`; never a write to
+         * the bundle document itself. BUNDLE is one of only 5 `AdminRowResource`
+         * values (the others: CLEARANCE, BEY, PART, SUBLISTING) — the ones
+         * whose admin view resolves a row to a real URL via `rowHrefTemplate`,
+         * per `recent-entry.ts`'s own doc comment on why most resources are NOT
+         * eligible (`renderEditor`/`onRowClick` drawers have no URL to pin).
+         */
+        "pin-to-dashboard": {
+            iconKey: "save",
+            id: "bundle.pin-to-dashboard",
+            label: "Pin to dashboard",
+            ariaLabel: "Pin this bundle to the dashboard",
+            description: "Adds this bundle as a recency card on your dashboard landing — findable and reopenable without the admin table.",
+            kind: "secondary",
+            roles: ["admin"],
+        },
     },
     /*
      * These four buckets were literally `{}` for months while their editors
@@ -473,7 +507,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new grouped listing",
             description: "Create a new grouped listing.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         edit: {
             iconKey: "edit",
@@ -482,7 +516,7 @@ export const ACTIONS = {
             ariaLabel: "Edit grouped listing",
             description: "Edit this grouped listing.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         delete: {
             iconKey: "delete",
@@ -491,7 +525,7 @@ export const ACTIONS = {
             ariaLabel: "Delete grouped listing",
             description: "Permanently delete this grouped listing.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this grouped listing?",
                 body: "This cannot be undone. Member listings are not deleted — only the group that ties them together.",
@@ -531,7 +565,7 @@ export const ACTIONS = {
             ariaLabel: "Edit part",
             description: "Correct this part's recorded details. The correction is kept when the database is regenerated.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         delete: {
             iconKey: "delete",
@@ -540,7 +574,7 @@ export const ACTIONS = {
             ariaLabel: "Delete part",
             description: "Remove this part from the live database.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Remove this part from the live database?",
                 body: "Beyblades built from it keep their parts list and will show its name without a link. " +
@@ -572,7 +606,7 @@ export const ACTIONS = {
             ariaLabel: "Edit FAQ",
             description: "Correct this question or its answer.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         delete: {
             iconKey: "delete",
@@ -581,7 +615,7 @@ export const ACTIONS = {
             ariaLabel: "Delete FAQ",
             description: "Remove this question from the help centre.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Remove this question from the help centre?",
                 /*
@@ -613,7 +647,7 @@ export const ACTIONS = {
             ariaLabel: "Edit Beyblade",
             description: "Correct this Beyblade's recorded details. The correction is kept when the database is regenerated.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         delete: {
             iconKey: "delete",
@@ -622,7 +656,7 @@ export const ACTIONS = {
             ariaLabel: "Delete Beyblade",
             description: "Remove this Beyblade from the live database.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Remove this Beyblade from the live database?",
                 body: "Its category page and any listings under it are not touched, and boxed sets that include " +
@@ -649,7 +683,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new category",
             description: "Create a new category.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
             categoryTypeScope: ["category"],
         },
         edit: {
@@ -659,7 +693,7 @@ export const ACTIONS = {
             ariaLabel: "Edit category",
             description: "Edit this category.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             categoryTypeScope: ["category"],
         },
         delete: {
@@ -669,7 +703,7 @@ export const ACTIONS = {
             ariaLabel: "Delete category",
             description: "Permanently delete this category.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this category?",
                 body: "This cannot be undone. Listings filed under it are not deleted, but they will no longer appear on this category page.",
@@ -695,7 +729,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new brand",
             description: "Create a new brand.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
             categoryTypeScope: ["brand"],
         },
         edit: {
@@ -705,7 +739,7 @@ export const ACTIONS = {
             ariaLabel: "Edit brand",
             description: "Edit this brand.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             categoryTypeScope: ["brand"],
         },
         delete: {
@@ -715,7 +749,7 @@ export const ACTIONS = {
             ariaLabel: "Delete brand",
             description: "Permanently delete this brand.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this brand?",
                 body: "This cannot be undone. Products keep their `brand` string, so they will be orphaned from every brand page until re-filed.",
@@ -741,7 +775,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new sub-listing",
             description: "Create a new sub-listing.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
             categoryTypeScope: ["sublisting"],
         },
         edit: {
@@ -751,7 +785,7 @@ export const ACTIONS = {
             ariaLabel: "Edit sub-listing",
             description: "Edit this sub-listing.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             categoryTypeScope: ["sublisting"],
         },
         delete: {
@@ -761,7 +795,7 @@ export const ACTIONS = {
             ariaLabel: "Delete sub-listing",
             description: "Permanently delete this sub-listing.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this sub-listing?",
                 body: "This cannot be undone.",
@@ -819,7 +853,7 @@ export const ACTIONS = {
             ariaLabel: "Fill the description from this category template",
             description: "Fill the description field from the category's description template, with the listing's own details interpolated.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "replace-description": {
             iconKey: "edit",
@@ -837,7 +871,7 @@ export const ACTIONS = {
              * with the action and is translatable.
              */
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Replace what you have written?",
                 body: "The description you typed will be overwritten by the category template. This cannot be undone.",
@@ -853,7 +887,7 @@ export const ACTIONS = {
             ariaLabel: "Accept this offer",
             description: "Accept a buyer's offer on a classified listing.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "reject-offer": {
             iconKey: "reject",
@@ -862,7 +896,7 @@ export const ACTIONS = {
             ariaLabel: "Reject this offer",
             description: "Reject a buyer's offer on a classified listing.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Reject this offer?",
                 body: "The buyer will be notified that their offer was declined.",
@@ -877,7 +911,7 @@ export const ACTIONS = {
             ariaLabel: "Counter this offer",
             description: "Send a counter-offer to the buyer.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         // ── Payout view ──────────────────────────────────────────────────────
         "view-payout": {
@@ -887,7 +921,7 @@ export const ACTIONS = {
             ariaLabel: "View payout details",
             description: "View the details of a payout.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "export-payout": {
             iconKey: "export",
@@ -896,7 +930,7 @@ export const ACTIONS = {
             ariaLabel: "Export payout details",
             description: "Download payout details as a file.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "set-payout-reminder": {
             iconKey: "settings",
@@ -905,7 +939,7 @@ export const ACTIONS = {
             ariaLabel: "Toggle a follow-up reminder on this payout",
             description: "Flag this payout for a personal follow-up reminder.",
             kind: "ghost",
-            permissions: ["seller"],
+            roles: ["seller"],
         },
         // ── Review management ───────────────────────────────────────────────
         "reply-review": {
@@ -915,7 +949,7 @@ export const ACTIONS = {
             ariaLabel: "Reply to this review",
             description: "Post or edit a public store reply to a buyer's review.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "contest-review": {
             iconKey: "report",
@@ -924,7 +958,7 @@ export const ACTIONS = {
             ariaLabel: "Contest this review",
             description: "Flag a review for admin investigation.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "buyer-feedback": {
             iconKey: "message",
@@ -933,7 +967,7 @@ export const ACTIONS = {
             ariaLabel: "Send feedback to buyer",
             description: "Send a private message to the buyer's notification inbox.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         // ── WhatsApp integration ────────────────────────────────────────────
         "whatsapp-connect": {
@@ -943,7 +977,7 @@ export const ACTIONS = {
             ariaLabel: "Save WhatsApp credentials and connect",
             description: "Save WhatsApp Business credentials and establish connection.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "whatsapp-catalog-sync": {
             iconKey: "retry",
@@ -952,7 +986,7 @@ export const ACTIONS = {
             ariaLabel: "Sync products to WhatsApp catalog",
             description: "Push published standard products to WhatsApp Business Catalog.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "whatsapp-catalog-import": {
             iconKey: "upload",
@@ -961,7 +995,7 @@ export const ACTIONS = {
             ariaLabel: "Import products from WhatsApp catalog",
             description: "Import products from WhatsApp Catalog as drafts.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         // ── Google Reviews integration ──────────────────────────────────────
         "google-reviews-sync": {
@@ -971,7 +1005,7 @@ export const ACTIONS = {
             ariaLabel: "Sync Google Business reviews",
             description: "Pull latest reviews from Google Business profile.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "save-google-settings": {
             iconKey: "save",
@@ -980,7 +1014,7 @@ export const ACTIONS = {
             ariaLabel: "Save Google Business settings",
             description: "Save Google Business profile configuration.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         // ── Refresh ─────────────────────────────────────────────────────────
         "refresh-offers": {
@@ -990,7 +1024,7 @@ export const ACTIONS = {
             ariaLabel: "Refresh offers list",
             description: "Reload latest offers and statuses.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "edit-listing": {
             iconKey: "edit",
@@ -999,7 +1033,7 @@ export const ACTIONS = {
             ariaLabel: "Edit listing",
             description: "Navigate to the edit form for this store listing.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "delete-listing": {
             iconKey: "delete",
@@ -1008,7 +1042,7 @@ export const ACTIONS = {
             ariaLabel: "Delete listing",
             description: "Permanently delete this store listing.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Delete listing?",
                 body: "This listing will be permanently removed. This action cannot be undone.",
@@ -1022,7 +1056,7 @@ export const ACTIONS = {
             label: "Publish",
             description: "Make this listing visible to buyers.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "unpublish-listing": {
             iconKey: "hide",
@@ -1030,7 +1064,7 @@ export const ACTIONS = {
             label: "Unpublish",
             description: "Hide this listing from buyers.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "mark-shipped": {
             iconKey: "ship",
@@ -1038,7 +1072,7 @@ export const ACTIONS = {
             label: "Mark as shipped",
             description: "Update an order status to shipped and enter tracking info.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "dispatch-custom": {
             iconKey: "ship",
@@ -1047,7 +1081,7 @@ export const ACTIONS = {
             ariaLabel: "Record a parcel you posted yourself",
             description: "Record the carrier and tracking id for a parcel the seller posted themselves.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "dispatch-platform": {
             iconKey: "ship",
@@ -1056,7 +1090,7 @@ export const ACTIONS = {
             ariaLabel: "Book this parcel through the platform's courier account",
             description: "Book a pickup on the platform's own carrier account. The tracking id comes back from the courier.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             /*
              * 🛑 Confirmed because it SPENDS MONEY and cannot be undone from this
              * screen. A booking debits the platform's carrier wallet and schedules
@@ -1077,7 +1111,7 @@ export const ACTIONS = {
             ariaLabel: "Mark this EMI installment as paid",
             description: "Record collection of one EMI installment after verifying the buyer's manual transfer proof.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Mark this installment as paid?",
                 body: "This confirms the buyer's payment was received and verified. The order becomes eligible to ship once every installment is marked paid.",
@@ -1091,7 +1125,7 @@ export const ACTIONS = {
             label: "Request payout",
             description: "Submit a payout request for available store earnings.",
             kind: "primary",
-            permissions: ["seller"],
+            roles: ["seller"],
         },
         "save-changes": {
             iconKey: "save",
@@ -1099,7 +1133,7 @@ export const ACTIONS = {
             label: "Save changes",
             description: "Submit the store listing or settings form.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "print-labels": {
             iconKey: "export",
@@ -1108,7 +1142,7 @@ export const ACTIONS = {
             ariaLabel: "Print inventory labels for selected products",
             description: "Open the print page for inventory labels for the selected products.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         /*
          * D13 — assemble a complete bey from component listings, and part one back
@@ -1125,7 +1159,7 @@ export const ACTIONS = {
             ariaLabel: "Build this listing from component parts in your inventory",
             description: "Build one or more of this listing from parts you already hold. Each component's stock is decremented; units already reserved by unpaid orders are never consumed.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "part-out-listing": {
             iconKey: "delete",
@@ -1134,7 +1168,7 @@ export const ACTIONS = {
             ariaLabel: "Break this listing down into its component parts",
             description: "Break this listing down and add its parts back to inventory. The complete listing's stock is decremented.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Part this out?",
                 /*
@@ -1153,7 +1187,7 @@ export const ACTIONS = {
             ariaLabel: "Set stock quantity for selected products",
             description: "Set the same stock quantity on every selected listing. Units already reserved by unpaid orders stay reserved.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "set-location": {
             iconKey: "settings",
@@ -1162,7 +1196,7 @@ export const ACTIONS = {
             ariaLabel: "Set physical storage location for selected items",
             description: "Assign zone, shelf, and bin for the selected inventory items.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "print-packing-slips": {
             iconKey: "export",
@@ -1171,7 +1205,7 @@ export const ACTIONS = {
             ariaLabel: "Print packing slips for selected orders",
             description: "Open the print page for packing slip labels for the selected orders.",
             kind: "secondary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "open-print-center": {
             iconKey: "view",
@@ -1180,7 +1214,7 @@ export const ACTIONS = {
             ariaLabel: "Open the Print & Label Center",
             description: "Open the Print & Label Center for this store.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         // SB-UNI-W follow-up (plan §7) — leaves for the 11 unwired store-dashboard
         // form/row CTAs identified by the W-3 sweep.
@@ -1191,7 +1225,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new product template",
             description: "Submit the new-template form.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "update-template": {
             iconKey: "edit",
@@ -1200,7 +1234,7 @@ export const ACTIONS = {
             ariaLabel: "Save changes to template",
             description: "Submit the edit-template form.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "edit-template": {
             iconKey: "edit",
@@ -1209,7 +1243,7 @@ export const ACTIONS = {
             ariaLabel: "Edit template",
             description: "Open the edit-template drawer for this row.",
             kind: "ghost",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "delete-template": {
             iconKey: "delete",
@@ -1218,7 +1252,7 @@ export const ACTIONS = {
             ariaLabel: "Delete template",
             description: "Permanently remove this template.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Delete template?",
                 body: "This template will be permanently removed. Existing products created from it are unaffected. This action cannot be undone.",
@@ -1233,7 +1267,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new bundle",
             description: "Submit the new-bundle form.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "create-feature": {
             iconKey: "create",
@@ -1242,7 +1276,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new product feature badge",
             description: "Submit the new-feature form.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "update-slug": {
             iconKey: "edit",
@@ -1251,7 +1285,7 @@ export const ACTIONS = {
             ariaLabel: "Update store slug",
             description: "Submit the slug-change form. Caution: existing links will redirect.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Update store slug?",
                 body: "Existing links that reference the old slug will start redirecting. Make sure to update social bios and external listings.",
@@ -1266,7 +1300,7 @@ export const ACTIONS = {
             ariaLabel: "Delete sublisting category",
             description: "Permanently remove this sublisting category from the store.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Delete sublisting category?",
                 body: "Products tagged with this category will lose the tag. This action cannot be undone.",
@@ -1286,7 +1320,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this analytics alert",
             description: "Permanently removes this alert rule. Past notifications are unaffected.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Delete this alert?",
                 body: "You will stop being notified when this rule matches. Alerts already sent are unaffected. This cannot be undone.",
@@ -1309,7 +1343,7 @@ export const ACTIONS = {
             ariaLabel: "Open the new-template drawer",
             description: "Open the new-template creation drawer.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
     },
     BLOG: {
@@ -1326,7 +1360,7 @@ export const ACTIONS = {
             ariaLabel: "Duplicate this post as a draft",
             description: "Copy this post into a new draft, without its views or featured flag.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "create-post": {
             iconKey: "create",
@@ -1335,7 +1369,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new blog post",
             description: "Navigate to the blog post editor.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "edit-post": {
             iconKey: "edit",
@@ -1344,7 +1378,7 @@ export const ACTIONS = {
             ariaLabel: "Edit this blog post",
             description: "Open the editor for a blog post.",
             kind: "ghost",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "delete-post": {
             iconKey: "delete",
@@ -1353,7 +1387,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this blog post",
             description: "Permanently delete a blog post.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Delete this post?",
                 body: "This blog post will be permanently removed. This action cannot be undone.",
@@ -1406,7 +1440,7 @@ export const ACTIONS = {
          * Clone, admin-only, backed by POST /api/admin/events/[id]/duplicate. A
          * recurring sale is the real use case: same copy, same prizes, new dates.
          *
-         * 🛑 The endpoint rebuilds every lottery slot from its prize definition and
+         * 🛑 The endpoint rebuilds every giveaway slot from its prize definition and
          * resets the booking half — a spread would attribute a real buyer’s
          * purchased slot to a brand-new event.
          */
@@ -1417,7 +1451,7 @@ export const ACTIONS = {
             ariaLabel: "Duplicate this event as a draft",
             description: "Copy this event into a new draft, without its entries, winner or slot bookings.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         /*
          * This bucket had only register / cancel-registration / draw-raffle-winner
@@ -1432,7 +1466,7 @@ export const ACTIONS = {
             ariaLabel: "Edit event",
             description: "Edit this event.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         delete: {
             iconKey: "delete",
@@ -1441,7 +1475,7 @@ export const ACTIONS = {
             ariaLabel: "Delete event",
             description: "Permanently delete this event.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this event?",
                 body: "This cannot be undone. Entries already recorded against it are removed with it, so a participant loses their place.",
@@ -1472,7 +1506,7 @@ export const ACTIONS = {
         /*
          * The raffle draw. Added 2026-10-19 — before this there was NO control to
          * draw a raffle anywhere in the product: the endpoint and its
-         * `ADMIN_ENDPOINTS.EVENT_TRIGGER_RAFFLE` constant existed with zero
+         * `ADMIN_ENDPOINTS.EVENT_TRIGGER_GIVEAWAY` constant existed with zero
          * callers, and the tester case whose step 3 reads "trigger the raffle
          * draw" was literally unexecutable.
          *
@@ -1486,14 +1520,14 @@ export const ACTIONS = {
         "draw-raffle-winner": {
             iconKey: "verify",
             id: "event.draw-raffle-winner",
-            label: "Draw raffle winner",
+            label: "Draw giveaway winner",
             ariaLabel: "Pick a random winner from the approved entries",
             description: "Picks one winner at random from this event's approved entries, records them on the event, and notifies them.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
-                title: "Draw the raffle winner?",
-                body: "One winner will be picked at random from the approved entries, announced on the event page, and notified. A raffle can only be drawn once — this action cannot be undone.",
+                title: "Draw the giveaway winner?",
+                body: "One winner will be picked at random from the approved entries, announced on the event page, and notified. A giveaway can only be drawn once — this action cannot be undone.",
                 confirmLabel: "Yes, draw the winner",
                 confirmKind: "danger",
             },
@@ -1722,9 +1756,9 @@ export const ACTIONS = {
             id: "seller.cancel-bid",
             label: "Cancel selected",
             ariaLabel: "Cancel selected bids",
-            description: "Cancel the selected bids from this store's auctions.",
+            description: "Cancel the selected bids from this store's collector drops.",
             kind: "danger",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
             confirmation: {
                 title: "Cancel these bids?",
                 body: "The selected bids will be cancelled and bidders will be notified.",
@@ -1741,7 +1775,7 @@ export const ACTIONS = {
             ariaLabel: "Create a new procurement shipment",
             description: "Start tracking a new import shipment.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "mark-received": {
             iconKey: "confirm",
@@ -1750,7 +1784,7 @@ export const ACTIONS = {
             ariaLabel: "Mark this shipment as received",
             description: "Flags the shipment as physically received so processing can begin.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "unlink-item": {
             iconKey: "link",
@@ -1759,7 +1793,7 @@ export const ACTIONS = {
             ariaLabel: "Unlink this item from its product",
             description: "Clears the product link on this shipment item without touching the product itself.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "delete": {
             iconKey: "delete",
@@ -1768,7 +1802,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this shipment",
             description: "Permanently deletes the shipment and all its lots/items.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this shipment?",
                 body: "This permanently removes the shipment and all its lots and items. This cannot be undone. Items still linked to a product must be unlinked first.",
@@ -1792,7 +1826,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this lot and its items",
             description: "Permanently deletes this lot and every item in it.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this lot?",
                 body: "This permanently removes the lot and every item in it. The rest of the shipment is untouched. Items still linked to a product must be unlinked first.",
@@ -1809,7 +1843,7 @@ export const ACTIONS = {
             ariaLabel: "List this catalogue item directly",
             description: "Seller-only — turns a catalogue item into a real listing under your own store immediately.",
             kind: "primary",
-            permissions: ["seller", "admin"],
+            roles: ["seller", "admin"],
         },
         "submit-for-approval": {
             iconKey: "send",
@@ -1826,7 +1860,7 @@ export const ACTIONS = {
             ariaLabel: "Unlink this catalogue item from its product",
             description: "Clears the product link on this catalogue item without touching the product itself.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "delete": {
             iconKey: "delete",
@@ -1849,7 +1883,7 @@ export const ACTIONS = {
             ariaLabel: "Approve this catalogue listing request",
             description: "Creates the product under the platform's consignment store and marks the item listed.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "reject": {
             iconKey: "reject",
@@ -1858,7 +1892,7 @@ export const ACTIONS = {
             ariaLabel: "Reject this catalogue listing request",
             description: "Declines the request and records a reason the owner can see.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Reject this listing request?",
                 body: "The owner will see your rejection reason.",
@@ -1893,7 +1927,7 @@ export const ACTIONS = {
             ariaLabel: "Enable this integration",
             description: "Turn an integration on. Writes the authoritative settings field for it.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "invalidate-cache": {
             // `retry` — the icon registry has no `refresh`/`reload`/`sync` key, and
@@ -1905,7 +1939,7 @@ export const ACTIONS = {
             ariaLabel: "Mark every cached public page stale",
             description: "Mark every cached public page stale so the next visitor gets a freshly rendered one. Use after a bulk data change the Firestore triggers could not see — a seed load, a direct Firestore edit, or a catalogue purge.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             /*
              * 🛑 A confirmation on a NON-destructive action, because the cost is
              * real and invisible at the click.
@@ -1923,6 +1957,21 @@ export const ACTIONS = {
                 confirmLabel: "Invalidate all",
             },
         },
+        "clear-repository-cache": {
+            // Item 8 §18 (overhaul brief) — the CacheManager in-memory read cache
+            // (site settings, products), a different layer entirely from
+            // `invalidate-cache`'s Next.js page/ISR cache above. No confirmation:
+            // unlike that one, this has no production cost either way — a cleared
+            // key just means the next read is a cache miss, one Firestore round
+            // trip, bounded by the same TTL that already governs it.
+            iconKey: "retry",
+            id: "admin.clear-repository-cache",
+            label: "Clear",
+            ariaLabel: "Clear this cache entry",
+            description: "Delete one cached read-cache entry (or every entry sharing a repository's key prefix) so the next read goes to Firestore instead of the in-memory cache.",
+            kind: "secondary",
+            roles: ["admin"],
+        },
         "update-pricing": {
             iconKey: "save",
             id: "admin.update-pricing",
@@ -1930,7 +1979,7 @@ export const ACTIONS = {
             ariaLabel: "Save the new rate",
             description: "Change one platform rate from now on. Orders, invoices and payouts already recorded keep the rate they were charged at — a rate change never restates history.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
             /*
              * 🛑 A confirmation even though `kind` is "primary" rather than "danger".
              * The registry requires one for destructive actions; this one is here
@@ -1951,7 +2000,7 @@ export const ACTIONS = {
             ariaLabel: "Add a dispute reason",
             description: "Add a reason buyers can pick when reporting a problem. The reason's KIND decides which gate it is subject to; the wording is yours.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "retire-dispute-reason": {
             iconKey: "reject",
@@ -1960,7 +2009,7 @@ export const ACTIONS = {
             ariaLabel: "Retire this dispute reason",
             description: "Take a reason out of the buyer's picker. Never a delete — past disputes name it, and the order snapshots its label so history survives either way.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Retire this reason?",
                 /*
@@ -1981,7 +2030,7 @@ export const ACTIONS = {
             ariaLabel: "Put this dispute reason back in the picker",
             description: "Offer a retired reason to buyers again. The original author is kept.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "disable-integration": {
             iconKey: "reject",
@@ -1990,7 +2039,7 @@ export const ACTIONS = {
             ariaLabel: "Disable this integration",
             description: "Turn an integration off. The consequence differs per integration and is stated on the row.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Switch this integration off?",
                 body: "",
@@ -2005,7 +2054,7 @@ export const ACTIONS = {
             ariaLabel: "Enable every integration",
             description: "Turn every integration on in a single write.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Enable every integration?",
                 body: "Online payments, customer email, courier booking and the support surface will all be switched on. One write, one audit-log entry.",
@@ -2019,7 +2068,7 @@ export const ACTIONS = {
             ariaLabel: "Disable every integration",
             description: "Turn every integration off in a single write.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Disable every integration?",
                 body: "This stops online payments, customer email and courier booking, and hides the buyer support surface. 🛑 Payments already in progress are abandoned — a buyer part-way through the gateway may be charged with no order placed. Staff email and open tickets stay workable. One write, one audit-log entry.",
@@ -2035,7 +2084,7 @@ export const ACTIONS = {
             ariaLabel: "Approve listing",
             description: "Mark a pending product listing as approved and visible to buyers.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "reject-product": {
             iconKey: "reject",
@@ -2044,7 +2093,7 @@ export const ACTIONS = {
             ariaLabel: "Reject listing",
             description: "Reject a product listing and notify the seller with a reason.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject this listing?",
                 body: "The listing will be rejected and the seller will be notified. You can restore it later.",
@@ -2060,7 +2109,7 @@ export const ACTIONS = {
             ariaLabel: "Ban this user",
             description: "Soft-ban a user account — blocks login and all marketplace activity.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Ban this user?",
                 body: "The user will be blocked from logging in and all marketplace activity. You can lift the ban later.",
@@ -2075,7 +2124,7 @@ export const ACTIONS = {
             ariaLabel: "Lift ban on this user",
             description: "Remove a soft-ban and restore normal account access.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         /**
          * Credit or debit a buyer's points by hand — `admin_adjustment`'s first
@@ -2099,7 +2148,7 @@ export const ACTIONS = {
             ariaLabel: "Credit or debit this user's points",
             description: "Credit or debit a buyer's points balance, with a reason recorded in the ledger and the admin audit log.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "bulk-suspend-users": {
             iconKey: "ban",
@@ -2108,7 +2157,7 @@ export const ACTIONS = {
             ariaLabel: "Suspend selected users",
             description: "Disable login for the selected accounts.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Suspend these users?",
                 body: "Selected accounts will be disabled from logging in. You can restore them later.",
@@ -2123,7 +2172,7 @@ export const ACTIONS = {
             ariaLabel: "Restore selected users",
             description: "Re-enable login for the selected accounts.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "bulk-delete-users": {
             iconKey: "delete",
@@ -2132,7 +2181,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected users",
             description: "Disable the selected accounts.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these users?",
                 body: "Selected accounts will be disabled. Their data (orders, reviews) is preserved — this does not permanently erase the account.",
@@ -2147,7 +2196,7 @@ export const ACTIONS = {
             ariaLabel: "Mark payment as received and verified",
             description: "Confirms manual cash/UPI payment was received. Moves order to Processing.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Verify payment?",
                 body: "This marks the payment as received. The order will move to Processing. This action cannot be undone.",
@@ -2161,7 +2210,7 @@ export const ACTIONS = {
             ariaLabel: "Ask the buyer to re-upload a corrected payment proof",
             description: "Clears the current proof and gives the buyer 15 more minutes to resubmit — for honest mistakes (blurry screenshot, wrong amount), not fraud.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Request a proof re-upload?",
                 body: "The buyer's current proof will be cleared and they'll get 15 more minutes to resubmit. Use this for honest mistakes, not suspected fraud.",
@@ -2175,7 +2224,7 @@ export const ACTIONS = {
             ariaLabel: "Reject this payment proof as fraudulent, cancel the order, and ban the account",
             description: "Cancels the order, restores stock, and triggers a temporary 7-day full-account ban. Use only for suspected deliberate fraud, not honest mistakes.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject as fraudulent?",
                 body: "This cancels the order, returns the item to stock, and suspends the buyer's account for 7 days. This is severe — use only for suspected deliberate fraud, not an honest mistake.",
@@ -2202,7 +2251,7 @@ export const ACTIONS = {
             ariaLabel: "Accept the pre-order balance payment proof",
             description: "Confirms the pre-order balance was received. The order becomes shippable. Does NOT post a ledger entry — the sale was recognised in full at order creation.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Accept the balance payment?",
                 body: "This records the remaining balance as received and clears the order to ship. Check the reference against your bank first.",
@@ -2216,7 +2265,7 @@ export const ACTIONS = {
             ariaLabel: "Reject the pre-order balance proof and ask the buyer to resend",
             description: "Sends the proof back with your note. The buyer can submit again — no cancellation, no stock change, no ban: the goods are already made and allocated to them.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject this balance proof?",
                 body: "The buyer is told why and can send another. The order stays open and the item stays theirs.",
@@ -2230,7 +2279,7 @@ export const ACTIONS = {
             ariaLabel: "Grant verified-vendor status",
             description: "Grant verified-vendor badge to a seller account.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "unverify-vendor": {
             iconKey: "reject",
@@ -2239,7 +2288,7 @@ export const ACTIONS = {
             ariaLabel: "Revoke verified-vendor status",
             description: "Revoke the verified-vendor badge from a seller account.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Remove vendor verification?",
                 body: "The verified badge will be removed from this seller's store.",
@@ -2255,7 +2304,7 @@ export const ACTIONS = {
             ariaLabel: "Verify this store",
             description: "Grant verified status to a store.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "suspend-store": {
             iconKey: "ban",
@@ -2264,7 +2313,7 @@ export const ACTIONS = {
             ariaLabel: "Suspend this store",
             description: "Suspend a store — hides all its listings from buyers.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Suspend this store?",
                 body: "All listings from this store will be hidden. The seller will be notified.",
@@ -2295,7 +2344,7 @@ export const ACTIONS = {
             ariaLabel: "Approve this store and make it public",
             description: "Approve a pending store — sets it active and makes its listings visible to buyers.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Approve this store?",
                 body: "The store becomes active and its listings become visible to buyers. The seller will be notified.",
@@ -2309,7 +2358,7 @@ export const ACTIONS = {
             ariaLabel: "Reject this store application",
             description: "Reject a pending store application — the store stays hidden from buyers.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Reject this store application?",
                 body: "The store will not be published and the seller will be notified. You can approve it later if they resolve the issue.",
@@ -2325,7 +2374,7 @@ export const ACTIONS = {
             ariaLabel: "Approve review",
             description: "Publish a pending product review.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "reject-review": {
             iconKey: "reject",
@@ -2334,7 +2383,7 @@ export const ACTIONS = {
             ariaLabel: "Reject review",
             description: "Reject a product review and prevent it from being shown.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject this review?",
                 body: "The review will be hidden from the product page.",
@@ -2350,7 +2399,7 @@ export const ACTIONS = {
             ariaLabel: "Approve return request",
             description: "Approve a return request and initiate the refund flow.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             // Required by Rule #7 — approving starts a real refund, which is money
             // leaving the platform and is not undoable from this screen. Its absence
             // also CRASHED /admin/return-requests outright: the view reads
@@ -2370,7 +2419,7 @@ export const ACTIONS = {
             ariaLabel: "Reject return request",
             description: "Reject a return request with a reason.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject return request?",
                 body: "The return request will be declined and the buyer will be notified.",
@@ -2386,7 +2435,7 @@ export const ACTIONS = {
             ariaLabel: "Run the weekly payout eligibility calculation",
             description: "Runs the same weekly sweep as the scheduled job on demand, generating pending payout records for eligible sellers.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "grant-payout": {
             iconKey: "approve",
@@ -2395,7 +2444,7 @@ export const ACTIONS = {
             ariaLabel: "Approve payout request",
             description: "Approve a seller payout request and trigger the transfer.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "hold-payout": {
             iconKey: "pause",
@@ -2404,7 +2453,7 @@ export const ACTIONS = {
             ariaLabel: "Put payout on hold",
             description: "Put a payout request on hold pending investigation.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Hold this payout?",
                 body: "The payout will be paused. The seller will be notified.",
@@ -2420,7 +2469,7 @@ export const ACTIONS = {
             ariaLabel: "Trigger bundle stock rebuild",
             description: "Recalculate bundle availability from its constituent product stock.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         // ── Dev / system ───────────────────────────────────────────────────────
         "reset-seed-data": {
@@ -2430,7 +2479,7 @@ export const ACTIONS = {
             ariaLabel: "Clear and re-seed Firestore",
             description: "Delete all seeded documents and reload from seed fixtures. Dev environments only.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Reset all seed data?",
                 body: "Every seeded document will be deleted and reloaded from fixtures. This cannot be undone. Only use this in a development environment.",
@@ -2445,7 +2494,7 @@ export const ACTIONS = {
             label: "Save changes",
             description: "Submit any admin editor form.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "export-csv": {
             iconKey: "export",
@@ -2454,7 +2503,7 @@ export const ACTIONS = {
             ariaLabel: "Export data as CSV",
             description: "Download the current view's data as a CSV file.",
             kind: "ghost",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Order management ──────────────────────────────────────────────────
         "mark-shipped": {
@@ -2464,7 +2513,7 @@ export const ACTIONS = {
             ariaLabel: "Mark order as shipped",
             description: "Update an order status to shipped.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "mark-delivered": {
             iconKey: "ship",
@@ -2473,7 +2522,7 @@ export const ACTIONS = {
             ariaLabel: "Mark order as delivered",
             description: "Update an order status to delivered.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "mark-installment-paid": {
             iconKey: "confirm",
@@ -2482,7 +2531,7 @@ export const ACTIONS = {
             ariaLabel: "Mark this EMI installment as paid",
             description: "Record collection of one EMI installment after verifying the buyer's manual transfer proof.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Mark this installment as paid?",
                 body: "This confirms the buyer's payment was received and verified. The order becomes eligible to ship once every installment is marked paid.",
@@ -2497,7 +2546,7 @@ export const ACTIONS = {
             ariaLabel: "Cancel selected orders",
             description: "Cancel one or more pending orders.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Cancel these orders?",
                 body: "The selected orders will be cancelled. Refunds are processed within 5–7 business days.",
@@ -2513,7 +2562,7 @@ export const ACTIONS = {
             ariaLabel: "Mark payout as paid",
             description: "Mark a payout as paid after transfer has been completed.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         // ── Session management ────────────────────────────────────────────────
         "revoke-session": {
@@ -2523,7 +2572,7 @@ export const ACTIONS = {
             ariaLabel: "Revoke selected sessions",
             description: "Force-end one or more active user sessions.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Revoke these sessions?",
                 body: "The selected sessions will be terminated. Users will need to sign in again.",
@@ -2539,7 +2588,7 @@ export const ACTIONS = {
             ariaLabel: "Mark selected notifications as read",
             description: "Mark one or more notifications as read.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "delete-notification": {
             iconKey: "delete",
@@ -2548,7 +2597,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected notifications",
             description: "Permanently delete one or more notifications.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these notifications?",
                 body: "The selected notifications will be permanently removed.",
@@ -2564,7 +2613,7 @@ export const ACTIONS = {
             ariaLabel: "Mark this tester feedback as reviewed",
             description: "Mark a tester feedback submission as reviewed by the dev team.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "export-tester-feedback": {
             iconKey: "export",
@@ -2573,7 +2622,7 @@ export const ACTIONS = {
             ariaLabel: "Download tester feedback as a Markdown report",
             description: "Download every tester checklist response as a Markdown file, grouped by feature area, for offline triage.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "export-event-entries": {
             iconKey: "export",
@@ -2582,7 +2631,7 @@ export const ACTIONS = {
             ariaLabel: "Download this event's entries as a Markdown report",
             description: "Download an event's entries as a Markdown file — a per-option vote tally for polls, or individual entries (submitter, status, points, responses) for every other event type.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "create-checklist-item": {
             iconKey: "create",
@@ -2591,7 +2640,7 @@ export const ACTIONS = {
             ariaLabel: "Add a new tester checklist item",
             description: "Create a new test case in the tester QA checklist catalog.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "edit-checklist-item": {
             iconKey: "edit",
@@ -2600,7 +2649,7 @@ export const ACTIONS = {
             ariaLabel: "Edit this tester checklist item",
             description: "Edit an existing test case in the tester QA checklist catalog.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "delete-checklist-item": {
             iconKey: "delete",
@@ -2609,7 +2658,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this tester checklist item",
             description: "Permanently delete a test case from the tester QA checklist catalog.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this checklist item?",
                 body: "This test case will be permanently removed from the tester QA checklist. Any tester answers already recorded for it are kept, but the item will no longer appear on the Tester Hub.",
@@ -2624,7 +2673,7 @@ export const ACTIONS = {
             ariaLabel: "Confirm this as a real bug and credit the reporting tester",
             description: "Confirms this reported issue as a real bug, credits the reporting tester as the bug hunter, and disables the case for all other testers.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Confirm this bug?",
                 body: "This credits the reporting tester as the bug hunter for this case and disables it so no other tester can answer it. This can't be undone from the UI.",
@@ -2639,7 +2688,7 @@ export const ACTIONS = {
             ariaLabel: "Reopen this fixed case as a new version for retest",
             description: "Once a confirmed bug is fixed, reopen it as a new version (v+1) for testers to retest — the old disabled case stays in the database with its bug-hunter credit intact.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Reopen this case for retest?",
                 body: "This creates a new, active version of this test case for testers to answer again. The old case stays disabled in the database — its bug-hunter credit is not affected.",
@@ -2654,7 +2703,7 @@ export const ACTIONS = {
             ariaLabel: "Resend this notification",
             description: "Re-send a notification to the recipient.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         // ── Blog management ───────────────────────────────────────────────────
         "publish-blog": {
@@ -2664,7 +2713,7 @@ export const ACTIONS = {
             ariaLabel: "Publish selected blog posts",
             description: "Set selected blog posts to published status.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "draft-blog": {
             iconKey: "edit",
@@ -2673,7 +2722,7 @@ export const ACTIONS = {
             ariaLabel: "Move selected posts to draft",
             description: "Revert selected blog posts to draft status.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Brand & category management ───────────────────────────────────────
         "edit-brand": {
@@ -2683,7 +2732,7 @@ export const ACTIONS = {
             ariaLabel: "Edit this brand",
             description: "Open the edit panel for a brand.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "edit-category": {
             iconKey: "edit",
@@ -2692,9 +2741,9 @@ export const ACTIONS = {
             ariaLabel: "Edit this category",
             description: "Open the edit panel for a category.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
-        // ── Feature & prize-draw management ────────────────────────────────────
+        // ── Feature & clearance management ────────────────────────────────────
         "delete-feature": {
             iconKey: "delete",
             id: "admin.delete-feature",
@@ -2702,7 +2751,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected features",
             description: "Permanently delete the selected product feature badges.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these features?",
                 body: "The selected product feature badges will be permanently removed. Products tagged with them will lose the badge.",
@@ -2712,15 +2761,15 @@ export const ACTIONS = {
         },
         "delete-prize-draw": {
             iconKey: "delete",
-            id: "admin.delete-prize-draw",
-            label: "Delete Prize Draws",
-            ariaLabel: "Delete selected prize draws",
-            description: "Permanently delete the selected prize draw listings.",
+            id: "admin.delete-clearance",
+            label: "Delete Clearance",
+            ariaLabel: "Delete selected clearance",
+            description: "Permanently delete the selected clearance listings.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
-                title: "Delete these prize draws?",
-                body: "The selected prize draw listings will be permanently removed. This action cannot be undone.",
+                title: "Delete these clearance?",
+                body: "The selected clearance listings will be permanently removed. This action cannot be undone.",
                 confirmLabel: "Delete",
                 confirmKind: "danger",
             },
@@ -2733,7 +2782,7 @@ export const ACTIONS = {
             ariaLabel: "Toggle featured status",
             description: "Toggle whether the selected products appear in featured sections.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "toggle-promoted": {
             iconKey: "analytics",
@@ -2742,7 +2791,7 @@ export const ACTIONS = {
             ariaLabel: "Toggle promoted status",
             description: "Toggle whether the selected products appear in promoted placements.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "toggle-on-sale": {
             iconKey: "analytics",
@@ -2751,7 +2800,7 @@ export const ACTIONS = {
             ariaLabel: "Toggle on-sale status",
             description: "Toggle the on-sale flag for the selected products.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Bundle management ─────────────────────────────────────────────────
         "activate-bundle": {
@@ -2761,7 +2810,7 @@ export const ACTIONS = {
             ariaLabel: "Activate selected bundles",
             description: "Set the selected bundles to active status.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "deactivate-bundle": {
             iconKey: "pause",
@@ -2770,7 +2819,7 @@ export const ACTIONS = {
             ariaLabel: "Deactivate selected bundles",
             description: "Set the selected bundles to inactive status.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "delete-bundle": {
             iconKey: "delete",
@@ -2779,7 +2828,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected bundles",
             description: "Permanently delete the selected bundles.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these bundles?",
                 body: "The selected bundles will be permanently removed. This action cannot be undone.",
@@ -2795,7 +2844,7 @@ export const ACTIONS = {
             ariaLabel: "Manage this store",
             description: "Open the store management panel.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "manage-user": {
             iconKey: "settings",
@@ -2804,35 +2853,7 @@ export const ACTIONS = {
             ariaLabel: "Manage selected users",
             description: "Open the user management panel.",
             kind: "primary",
-            permissions: ["admin"],
-        },
-        // ── Carousel management ──────────────────────────────────────────────
-        "edit-carousel": {
-            iconKey: "edit",
-            id: "admin.edit-carousel",
-            label: "Edit Slide",
-            ariaLabel: "Edit carousel slide",
-            description: "Open the edit panel for a carousel slide.",
-            kind: "ghost",
-            permissions: ["admin"],
-        },
-        "activate-carousel": {
-            iconKey: "resume",
-            id: "admin.activate-carousel",
-            label: "Activate",
-            ariaLabel: "Show this slide in the carousel",
-            description: "Set a carousel slide to active so the hero carousel renders it.",
-            kind: "primary",
-            permissions: ["admin"],
-        },
-        "deactivate-carousel": {
-            iconKey: "hide",
-            id: "admin.deactivate-carousel",
-            label: "Deactivate",
-            ariaLabel: "Hide this slide from the carousel",
-            description: "Set a carousel slide to inactive without deleting it.",
-            kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         /*
          * Homepage sections have no bucket of their own, so their leaves live here
@@ -2862,7 +2883,7 @@ export const ACTIONS = {
             ariaLabel: "Edit this homepage section",
             description: "Open the homepage sections list, which owns this section's config.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "enable-section": {
             iconKey: "resume",
@@ -2871,7 +2892,7 @@ export const ACTIONS = {
             ariaLabel: "Enable this homepage section",
             description: "Render this section on its surface again.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "disable-section": {
             iconKey: "hide",
@@ -2880,7 +2901,7 @@ export const ACTIONS = {
             ariaLabel: "Disable this homepage section",
             description: "Stop rendering this section without deleting it or its saved config.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "delete-section": {
             iconKey: "delete",
@@ -2889,7 +2910,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this homepage section",
             description: "Permanently remove this homepage section and its saved config.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this section?",
                 /*
@@ -2909,7 +2930,7 @@ export const ACTIONS = {
             ariaLabel: "Show this navigation item",
             description: "Make a navigation item visible in the sidebar and menus.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "hide-nav-item": {
             iconKey: "hide",
@@ -2918,22 +2939,7 @@ export const ACTIONS = {
             ariaLabel: "Hide this navigation item",
             description: "Hide a navigation item without deleting it.",
             kind: "secondary",
-            permissions: ["admin"],
-        },
-        "delete-carousel": {
-            iconKey: "delete",
-            id: "admin.delete-carousel",
-            label: "Delete Slides",
-            ariaLabel: "Delete selected carousel slides",
-            description: "Permanently delete the selected carousel slides.",
-            kind: "danger",
-            permissions: ["admin"],
-            confirmation: {
-                title: "Delete these slides?",
-                body: "The selected carousel slides will be permanently removed.",
-                confirmLabel: "Delete",
-                confirmKind: "danger",
-            },
+            roles: ["admin"],
         },
         // ── Contact management ────────────────────────────────────────────────
         "mark-contact-read": {
@@ -2943,7 +2949,7 @@ export const ACTIONS = {
             ariaLabel: "Mark selected messages as read",
             description: "Mark one or more contact messages as read.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "archive-contact": {
             iconKey: "archive",
@@ -2952,7 +2958,7 @@ export const ACTIONS = {
             ariaLabel: "Archive selected messages",
             description: "Move the selected contact messages to archive.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "delete-contact": {
             iconKey: "delete",
@@ -2961,7 +2967,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected messages",
             description: "Permanently delete the selected contact messages.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these messages?",
                 body: "The selected messages will be permanently removed.",
@@ -2977,7 +2983,7 @@ export const ACTIONS = {
             ariaLabel: "Unsubscribe selected subscribers",
             description: "Remove the selected subscribers from the newsletter.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Unsubscribe these subscribers?",
                 body: "The selected subscribers will be removed from the newsletter.",
@@ -2993,7 +2999,7 @@ export const ACTIONS = {
             ariaLabel: "Edit team member permissions",
             description: "Open the permissions editor for a team member.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "remove-team-member": {
             iconKey: "delete",
@@ -3002,7 +3008,7 @@ export const ACTIONS = {
             ariaLabel: "Remove selected team members",
             description: "Remove the selected team members.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Remove these team members?",
                 body: "The selected team members will be removed from the team.",
@@ -3018,7 +3024,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected FAQs",
             description: "Permanently delete the selected FAQ entries.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these FAQs?",
                 body: "The selected FAQ entries will be permanently removed.",
@@ -3033,7 +3039,7 @@ export const ACTIONS = {
             ariaLabel: "Archive selected FAQs",
             description: "Archive the selected FAQ entries.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Coupon management ─────────────────────────────────────────────────
         "delete-coupon": {
@@ -3043,7 +3049,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected coupons",
             description: "Permanently delete the selected coupons.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these coupons?",
                 body: "The selected coupons will be permanently removed. Active coupon codes will stop working.",
@@ -3058,7 +3064,7 @@ export const ACTIONS = {
             ariaLabel: "Edit this coupon",
             description: "Open the edit panel for a coupon.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "duplicate-coupon": {
             iconKey: "duplicate",
@@ -3067,7 +3073,7 @@ export const ACTIONS = {
             ariaLabel: "Duplicate this coupon",
             description: "Create a copy of this coupon with a new code.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         // ── Navigation management ─────────────────────────────────────────────
         "edit-nav": {
@@ -3077,7 +3083,7 @@ export const ACTIONS = {
             ariaLabel: "Edit navigation item",
             description: "Edit a navigation menu item.",
             kind: "ghost",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "delete-nav": {
             iconKey: "delete",
@@ -3086,7 +3092,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected navigation items",
             description: "Permanently delete the selected navigation items.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these navigation items?",
                 body: "The selected navigation items will be permanently removed from the menu.",
@@ -3102,7 +3108,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected sublisting categories",
             description: "Permanently delete the selected sublisting categories.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these categories?",
                 body: "Products tagged with these categories will lose the tag.",
@@ -3118,7 +3124,7 @@ export const ACTIONS = {
             ariaLabel: "Verify this scammer report",
             description: "Mark a scammer report as verified after review.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "dismiss-scammer": {
             iconKey: "reject",
@@ -3127,7 +3133,7 @@ export const ACTIONS = {
             ariaLabel: "Dismiss this scammer report",
             description: "Dismiss a scammer report as unverified.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "delete-scammer": {
             iconKey: "delete",
@@ -3136,7 +3142,7 @@ export const ACTIONS = {
             ariaLabel: "Delete selected scammer reports",
             description: "Permanently delete the selected scammer reports.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete these reports?",
                 body: "The selected scammer reports will be permanently removed.",
@@ -3152,7 +3158,7 @@ export const ACTIONS = {
             ariaLabel: "View support ticket details",
             description: "Open the full support ticket details.",
             kind: "ghost",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "close-ticket": {
             iconKey: "cancel",
@@ -3161,7 +3167,7 @@ export const ACTIONS = {
             ariaLabel: "Close selected tickets",
             description: "Close the selected support tickets.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "escalate-ticket": {
             iconKey: "report",
@@ -3170,7 +3176,7 @@ export const ACTIONS = {
             ariaLabel: "Escalate this ticket",
             description: "Escalate a support ticket to a higher priority.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Event entry management ────────────────────────────────────────────
         "approve-entry": {
@@ -3180,7 +3186,7 @@ export const ACTIONS = {
             ariaLabel: "Approve selected event entries",
             description: "Approve the selected event entries.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "reject-entry": {
             iconKey: "reject",
@@ -3189,7 +3195,7 @@ export const ACTIONS = {
             ariaLabel: "Reject selected event entries",
             description: "Reject the selected event entries.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Reject these entries?",
                 body: "The selected entries will be rejected and participants will be notified.",
@@ -3205,7 +3211,7 @@ export const ACTIONS = {
             ariaLabel: "Confirm this event entry",
             description: "Confirm a single event entry.",
             kind: "primary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "waitlist-entry": {
             iconKey: "pause",
@@ -3214,7 +3220,7 @@ export const ACTIONS = {
             ariaLabel: "Waitlist this event entry",
             description: "Move a single event entry to waitlist.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "cancel-entry": {
             iconKey: "cancel",
@@ -3223,7 +3229,7 @@ export const ACTIONS = {
             ariaLabel: "Cancel this event entry",
             description: "Cancel a single event entry.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Cancel this entry?",
                 body: "This will remove the participant from the event. They can re-register if the event is still open.",
@@ -3239,7 +3245,7 @@ export const ACTIONS = {
             ariaLabel: "Feature this review",
             description: "Feature a review on the product page.",
             kind: "ghost",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "unfeature-review": {
             iconKey: "review",
@@ -3248,7 +3254,7 @@ export const ACTIONS = {
             ariaLabel: "Unfeature this review",
             description: "Remove a review from the featured section.",
             kind: "ghost",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Scammer management (row-level) ────────────────────────────────
         "review-scammer": {
@@ -3258,7 +3264,7 @@ export const ACTIONS = {
             ariaLabel: "Review this scammer report",
             description: "Open the scammer profile for detailed review.",
             kind: "ghost",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         // ── Bid management ────────────────────────────────────────────────────
         "cancel-bid": {
@@ -3268,7 +3274,7 @@ export const ACTIONS = {
             ariaLabel: "Cancel selected bids",
             description: "Cancel the selected bids.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Cancel these bids?",
                 body: "The selected bids will be cancelled. Bidders will be notified.",
@@ -3285,7 +3291,7 @@ export const ACTIONS = {
             kind: "danger",
             // Admin only. The route is ROLES_ADMIN_ONLY, so listing "moderator" here
             // showed a moderator an action that could only ever return 403.
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Cancel this offer?",
                 body: "The offer will be expired and removed from the buyer's cart, and they'll be notified. This cannot be undone — the buyer would need to make a new offer.",
@@ -3301,7 +3307,7 @@ export const ACTIONS = {
             ariaLabel: "Ban this address",
             description: "Ban an address from being used on the platform.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Ban this address?",
                 body: "The address will be blocked from use at checkout across all accounts.",
@@ -3316,7 +3322,7 @@ export const ACTIONS = {
             ariaLabel: "Approve unban request",
             description: "Approve an address unban request and restore it to active.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "reject-unban": {
             iconKey: "reject",
@@ -3325,7 +3331,7 @@ export const ACTIONS = {
             ariaLabel: "Reject unban request",
             description: "Reject an address unban request — address stays banned.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         // ── Payment method ban management ──────────────────────────────────────
         "ban-payment-method": {
@@ -3335,7 +3341,7 @@ export const ACTIONS = {
             ariaLabel: "Ban this payment method",
             description: "Ban a payment identifier from being used on the platform.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Ban this payment method?",
                 body: "The payment identifier will be blocked from checkout across all accounts.",
@@ -3350,7 +3356,7 @@ export const ACTIONS = {
             ariaLabel: "Approve payment method unban",
             description: "Approve a payment method unban request.",
             kind: "primary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
         "reject-payment-unban": {
             iconKey: "reject",
@@ -3359,7 +3365,7 @@ export const ACTIONS = {
             ariaLabel: "Reject payment method unban",
             description: "Reject a payment method unban request — stays banned.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
         },
     },
     CART: {
@@ -3570,7 +3576,7 @@ export const ACTIONS = {
             ariaLabel: "Clear uploaded previews",
             description: "Remove all preview images from the current session.",
             kind: "secondary",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
         },
         "discard-staged": {
             iconKey: "delete",
@@ -3579,7 +3585,7 @@ export const ACTIONS = {
             ariaLabel: "Discard all staged uploads",
             description: "Remove staged upload files from temporary storage.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Discard staged uploads?",
                 body: "All uploaded files not yet saved to a record will be deleted from storage.",
@@ -3602,7 +3608,7 @@ export const ACTIONS = {
             ariaLabel: "Delete this media file",
             description: "Permanently delete a media file and the asset row that resolves it.",
             kind: "danger",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Delete this file?",
                 body: "The file is removed from storage and stops resolving. Any product, blog post or section still embedding it will show a broken image — this cannot be undone.",
@@ -3680,21 +3686,21 @@ export const ACTIONS = {
             kind: "primary",
         },
     },
-    LOTTERY: {
+    GIVEAWAY: {
         "pull": {
             iconKey: "retry",
-            id: "lottery.pull",
+            id: "giveaway.pull",
             label: "Submit Entry",
-            description: "Submit a lottery pull entry — slot assigned immediately.",
+            description: "Submit a giveaway pull entry — slot assigned immediately.",
             kind: "primary",
         },
         "flag-entry": {
             iconKey: "report",
-            id: "lottery.flag-entry",
+            id: "giveaway.flag-entry",
             label: "Flag as Scammer",
-            description: "Flag a lottery entry as fraudulent.",
+            description: "Flag a giveaway entry as fraudulent.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
                 title: "Flag this entry?",
                 body: "Entry will be marked fraudulent. Their claimed slot stays booked until you manually reopen it.",
@@ -3704,11 +3710,11 @@ export const ACTIONS = {
         },
         "reopen-slot": {
             iconKey: "restore",
-            id: "lottery.reopen-slot",
+            id: "giveaway.reopen-slot",
             label: "Reopen Slot",
             description: "Free a flagged entry's slot so it can be claimed again.",
             kind: "secondary",
-            permissions: ["admin"],
+            roles: ["admin"],
             confirmation: {
                 title: "Reopen this slot?",
                 body: "The slot will be available for new pulls. The flagged entry's slot assignment is removed.",
@@ -3717,13 +3723,13 @@ export const ACTIONS = {
         },
         "cancel": {
             iconKey: "cancel",
-            id: "lottery.cancel",
-            label: "Cancel Lottery",
+            id: "giveaway.cancel",
+            label: "Cancel Giveaway",
             description: "Close the draw window and reject pending pulls.",
             kind: "danger",
-            permissions: ["admin", "moderator"],
+            roles: ["admin", "moderator"],
             confirmation: {
-                title: "Cancel lottery?",
+                title: "Cancel giveaway?",
                 body: "Draw window closes immediately. Pending pulls rejected.",
                 confirmLabel: "Cancel",
                 confirmKind: "danger",