@mohasinac/appkit 4.26.0 → 4.28.0

package/dist/monitoring/server-logger.js

@@ -18,7 +18,26 @@ function getLogsDir() {
 }
 const MAX_LOG_FILE_SIZE = 10 * 1024 * 1024;
 const MAX_LOG_FILES = 10;
-const isFileLoggingEnabled = !process.env.VERCEL;
+/**
+ * File logging is OPT-IN, not "anywhere that isn't Vercel".
+ *
+ * This was `!process.env.VERCEL`, which is `true` inside Cloud Functions — where
+ * `VERCEL` is simply unset and the filesystem is read-only. Every log line in
+ * every Function therefore ran mkdir/stat/appendFile, failed, and emitted a
+ * SECOND line carrying the EROFS stack: every Function log doubled, plus four
+ * wasted syscalls per line, against a log buffer that drops at ~4 KB/s
+ * (CLAUDE.md Rule #6).
+ *
+ * Serverless runtimes have no durable disk and their stdout is already
+ * collected, so the only place local files help is a developer machine.
+ * `LOG_TO_FILE=1` turns it on there; nothing else does.
+ */
+const isServerlessRuntime = Boolean(process.env.VERCEL ||
+    process.env.FUNCTION_TARGET || // Cloud Functions (2nd gen)
+    process.env.K_SERVICE || // Cloud Run / Functions
+    process.env.FUNCTIONS_EMULATOR ||
+    process.env.AWS_LAMBDA_FUNCTION_NAME);
+const isFileLoggingEnabled = process.env.LOG_TO_FILE === "1" && !isServerlessRuntime;
 function serializeError(error) {
     const serialized = {
         name: error.name,
@@ -136,46 +155,65 @@ async function writeLog(entry) {
         console.error("Failed to write log:", error);
     }
 }
-export const serverLogger = {
-    debug(message, data) {
-        const sanitized = data ? redactPii(normalizeLogData(data)) : undefined;
-        console.debug(`[DEBUG] ${message}`, sanitized);
-    },
-    info(message, data) {
-        const sanitized = data ? redactPii(normalizeLogData(data)) : undefined;
-        const entry = {
-            level: "info",
+/**
+ * Cloud Logging severity names. GCP parses a JSON stdout line and promotes
+ * `severity` into the real log level; a plain `[INFO] msg` string arrives as
+ * unparsed `DEFAULT`-severity text, which is what every appkit server log has
+ * been doing — invisible to any severity filter or alert.
+ */
+const GCP_SEVERITY = {
+    debug: "DEBUG",
+    info: "INFO",
+    warn: "WARNING",
+    error: "ERROR",
+};
+/**
+ * Emit one line. Structured JSON where a collector is reading stdout
+ * (Vercel/Cloud Functions/Cloud Run), human-readable locally.
+ */
+function emit(level, message, sanitized) {
+    const consoleFn = level === "error" ? console.error : level === "warn" ? console.warn : level === "debug" ? console.debug : console.info;
+    if (isServerlessRuntime) {
+        consoleFn(JSON.stringify({
+            severity: GCP_SEVERITY[level],
             message,
             timestamp: new Date().toISOString(),
-            data: sanitized,
-        };
-        console.info(`[INFO] ${message}`, sanitized);
-        if (isFileLoggingEnabled)
-            writeLog(entry).catch((err) => { process.stderr.write(String(err) + "\n"); });
-    },
-    warn(message, data) {
-        const sanitized = data ? redactPii(normalizeLogData(data)) : undefined;
+            ...(sanitized !== undefined ? { data: sanitized } : {}),
+        }));
+        return;
+    }
+    consoleFn(`[${level.toUpperCase()}] ${message}`, sanitized);
+}
+function record(level, message, data) {
+    const sanitized = data ? redactPii(normalizeLogData(data)) : undefined;
+    emit(level, message, sanitized);
+    if (isFileLoggingEnabled) {
         const entry = {
-            level: "warn",
+            level,
             message,
             timestamp: new Date().toISOString(),
             data: sanitized,
         };
-        console.warn(`[WARN] ${message}`, sanitized);
-        if (isFileLoggingEnabled)
-            writeLog(entry).catch((err) => { process.stderr.write(String(err) + "\n"); });
+        writeLog(entry).catch((err) => {
+            // stderr, not the logger — a logger that logs its own failure through
+            // itself recurses. normalizeError is pure classification, so it is safe
+            // to call here.
+            process.stderr.write(`log write failed: ${normalizeError(err).message}\n`);
+        });
+    }
+}
+export const serverLogger = {
+    debug(message, data) {
+        record("debug", message, data);
+    },
+    info(message, data) {
+        record("info", message, data);
+    },
+    warn(message, data) {
+        record("warn", message, data);
     },
     error(message, data) {
-        const sanitized = data ? redactPii(normalizeLogData(data)) : undefined;
-        const entry = {
-            level: "error",
-            message,
-            timestamp: new Date().toISOString(),
-            data: sanitized,
-        };
-        console.error(`[ERROR] ${message}`, sanitized);
-        if (isFileLoggingEnabled)
-            writeLog(entry).catch((err) => { process.stderr.write(String(err) + "\n"); });
+        record("error", message, data);
     },
 };
 /** Pull the commonly needed headers from a NextRequest in one call. */

package/dist/next/components/ErrorView.js

@@ -28,5 +28,5 @@ export function ErrorView({ error, reset, heading = "Something went wrong", desc
             metadata: { digest: error.digest ?? null },
         });
     }, [error]);
-    return (_jsxs(Stack, { justify: "center", role: "alert", className: "min-h-[50vh] text-center", padding: "x-xl", align: "center", children: [_jsx(Heading, { level: 2, className: "mb-2", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-6", children: description }), process.env.NODE_ENV === "development" && error.digest && (_jsxs(Text, { variant: "muted", size: "xs", className: "mb-4", children: ["digest: ", error.digest] })), _jsx(Button, { type: "button", variant: "primary", onClick: reset, children: retryLabel })] }));
+    return (_jsxs(Stack, { justify: "center", role: "alert", className: "min-h-[50vh] text-center", padding: "x-xl", align: "center", children: [_jsx(Heading, { level: 2, className: "mb-2", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-6", children: description }), error.digest && (_jsxs(Text, { variant: "muted", size: "xs", className: "mb-4", children: ["Reference: ", error.digest] })), _jsx(Button, { type: "button", variant: "primary", onClick: reset, children: retryLabel })] }));
 }

package/dist/next/routing/route-map.d.ts

@@ -143,8 +143,6 @@ export declare const DEFAULT_ROUTE_MAP: {
          */
         readonly ADDRESSES_NEW: "/user/addresses/new";
         readonly ADDRESSES_EDIT: (id: string) => string;
-        /** @deprecated Use ADDRESSES_NEW. Kept so existing links keep resolving. */
-        readonly ADDRESSES_ADD: "/user/addresses/new";
         readonly ORDER_DETAIL: (id: string) => string;
         readonly ORDER_CANCEL: (id: string) => string;
         readonly ORDER_TRACK: (id: string) => string;
@@ -161,6 +159,7 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly OFFERS: "/user/offers";
         readonly REVIEWS: "/user/reviews";
         readonly BIDS: "/user/bids";
+        readonly BID_DETAIL: (id: string) => string;
         readonly RETURNS: "/user/returns";
         readonly SUPPORT: "/user/support";
         readonly SUPPORT_NEW: "/user/support/new";
@@ -198,10 +197,13 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly SHIPPING: "/store/shipping";
         readonly PAYOUT_SETTINGS: "/store/payout-settings";
         readonly ADDRESSES: "/store/addresses";
+        readonly ADDRESSES_NEW: "/store/addresses/new";
+        readonly ADDRESSES_EDIT: (id: string) => string;
         readonly OFFERS: "/store/offers";
         readonly WHATSAPP: "/store/whatsapp";
         readonly REVIEWS: "/store/reviews";
         readonly BIDS: "/store/bids";
+        readonly BID_DETAIL: (id: string) => string;
         readonly SUBLISTING_CATEGORIES: "/store/sublisting-categories";
         readonly SUBLISTING_CATEGORIES_NEW: "/store/sublisting-categories/new";
         readonly SUBLISTING_CATEGORIES_EDIT: (id: string) => string;
@@ -216,7 +218,6 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly PRIZE_DRAWS_NEW: "/store/prize-draws/new";
         readonly PRIZE_DRAWS_EDIT: (id: string) => string;
         readonly PRIZE_DRAW_ENTRIES: (id: string) => string;
-        readonly PRODUCT_CODES: (id: string) => string;
         readonly CLASSIFIED: "/store/classified";
         readonly CLASSIFIED_NEW: "/store/classified/new";
         readonly CLASSIFIED_EDIT: (id: string) => string;
@@ -270,14 +271,19 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly CATALOGUE_APPROVALS: "/admin/catalogue-approvals";
         readonly USERS: "/admin/users";
         readonly USER_DETAIL: (id: string) => string;
+        readonly USER_EDIT: (id: string) => string;
         readonly SITE: "/admin/site";
         readonly CAROUSEL: "/admin/carousel";
         readonly CAROUSEL_NEW: "/admin/carousel/new";
         readonly CAROUSEL_EDIT: (id: string) => string;
         readonly CAROUSELS: "/admin/carousels";
         readonly CAROUSEL_DETAIL: (id: string) => string;
+        readonly CAROUSELS_NEW: "/admin/carousels/new";
+        readonly CAROUSELS_EDIT: (id: string) => string;
         readonly SECTIONS: "/admin/sections";
         readonly NAVIGATION: "/admin/navigation";
+        readonly NAVIGATION_NEW: "/admin/navigation/new";
+        readonly NAVIGATION_EDIT: (id: string) => string;
         readonly CATEGORIES: "/admin/categories";
         readonly CATEGORIES_NEW: "/admin/categories/new";
         readonly CATEGORIES_EDIT: (id: string) => string;
@@ -288,6 +294,8 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly FAQS_NEW: "/admin/faqs/new";
         readonly FAQS_EDIT: (id: string) => string;
         readonly TESTER_CHECKLIST: "/admin/tester-checklist";
+        readonly TESTER_CHECKLIST_NEW: "/admin/tester-checklist/new";
+        readonly TESTER_CHECKLIST_EDIT: (id: string) => string;
         readonly TESTER_FEEDBACK: "/admin/tester-feedback";
         readonly REVIEWS: "/admin/reviews";
         readonly COUPONS: "/admin/coupons";
@@ -303,11 +311,14 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly ART: "/admin/art";
         readonly STICKERS: "/admin/stickers";
         readonly GROUPED_LISTINGS: "/admin/grouped-listings";
+        readonly GROUPED_LISTINGS_NEW: "/admin/grouped-listings/new";
+        readonly GROUPED_LISTINGS_EDIT: (id: string) => string;
         readonly DEALS: "/admin/deals";
         readonly FEATURED: "/admin/featured";
         readonly ORDERS: "/admin/orders";
         readonly ORDER_DETAIL: (id: string) => string;
         readonly BIDS: "/admin/bids";
+        readonly BID_DETAIL: (id: string) => string;
         readonly OFFERS: "/admin/offers";
         readonly BLOG: "/admin/blog";
         readonly BLOG_NEW: "/admin/blog/new";
@@ -331,6 +342,7 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly CONTACT: "/admin/contact";
         readonly SESSIONS: "/admin/sessions";
         readonly ALL_EVENT_ENTRIES: "/admin/event-entries";
+        readonly EVENT_ENTRY_DETAIL: (id: string) => string;
         readonly NOTIFICATIONS: "/admin/notifications";
         readonly CARTS: "/admin/carts";
         readonly WISHLISTS: "/admin/wishlists";
@@ -353,8 +365,11 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly PRIZE_DRAWS_EDIT: (id: string) => string;
         readonly PRIZE_DRAWS_ENTRIES: (id: string) => string;
         readonly LOTTERIES: "/admin/lotteries";
+        readonly LOTTERY_CONFIG: (id: string) => string;
         readonly LOTTERY_ENTRIES: (id: string) => string;
         readonly TEAM: "/admin/team";
+        readonly TEAM_NEW: "/admin/team/new";
+        readonly TEAM_EDIT: (id: string) => string;
         readonly SUPPORT_TICKETS: "/admin/support-tickets";
         readonly SUPPORT_TICKET_BY_ID: (id: string) => string;
         readonly SCAMMERS: "/admin/scammers";
@@ -531,8 +546,6 @@ export declare const ROUTES: {
          */
         readonly ADDRESSES_NEW: "/user/addresses/new";
         readonly ADDRESSES_EDIT: (id: string) => string;
-        /** @deprecated Use ADDRESSES_NEW. Kept so existing links keep resolving. */
-        readonly ADDRESSES_ADD: "/user/addresses/new";
         readonly ORDER_DETAIL: (id: string) => string;
         readonly ORDER_CANCEL: (id: string) => string;
         readonly ORDER_TRACK: (id: string) => string;
@@ -549,6 +562,7 @@ export declare const ROUTES: {
         readonly OFFERS: "/user/offers";
         readonly REVIEWS: "/user/reviews";
         readonly BIDS: "/user/bids";
+        readonly BID_DETAIL: (id: string) => string;
         readonly RETURNS: "/user/returns";
         readonly SUPPORT: "/user/support";
         readonly SUPPORT_NEW: "/user/support/new";
@@ -586,10 +600,13 @@ export declare const ROUTES: {
         readonly SHIPPING: "/store/shipping";
         readonly PAYOUT_SETTINGS: "/store/payout-settings";
         readonly ADDRESSES: "/store/addresses";
+        readonly ADDRESSES_NEW: "/store/addresses/new";
+        readonly ADDRESSES_EDIT: (id: string) => string;
         readonly OFFERS: "/store/offers";
         readonly WHATSAPP: "/store/whatsapp";
         readonly REVIEWS: "/store/reviews";
         readonly BIDS: "/store/bids";
+        readonly BID_DETAIL: (id: string) => string;
         readonly SUBLISTING_CATEGORIES: "/store/sublisting-categories";
         readonly SUBLISTING_CATEGORIES_NEW: "/store/sublisting-categories/new";
         readonly SUBLISTING_CATEGORIES_EDIT: (id: string) => string;
@@ -604,7 +621,6 @@ export declare const ROUTES: {
         readonly PRIZE_DRAWS_NEW: "/store/prize-draws/new";
         readonly PRIZE_DRAWS_EDIT: (id: string) => string;
         readonly PRIZE_DRAW_ENTRIES: (id: string) => string;
-        readonly PRODUCT_CODES: (id: string) => string;
         readonly CLASSIFIED: "/store/classified";
         readonly CLASSIFIED_NEW: "/store/classified/new";
         readonly CLASSIFIED_EDIT: (id: string) => string;
@@ -658,14 +674,19 @@ export declare const ROUTES: {
         readonly CATALOGUE_APPROVALS: "/admin/catalogue-approvals";
         readonly USERS: "/admin/users";
         readonly USER_DETAIL: (id: string) => string;
+        readonly USER_EDIT: (id: string) => string;
         readonly SITE: "/admin/site";
         readonly CAROUSEL: "/admin/carousel";
         readonly CAROUSEL_NEW: "/admin/carousel/new";
         readonly CAROUSEL_EDIT: (id: string) => string;
         readonly CAROUSELS: "/admin/carousels";
         readonly CAROUSEL_DETAIL: (id: string) => string;
+        readonly CAROUSELS_NEW: "/admin/carousels/new";
+        readonly CAROUSELS_EDIT: (id: string) => string;
         readonly SECTIONS: "/admin/sections";
         readonly NAVIGATION: "/admin/navigation";
+        readonly NAVIGATION_NEW: "/admin/navigation/new";
+        readonly NAVIGATION_EDIT: (id: string) => string;
         readonly CATEGORIES: "/admin/categories";
         readonly CATEGORIES_NEW: "/admin/categories/new";
         readonly CATEGORIES_EDIT: (id: string) => string;
@@ -676,6 +697,8 @@ export declare const ROUTES: {
         readonly FAQS_NEW: "/admin/faqs/new";
         readonly FAQS_EDIT: (id: string) => string;
         readonly TESTER_CHECKLIST: "/admin/tester-checklist";
+        readonly TESTER_CHECKLIST_NEW: "/admin/tester-checklist/new";
+        readonly TESTER_CHECKLIST_EDIT: (id: string) => string;
         readonly TESTER_FEEDBACK: "/admin/tester-feedback";
         readonly REVIEWS: "/admin/reviews";
         readonly COUPONS: "/admin/coupons";
@@ -691,11 +714,14 @@ export declare const ROUTES: {
         readonly ART: "/admin/art";
         readonly STICKERS: "/admin/stickers";
         readonly GROUPED_LISTINGS: "/admin/grouped-listings";
+        readonly GROUPED_LISTINGS_NEW: "/admin/grouped-listings/new";
+        readonly GROUPED_LISTINGS_EDIT: (id: string) => string;
         readonly DEALS: "/admin/deals";
         readonly FEATURED: "/admin/featured";
         readonly ORDERS: "/admin/orders";
         readonly ORDER_DETAIL: (id: string) => string;
         readonly BIDS: "/admin/bids";
+        readonly BID_DETAIL: (id: string) => string;
         readonly OFFERS: "/admin/offers";
         readonly BLOG: "/admin/blog";
         readonly BLOG_NEW: "/admin/blog/new";
@@ -719,6 +745,7 @@ export declare const ROUTES: {
         readonly CONTACT: "/admin/contact";
         readonly SESSIONS: "/admin/sessions";
         readonly ALL_EVENT_ENTRIES: "/admin/event-entries";
+        readonly EVENT_ENTRY_DETAIL: (id: string) => string;
         readonly NOTIFICATIONS: "/admin/notifications";
         readonly CARTS: "/admin/carts";
         readonly WISHLISTS: "/admin/wishlists";
@@ -741,8 +768,11 @@ export declare const ROUTES: {
         readonly PRIZE_DRAWS_EDIT: (id: string) => string;
         readonly PRIZE_DRAWS_ENTRIES: (id: string) => string;
         readonly LOTTERIES: "/admin/lotteries";
+        readonly LOTTERY_CONFIG: (id: string) => string;
         readonly LOTTERY_ENTRIES: (id: string) => string;
         readonly TEAM: "/admin/team";
+        readonly TEAM_NEW: "/admin/team/new";
+        readonly TEAM_EDIT: (id: string) => string;
         readonly SUPPORT_TICKETS: "/admin/support-tickets";
         readonly SUPPORT_TICKET_BY_ID: (id: string) => string;
         readonly SCAMMERS: "/admin/scammers";
@@ -810,10 +840,13 @@ export declare const SELLER_ROUTES: {
     readonly SHIPPING: "/store/shipping";
     readonly PAYOUT_SETTINGS: "/store/payout-settings";
     readonly ADDRESSES: "/store/addresses";
+    readonly ADDRESSES_NEW: "/store/addresses/new";
+    readonly ADDRESSES_EDIT: (id: string) => string;
     readonly OFFERS: "/store/offers";
     readonly WHATSAPP: "/store/whatsapp";
     readonly REVIEWS: "/store/reviews";
     readonly BIDS: "/store/bids";
+    readonly BID_DETAIL: (id: string) => string;
     readonly SUBLISTING_CATEGORIES: "/store/sublisting-categories";
     readonly SUBLISTING_CATEGORIES_NEW: "/store/sublisting-categories/new";
     readonly SUBLISTING_CATEGORIES_EDIT: (id: string) => string;
@@ -828,7 +861,6 @@ export declare const SELLER_ROUTES: {
     readonly PRIZE_DRAWS_NEW: "/store/prize-draws/new";
     readonly PRIZE_DRAWS_EDIT: (id: string) => string;
     readonly PRIZE_DRAW_ENTRIES: (id: string) => string;
-    readonly PRODUCT_CODES: (id: string) => string;
     readonly CLASSIFIED: "/store/classified";
     readonly CLASSIFIED_NEW: "/store/classified/new";
     readonly CLASSIFIED_EDIT: (id: string) => string;

package/dist/next/routing/route-map.js

@@ -147,8 +147,6 @@ export const DEFAULT_ROUTE_MAP = {
          */
         ADDRESSES_NEW: "/user/addresses/new",
         ADDRESSES_EDIT: (id) => `/user/addresses/${id}/edit`,
-        /** @deprecated Use ADDRESSES_NEW. Kept so existing links keep resolving. */
-        ADDRESSES_ADD: "/user/addresses/new",
         ORDER_DETAIL: (id) => `/user/orders/view/${id}`,
         ORDER_CANCEL: (id) => `/user/orders/${id}/cancel`,
         ORDER_TRACK: (id) => `/user/orders/${id}/track`,
@@ -165,6 +163,7 @@ export const DEFAULT_ROUTE_MAP = {
         OFFERS: "/user/offers",
         REVIEWS: "/user/reviews",
         BIDS: "/user/bids",
+        BID_DETAIL: (id) => `/user/bids/${id}/view`,
         RETURNS: "/user/returns",
         SUPPORT: "/user/support",
         SUPPORT_NEW: "/user/support/new",
@@ -202,10 +201,13 @@ export const DEFAULT_ROUTE_MAP = {
         SHIPPING: "/store/shipping",
         PAYOUT_SETTINGS: "/store/payout-settings",
         ADDRESSES: "/store/addresses",
+        ADDRESSES_NEW: "/store/addresses/new",
+        ADDRESSES_EDIT: (id) => `/store/addresses/${id}/edit`,
         OFFERS: "/store/offers",
         WHATSAPP: "/store/whatsapp",
         REVIEWS: "/store/reviews",
         BIDS: "/store/bids",
+        BID_DETAIL: (id) => `/store/bids/${id}/view`,
         SUBLISTING_CATEGORIES: "/store/sublisting-categories",
         SUBLISTING_CATEGORIES_NEW: "/store/sublisting-categories/new",
         SUBLISTING_CATEGORIES_EDIT: (id) => `/store/sublisting-categories/${id}/edit`,
@@ -221,7 +223,6 @@ export const DEFAULT_ROUTE_MAP = {
         PRIZE_DRAWS_NEW: "/store/prize-draws/new",
         PRIZE_DRAWS_EDIT: (id) => `/store/prize-draws/${id}/edit`,
         PRIZE_DRAW_ENTRIES: (id) => `/store/prize-draws/${id}/entries`,
-        PRODUCT_CODES: (id) => `/store/products/${id}/codes`,
         // SB-UNI-R — classified / digital-code / live
         CLASSIFIED: "/store/classified",
         CLASSIFIED_NEW: "/store/classified/new",
@@ -279,14 +280,24 @@ export const DEFAULT_ROUTE_MAP = {
         CATALOGUE_APPROVALS: "/admin/catalogue-approvals",
         USERS: "/admin/users",
         USER_DETAIL: (id) => `/admin/users/${id}`,
+        USER_EDIT: (id) => `/admin/users/${id}/edit`,
         SITE: "/admin/site",
         CAROUSEL: "/admin/carousel",
         CAROUSEL_NEW: "/admin/carousel/new",
         CAROUSEL_EDIT: (id) => `/admin/carousel/${id}/edit`,
         CAROUSELS: "/admin/carousels",
         CAROUSEL_DETAIL: (id) => `/admin/carousels/${id}`,
+        /*
+         * 🛑 PLURAL = the named carousel GROUP. Singular `CAROUSEL_NEW` /
+         * `CAROUSEL_EDIT` above are `/admin/carousel/*` and mean a SLIDE.
+         * Two different entities, one letter apart — do not merge them.
+         */
+        CAROUSELS_NEW: "/admin/carousels/new",
+        CAROUSELS_EDIT: (id) => `/admin/carousels/${id}/edit`,
         SECTIONS: "/admin/sections",
         NAVIGATION: "/admin/navigation",
+        NAVIGATION_NEW: "/admin/navigation/new",
+        NAVIGATION_EDIT: (id) => `/admin/navigation/${id}/edit`,
         CATEGORIES: "/admin/categories",
         CATEGORIES_NEW: "/admin/categories/new",
         CATEGORIES_EDIT: (id) => `/admin/categories/${id}/edit`,
@@ -297,6 +308,8 @@ export const DEFAULT_ROUTE_MAP = {
         FAQS_NEW: "/admin/faqs/new",
         FAQS_EDIT: (id) => `/admin/faqs/${id}/edit`,
         TESTER_CHECKLIST: "/admin/tester-checklist",
+        TESTER_CHECKLIST_NEW: "/admin/tester-checklist/new",
+        TESTER_CHECKLIST_EDIT: (id) => `/admin/tester-checklist/${id}/edit`,
         TESTER_FEEDBACK: "/admin/tester-feedback",
         REVIEWS: "/admin/reviews",
         COUPONS: "/admin/coupons",
@@ -313,11 +326,14 @@ export const DEFAULT_ROUTE_MAP = {
         ART: "/admin/art",
         STICKERS: "/admin/stickers",
         GROUPED_LISTINGS: "/admin/grouped-listings",
+        GROUPED_LISTINGS_NEW: "/admin/grouped-listings/new",
+        GROUPED_LISTINGS_EDIT: (id) => `/admin/grouped-listings/${id}/edit`,
         DEALS: "/admin/deals",
         FEATURED: "/admin/featured",
         ORDERS: "/admin/orders",
         ORDER_DETAIL: (id) => `/admin/orders/${id}/view`,
         BIDS: "/admin/bids",
+        BID_DETAIL: (id) => `/admin/bids/${id}/view`,
         OFFERS: "/admin/offers",
         BLOG: "/admin/blog",
         BLOG_NEW: "/admin/blog/new",
@@ -341,6 +357,7 @@ export const DEFAULT_ROUTE_MAP = {
         CONTACT: "/admin/contact",
         SESSIONS: "/admin/sessions",
         ALL_EVENT_ENTRIES: "/admin/event-entries",
+        EVENT_ENTRY_DETAIL: (id) => `/admin/event-entries/${id}/view`,
         NOTIFICATIONS: "/admin/notifications",
         CARTS: "/admin/carts",
         WISHLISTS: "/admin/wishlists",
@@ -365,8 +382,18 @@ export const DEFAULT_ROUTE_MAP = {
         PRIZE_DRAWS_EDIT: (id) => `/admin/prize-draws/${id}/edit`,
         PRIZE_DRAWS_ENTRIES: (id) => `/admin/prize-draws/${id}/entries`,
         LOTTERIES: "/admin/lotteries",
+        /*
+         * Slot configuration only. A lottery EVENT (title, dates, status, media)
+         * is created through the ordinary event editor — `LotteryAdminEditView`
+         * has no fields for any of those, so treating it as the whole create
+         * flow would produce a lottery with no dates, and the draw window is
+         * measured from them.
+         */
+        LOTTERY_CONFIG: (id) => `/admin/lotteries/${id}/edit`,
         LOTTERY_ENTRIES: (id) => `/admin/lotteries/${id}/entries`,
         TEAM: "/admin/team",
+        TEAM_NEW: "/admin/team/new",
+        TEAM_EDIT: (id) => `/admin/team/${id}/edit`,
         SUPPORT_TICKETS: "/admin/support-tickets",
         SUPPORT_TICKET_BY_ID: (id) => `/admin/support-tickets/${id}`,
         SCAMMERS: "/admin/scammers",
@@ -479,7 +506,10 @@ export const PROTECTED_ROUTES = [
     ROUTES.USER.SETTINGS,
     ROUTES.USER.ORDERS,
     ROUTES.USER.ADDRESSES,
-    ROUTES.USER.ADDRESSES_ADD,
+    // Was ADDRESSES_ADD, a deprecated alias resolving to the same path. Swapped
+    // rather than dropped: deleting the alias without this would have removed
+    // /user/addresses/new from the protected set entirely.
+    ROUTES.USER.ADDRESSES_NEW,
     ROUTES.USER.NOTIFICATIONS,
     ROUTES.USER.CART,
 ];

package/dist/providers/db-firebase/base.repository.d.ts

@@ -12,6 +12,36 @@ export declare abstract class BaseRepository<T extends DocumentData> {
     findBy(field: string, value: unknown): Promise<T[]>;
     findOneBy(field: string, value: unknown): Promise<T | null>;
     findAll(limit?: number): Promise<T[]>;
+    /**
+     * PII fields for this collection, encrypted on every write path below.
+     *
+     * Declare it in the subclass instead of overriding `create`/`update` by hand.
+     * There were no encryption hooks here at all, so encryption was opt-in per
+     * method per repository — which meant `createWithId`, `update`, and the whole
+     * `*InTx` / `*InBatch` family were silent bypasses in any repo that had only
+     * overridden `create`. `sessions.deviceInfo.ip` sat in plaintext for exactly
+     * that reason.
+     */
+    protected piiFields: readonly string[];
+    /** Blind-index map (plaintext field → index field) for equality lookups. */
+    protected piiIndexMap: Record<string, string>;
+    /**
+     * Build this document's `searchTxt` tokens. Return `null` to leave the field
+     * alone (the default), so a collection opts in by overriding this.
+     *
+     * MUST NOT include PII: `searchTxt` stores readable fragments of the source
+     * text, so indexing an encrypted field would undo the encryption.
+     */
+    protected buildSearchTxtFor(_data: Record<string, unknown>): string[] | null;
+    /**
+     * The one place writes are transformed. Every write path routes through here
+     * so a new method cannot silently skip encryption.
+     *
+     * `encryptPiiFields` is idempotent (it skips anything already carrying the
+     * `enc:v1:` prefix), so a subclass that still encrypts by hand before calling
+     * super is harmless rather than double-encrypted.
+     */
+    protected applyWriteHooks<D extends object>(data: D): D;
     create(data: Partial<T> | FirestoreDocument): Promise<T>;
     createWithId(id: string, data: Partial<T>): Promise<T>;
     update(id: string, data: Partial<T>): Promise<T>;

package/dist/providers/db-firebase/base.repository.js

@@ -4,8 +4,22 @@ import { serverLogger } from "../../monitoring";
 import { applySieveToFirestore, countSieveMatches, } from "./sieve";
 import { deserializeTimestamps, prepareForFirestore } from "./helpers";
 import { getAdminDb } from "./admin";
+import { encryptPiiFields, piiIndicesFor } from "../../security/pii-encrypt";
 export class BaseRepository {
     constructor(collectionName) {
+        /**
+         * PII fields for this collection, encrypted on every write path below.
+         *
+         * Declare it in the subclass instead of overriding `create`/`update` by hand.
+         * There were no encryption hooks here at all, so encryption was opt-in per
+         * method per repository — which meant `createWithId`, `update`, and the whole
+         * `*InTx` / `*InBatch` family were silent bypasses in any repo that had only
+         * overridden `create`. `sessions.deviceInfo.ip` sat in plaintext for exactly
+         * that reason.
+         */
+        this.piiFields = [];
+        /** Blind-index map (plaintext field → index field) for equality lookups. */
+        this.piiIndexMap = {};
         this.collection = collectionName;
     }
     get db() {
@@ -82,10 +96,43 @@ export class BaseRepository {
             throw new DatabaseError("Failed to fetch all documents", error);
         }
     }
+    /**
+     * Build this document's `searchTxt` tokens. Return `null` to leave the field
+     * alone (the default), so a collection opts in by overriding this.
+     *
+     * MUST NOT include PII: `searchTxt` stores readable fragments of the source
+     * text, so indexing an encrypted field would undo the encryption.
+     */
+    buildSearchTxtFor(_data) {
+        return null;
+    }
+    /**
+     * The one place writes are transformed. Every write path routes through here
+     * so a new method cannot silently skip encryption.
+     *
+     * `encryptPiiFields` is idempotent (it skips anything already carrying the
+     * `enc:v1:` prefix), so a subclass that still encrypts by hand before calling
+     * super is harmless rather than double-encrypted.
+     */
+    applyWriteHooks(data) {
+        let out = data;
+        if (this.piiFields.length > 0) {
+            out = {
+                ...encryptPiiFields(out, [...this.piiFields]),
+                // Indices are derived from the PLAINTEXT source and must not carry it
+                // along — see piiIndicesFor's docstring for the bug that caused.
+                ...piiIndicesFor(data, this.piiIndexMap),
+            };
+        }
+        const searchTxt = this.buildSearchTxtFor(out);
+        if (searchTxt)
+            out.searchTxt = searchTxt;
+        return out;
+    }
     async create(data) {
         try {
             const cleanData = prepareForFirestore({
-                ...data,
+                ...this.applyWriteHooks(data),
                 createdAt: new Date(),
                 updatedAt: new Date(),
             });
@@ -102,7 +149,7 @@ export class BaseRepository {
         try {
             const now = new Date();
             const cleanData = prepareForFirestore({
-                ...data,
+                ...this.applyWriteHooks(data),
                 createdAt: now,
                 updatedAt: now,
             });
@@ -125,7 +172,7 @@ export class BaseRepository {
     async update(id, data) {
         try {
             const cleanData = prepareForFirestore({
-                ...data,
+                ...this.applyWriteHooks(data),
                 updatedAt: new Date(),
             });
             await this.getCollection().doc(id).update(cleanData);
@@ -240,7 +287,7 @@ export class BaseRepository {
         const docRef = this.getCollection().doc();
         const now = new Date();
         tx.set(docRef, prepareForFirestore({
-            ...data,
+            ...this.applyWriteHooks(data),
             createdAt: now,
             updatedAt: now,
         }));
@@ -250,7 +297,7 @@ export class BaseRepository {
         const docRef = this.getCollection().doc(id);
         const now = new Date();
         tx.set(docRef, prepareForFirestore({
-            ...data,
+            ...this.applyWriteHooks(data),
             createdAt: now,
             updatedAt: now,
         }));
@@ -258,7 +305,7 @@ export class BaseRepository {
     }
     updateInTx(tx, id, data) {
         const docRef = this.getCollection().doc(id);
-        tx.update(docRef, prepareForFirestore({ ...data, updatedAt: new Date() }));
+        tx.update(docRef, prepareForFirestore({ ...this.applyWriteHooks(data), updatedAt: new Date() }));
     }
     deleteInTx(tx, id) {
         const docRef = this.getCollection().doc(id);
@@ -268,7 +315,7 @@ export class BaseRepository {
         const docRef = this.getCollection().doc();
         const now = new Date();
         batch.set(docRef, prepareForFirestore({
-            ...data,
+            ...this.applyWriteHooks(data),
             createdAt: now,
             updatedAt: now,
         }));
@@ -278,14 +325,14 @@ export class BaseRepository {
         const docRef = this.getCollection().doc(id);
         const now = new Date();
         batch.set(docRef, prepareForFirestore({
-            ...data,
+            ...this.applyWriteHooks(data),
             createdAt: now,
             updatedAt: now,
         }));
     }
     updateInBatch(batch, id, data) {
         const docRef = this.getCollection().doc(id);
-        batch.update(docRef, prepareForFirestore({ ...data, updatedAt: new Date() }));
+        batch.update(docRef, prepareForFirestore({ ...this.applyWriteHooks(data), updatedAt: new Date() }));
     }
     deleteInBatch(batch, id) {
         const docRef = this.getCollection().doc(id);