@mohasinac/appkit 4.30.18 → 4.30.19

package/dist/features/seller/components/SellerProductShell.d.ts

@@ -74,6 +74,11 @@ export interface SellerProductDraft {
 /** Shape returned by `onSave`/`onPublish` — structurally compatible with appkit's `ActionResult<T>` failure/success arms, without importing the server-only type into this client component. */
 export interface ProductActionResult {
     ok: boolean;
+    /**
+     * Stable error code. This is what the failure toast resolves — `error` is the
+     * server's own sentence and is reported, never shown (audit-raw-error-text).
+     */
+    code?: string;
     error?: string;
     issues?: unknown[];
 }

package/dist/features/seller/components/SellerProductShell.js

@@ -13,6 +13,7 @@ import { BarcodeField } from "./BarcodeField";
 import { pluginFor } from "../../../_internal/shared/listing-types/_registry";
 import { DEFAULT_MIN_OFFER_PERCENT } from "../../../_internal/shared/features/offers/config";
 import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 /**
  * "bundle" is a categoryType, not a ListingType, so it can't live in
  * LISTING_TYPE_REGISTRY — this is the single, explicit escape hatch that
@@ -346,18 +347,25 @@ export function SellerProductShell({ mode, listingType = "standard", initialValu
                 return;
             }
             applyZodIssues(result.issues ?? [], setFieldError);
-            if (!silent)
-                showToast(result.error || "Fix the highlighted errors and try again.", "error");
+            if (!silent) {
+                showToast(toUserMessage(result.code, undefined, {
+                    fallback: "Fix the highlighted errors and try again.",
+                }), "error");
+            }
         }
         catch (err) {
             void normalizeError(err);
             if (!silent)
-                showToast(err instanceof Error ? err.message : "Failed to save.", "error");
+                showToast("Failed to save.", "error");
         }
     }, [draft, onSave, markClean, clearErrors, setFieldError, showToast]);
     const handleAutoSave = useCallback(async () => {
         try {
             await handleSave(true);
+            // handleSave was called with silent=true, which is the whole point of
+            // auto-save: it has already applied the field errors and populated
+            // FormErrorSummary, so a toast every two seconds while the seller is
+            // still typing would be worse than saying nothing at all here.
         }
         catch (err) {
             void normalizeError(err);
@@ -383,11 +391,13 @@ export function SellerProductShell({ mode, listingType = "standard", initialValu
                 return;
             }
             applyZodIssues(result.issues ?? [], setFieldError);
-            showToast(result.error || "Fix the highlighted errors and try again.", "error");
+            showToast(toUserMessage(result.code, undefined, {
+                fallback: "Fix the highlighted errors and try again.",
+            }), "error");
         }
         catch (err) {
             void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to publish.", "error");
+            showToast("Failed to publish.", "error");
         }
     }, [draft, onPublish, markClean, clearErrors, setFieldError, showToast]);
     const listingTypeLabel = pluginForMode(listingType).typeLabel;

package/dist/features/seller/components/SellerProductsView.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 import { SIEVE_OP, Stack, sieveFilter } from "@mohasinac/appkit/client";
 import { sortBy } from "@mohasinac/appkit/client";
 import { useState, useCallback } from "react";
@@ -148,15 +149,23 @@ export function SellerProductsView({ onDeleteProduct, onCreateClick, }) {
         await performDelete(row.id);
     };
     const handleDuplicate = async (row) => {
-        const res = await fetch(SELLER_ENDPOINTS.PRODUCT_DUPLICATE(row.id), {
-            method: "POST",
-        }).catch(() => null);
-        if (res && res.ok) {
+        // A swallowed failure here does nothing at all and says nothing — the
+        // seller clicks Duplicate and no copy appears, with no way to tell whether
+        // the request even left the browser.
+        try {
+            const res = await fetch(SELLER_ENDPOINTS.PRODUCT_DUPLICATE(row.id), {
+                method: "POST",
+            });
+            if (!res.ok)
+                throw new Error(`Duplicate failed (${res.status})`);
             const json = await res.json().catch(() => null);
             const newId = json?.data?.id;
             if (newId)
                 handleEdit({ ...row, id: newId });
         }
+        catch (err) {
+            showToast(normalizeError(err).message, "error");
+        }
     };
     const handleTogglePublish = async (row) => {
         const currentStatus = statusOverrides.get(row.id) ?? row.status;
@@ -167,10 +176,15 @@ export function SellerProductsView({ onDeleteProduct, onCreateClick, }) {
                 method: "PATCH",
                 headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({ status: newStatus }),
-            }).catch(() => null);
-            if (res?.ok) {
-                setStatusOverrides((prev) => new Map([...prev, [row.id, newStatus]]));
-            }
+            });
+            if (!res.ok)
+                throw new Error(`Could not change status (${res.status})`);
+            setStatusOverrides((prev) => new Map([...prev, [row.id, newStatus]]));
+        }
+        catch (err) {
+            // The row silently snapped back to its old status before this — a seller
+            // could not tell a rejected publish from a UI that had not repainted.
+            showToast(normalizeError(err).message, "error");
         }
         finally {
             setPublishingId(null);
@@ -191,8 +205,8 @@ export function SellerProductsView({ onDeleteProduct, onCreateClick, }) {
             setSetLocationOpen(false);
         }
         catch (err) {
-            void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to update location.", "error");
+            const e = normalizeError(err);
+            showToast(toUserMessage(e.code, undefined, { fallback: "Failed to update location." }), "error");
         }
     }, [showToast]);
     const config = {

package/dist/features/seller/components/SellerReviewsView.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { normalizeError } from "../../../errors/normalize";
 import { useCallback, useState } from "react";
 import { useQueryClient } from "@tanstack/react-query";
-import { Alert, Badge, Button, Checkbox, Div, Modal, Row, Select, SideDrawer, Span, Stack, Text, Textarea } from "../../../ui";
+import { Alert, Badge, Button, Checkbox, Div, Modal, Row, Select, SideDrawer, Span, Stack, Text, Textarea, useToast } from "../../../ui";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry";
 import { SELLER_BULK_ACTIONS, ROW_ACTION_META } from "../../products/constants/action-defs";
 import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints";
@@ -34,6 +34,7 @@ function statusBadge(status) {
 }
 export function SellerReviewsView({ reviewsApiBase = SELLER_ENDPOINTS.REVIEWS, replyApiBase = SELLER_ENDPOINTS.REVIEWS, }) {
     const queryClient = useQueryClient();
+    const { showToast } = useToast();
     const refetchReviews = useCallback(() => queryClient.invalidateQueries({ queryKey: ["seller", "reviews", "listing"] }), [queryClient]);
     // Reply drawer
     const [replyTarget, setReplyTarget] = useState(null);
@@ -80,45 +81,75 @@ export function SellerReviewsView({ reviewsApiBase = SELLER_ENDPOINTS.REVIEWS, r
             setReplySaving(false);
         }
     };
+    // The three submits below all closed their modal unconditionally, so a
+    // rejected or unsent request looked exactly like a successful one — the
+    // seller believed the contest/feedback/reply had been filed.
     const submitContest = useCallback(async (onDone) => {
         if (!contestTarget)
             return;
-        await fetch(SELLER_ENDPOINTS.REVIEW_CONTEST(contestTarget.id), {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ reason: contestReason }),
-        }).catch(() => null);
+        try {
+            const res = await fetch(SELLER_ENDPOINTS.REVIEW_CONTEST(contestTarget.id), {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ reason: contestReason }),
+            });
+            if (!res.ok)
+                throw new Error(`Could not submit the contest (${res.status})`);
+        }
+        catch (err) {
+            showToast(normalizeError(err).message, "error");
+            return;
+        }
         setContestTarget(null);
         setContestReason("");
         onDone();
-    }, [contestTarget, contestReason]);
+    }, [contestTarget, contestReason, showToast]);
     const submitFeedback = useCallback(async () => {
         if (!feedbackTarget)
             return;
-        await fetch(SELLER_ENDPOINTS.REVIEW_FEEDBACK(feedbackTarget.id), {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ feedback: feedbackText }),
-        }).catch(() => null);
+        try {
+            const res = await fetch(SELLER_ENDPOINTS.REVIEW_FEEDBACK(feedbackTarget.id), {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ feedback: feedbackText }),
+            });
+            if (!res.ok)
+                throw new Error(`Could not send the feedback (${res.status})`);
+        }
+        catch (err) {
+            showToast(normalizeError(err).message, "error");
+            return;
+        }
         setFeedbackTarget(null);
         setFeedbackText("");
-    }, [feedbackTarget, feedbackText]);
+    }, [feedbackTarget, feedbackText, showToast]);
     const submitBulkReply = useCallback(async () => {
         if (!bulkReplyText.trim() || bulkTargetIds.length === 0)
             return;
         setBulkSaving(true);
-        await Promise.all(bulkTargetIds.map((id) => fetch(`${replyApiBase}/${id}/reply`, {
+        // Partial success is the normal outcome of a bulk write, so report the
+        // count that failed rather than throwing away the whole batch's result.
+        const outcomes = await Promise.all(bulkTargetIds.map((id) => fetch(`${replyApiBase}/${id}/reply`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify({ reply: bulkReplyText }),
-        }).catch(() => null)));
+        })
+            .then((res) => res.ok)
+            .catch((err) => {
+            void normalizeError(err);
+            return false;
+        })));
+        const failed = outcomes.filter((ok) => !ok).length;
+        if (failed > 0) {
+            showToast(`${failed} of ${outcomes.length} replies could not be saved.`, "error");
+        }
         setBulkSaving(false);
         setBulkReplyOpen(false);
         setBulkReplyText("");
         bulkClearSelection?.();
         setBulkTargetIds([]);
         await refetchReviews();
-    }, [bulkReplyText, bulkTargetIds, replyApiBase, bulkClearSelection, refetchReviews]);
+    }, [bulkReplyText, bulkTargetIds, replyApiBase, bulkClearSelection, refetchReviews, showToast]);
     const config = {
         portal: "seller",
         title: "Reviews",

package/dist/features/seller/components/SellerShippingConfigsView.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 import { sortBy } from "@mohasinac/appkit/client";
 import { useState, useCallback } from "react";
 import { useEntityDelete } from "../../../react/hooks/useEntityDelete";
@@ -53,8 +54,8 @@ export function SellerShippingConfigsView({ onCreateClick, onEditClick, onDelete
             await performDelete(id);
         }
         catch (err) {
-            void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to delete shipping config", "error");
+            const e = normalizeError(err);
+            showToast(toUserMessage(e.code, undefined, { fallback: "Failed to delete shipping config." }), "error");
         }
         setDeleteTargetId(null);
     }, [performDelete, showToast]);
@@ -75,8 +76,8 @@ export function SellerShippingConfigsView({ onCreateClick, onEditClick, onDelete
             showToast("Default shipping config updated.", "success");
         }
         catch (err) {
-            void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to update default.", "error");
+            const e = normalizeError(err);
+            showToast(toUserMessage(e.code, undefined, { fallback: "Failed to update default." }), "error");
         }
         finally {
             setSettingDefaultId(null);

package/dist/features/seller/components/SellerStoreCategoriesView.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 import { Badge, sortBy } from "@mohasinac/appkit/client";
 import { useState, useCallback } from "react";
 import { useEntityDelete } from "../../../react/hooks/useEntityDelete";
@@ -49,8 +50,8 @@ export function SellerStoreCategoriesView({ onCreateClick, onEditClick, onDelete
             await performDelete(id);
         }
         catch (err) {
-            void normalizeError(err);
-            showToast(err instanceof Error ? err.message : "Failed to delete category", "error");
+            const e = normalizeError(err);
+            showToast(toUserMessage(e.code, undefined, { fallback: "Failed to delete category." }), "error");
         }
         setDeleteTargetId(null);
     }, [onDelete, performDelete, showToast]);

package/dist/features/stores/components/StoreDetailLayoutView.d.ts

@@ -1,6 +1,6 @@
 import React from "react";
 import type { ReactNode } from "react";
-export declare const getStoreBySlug: (slug: string) => Promise<import("@mohasinac/appkit").StoreDocument | null | undefined>;
+export declare const getStoreBySlug: (slug: string) => Promise<import("@mohasinac/appkit").StoreDocument | null>;
 export interface StoreDetailLayoutViewProps {
     storeSlug: string;
     /** The current active tab value: "products" | "auctions" | "reviews" | "about" */

package/dist/features/stores/components/StoreDetailLayoutView.js

@@ -2,6 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { sieveFilter, sieveAnd, SIEVE_OP } from "@mohasinac/appkit";
 import { cache } from "react";
 import { storeRepository, siteSettingsRepository, reviewRepository, couponsRepository } from "../../../repositories";
+import { safeRead } from "../../../errors/safe-read";
 import { ROUTES } from "../../../next";
 import { Container, Main, Section, Text } from "../../../ui";
 import { STORE_PAGE_TABS } from "../../products/constants/listing-tabs";
@@ -26,7 +27,10 @@ const STORE_LISTING_HREF = {
     // a real non-zero count and landed on a page with none of those items.
     art: (slug) => String(ROUTES.PUBLIC.STORE_ART(slug)),
 };
-export const getStoreBySlug = cache((slug) => storeRepository.findBySlug(slug).catch(() => undefined));
+// The store IS this layout's subject, and `findBySlug` already returns null for
+// "no such slug" — swallowing a read failure into the same value would render
+// the "Store not found." branch below for a live store during an outage.
+export const getStoreBySlug = cache((slug) => storeRepository.findBySlug(slug));
 function tabLabel(base, count) {
     if (!count)
         return base;
@@ -39,9 +43,14 @@ export async function StoreDetailLayoutView({ storeSlug, activeTab, children, sc
     }
     const storeId = store?.id;
     const [settings, trust] = await Promise.all([
-        siteSettingsRepository.findById("global").catch(() => null),
+        safeRead(() => siteSettingsRepository.findById("global"), {
+            route: "/stores/[slug]", key: "store.siteSettings", fallback: null,
+        }),
         scamRegistryEnabled && storeId
-            ? getSellerTrustStatus(storeId).catch(() => undefined)
+            // Fails open to "no trust verdict", which hides the badge entirely rather
+            // than asserting a seller is clear — but that has to be recorded, since a
+            // missing badge is exactly what a clean seller looks like.
+            ? safeRead(() => getSellerTrustStatus(storeId), { route: "/stores/[slug]", key: "store.sellerTrust", fallback: undefined })
             : Promise.resolve(undefined),
     ]);
     // One derived batch instead of nine copy-pasted per-type queries. The tabs

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -3728,7 +3728,22 @@ const rawTesterChecklistItems = [
                     href: "/admin/site",
                 },
                 { key: "admin-dashboard-widgets", label: "Admin dashboard widgets show accurate data", href: "/admin/dashboard" },
-                { key: "analytics-admin", label: "Admin analytics dashboard shows accurate data", href: "/admin/analytics" },
+                {
+                    key: "analytics-admin",
+                    label: "Admin analytics dashboard shows accurate data",
+                    href: "/admin/analytics",
+                },
+                {
+                    key: "analytics-traffic-card-has-numbers",
+                    label: "The \"Traffic today\" card shows a real number, and it MATCHES the Page Views tab beside it",
+                    description: "Fixed 2026-08-29. BEFORE: the card showed an em-dash forever — never even a 0. It subscribed to two Realtime Database paths written by a presence hook whose writes had been denied since the day it shipped (the RTDB rules are backend-write-only), and both subscriptions passed no error callback, so a permission denial fired nothing at all and the tiles simply never left their initial state. AFTER: the card reads the same Firestore pageview counter that backs the Page Views tab in the same tab strip, so the two figures must agree — compare them. If the card errors it now SAYS so instead of showing a dash.",
+                },
+                {
+                    key: "analytics-no-permission-denied",
+                    label: "Opening /admin/analytics logs no PERMISSION_DENIED in the browser console",
+                    description: "Fixed 2026-08-29. BEFORE: every admin page load produced two Firebase permission_denied warnings from the dead presence/analytics subscriptions. AFTER: none — those subscriptions are gone entirely. Open devtools, hard-reload the page, and confirm the console is clean of Firebase permission errors.",
+                    href: "/admin/analytics",
+                },
                 {
                     key: "pageviews-report-listing-standard",
                     label: "The \"Page Views\" tab in Admin Analytics is a full standard listing — a search box (by entity id or URL), an entity-type filter drawer, a \"Most views\"/\"Fewest views\" sort dropdown, and real pagination — not a bare unsearchable table",

package/dist/features/whatsapp-bot/components/SellerWhatsAppSettingsView.js

@@ -3,6 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useApiMutation, useBulkEvent, RTDB_PATHS } from "@mohasinac/appkit/client";
 import React from "react";
 import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 const __P = {
     p3: "p-[var(--appkit-space-3)]",
 };
@@ -156,9 +157,9 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
             }
         }
         catch (err) {
-            void normalizeError(err);
+            const e = normalizeError(err);
             setImporting(false);
-            showToast(err instanceof Error ? err.message : "Import failed", "error");
+            showToast(toUserMessage(e.code, undefined, { fallback: "Failed to start catalog import." }), "error");
         }
     };
     React.useEffect(() => {

package/dist/features/wishlist/hooks/useWishlistToggle.js

@@ -1,6 +1,8 @@
 "use client";
 import { useCallback, useState } from "react";
 import { useToast } from "../../../ui";
+import { normalizeError } from "../../../errors/normalize";
+import { toUserMessage } from "../../../errors/error-display-map";
 export function useWishlistToggle(productId, initial = false, actions) {
     const [inWishlist, setInWishlist] = useState(initial);
     const [isLoading, setIsLoading] = useState(false);
@@ -25,8 +27,13 @@ export function useWishlistToggle(productId, initial = false, actions) {
             }
         }
         catch (err) {
+            const e = normalizeError(err);
             setInWishlist(prev);
-            showToast(err instanceof Error ? err.message : "Something went wrong.", "error");
+            showToast(toUserMessage(e.code, undefined, {
+                fallback: prev
+                    ? "Could not remove this item from your wishlist."
+                    : "Could not add this item to your wishlist.",
+            }), "error");
             throw err;
         }
         finally {

package/dist/index.d.ts

@@ -333,6 +333,7 @@ export { RazorpayUnreachableError } from "./errors/index";
 export { mapToHttpError, HTTP_ERROR_CODES } from "./errors/index";
 export type { MappedError, HttpErrorCode } from "./errors/index";
 export { ERROR_DISPLAY_MAP, getErrorDisplay } from "./errors/index";
+export { toUserMessage, GENERIC_USER_MESSAGE } from "./errors/index";
 export type { ErrorDisplayEntry } from "./errors/index";
 export { parseJsonBody } from "./next/api/parseJsonBody";
 export { SEO_CONFIG } from "./seo/index";
@@ -849,7 +850,6 @@ export { requireRoleUser } from "./providers/auth-firebase/index";
 export { revokeUserTokens } from "./providers/auth-firebase/index";
 export { verifyIdToken } from "./providers/auth-firebase/index";
 export { verifySessionCookie } from "./providers/auth-firebase/index";
-export { FirebaseRealtimeRepository } from "./providers/db-firebase/index";
 export { FirebaseRepository } from "./providers/db-firebase/index";
 export { FirebaseSieveRepository } from "./providers/db-firebase/index";
 export { RTDB_PATHS } from "./providers/db-firebase/index";

package/dist/index.js

@@ -568,6 +568,11 @@ export { mapToHttpError, HTTP_ERROR_CODES } from "./errors/index";
 // [UTIL]-Pure utility — client-safe lookup of inline-field + i18n key per error code.
 // ERROR_DISPLAY_MAP - CLAUDE.md Rule #9 source-of-truth for client error rendering.
 export { ERROR_DISPLAY_MAP, getErrorDisplay } from "./errors/index";
+// [UTIL]-Pure utility — the ONLY sanctioned way to turn a failure into user copy.
+// toUserMessage - resolves a stable error code through errors.codes.*; terminates
+// in a constant, so a thrown value's own .message can never reach a user
+// (audit-raw-error-text).
+export { toUserMessage, GENERIC_USER_MESSAGE } from "./errors/index";
 // [SERVER-ONLY] parseJsonBody — strict JSON request-body parser for API routes.
 // Replaces the silent `request.json().catch(() => ({}))` anti-pattern. Throws
 // ValidationError on malformed JSON → routeHandler wrapper maps to 400.
@@ -1726,8 +1731,6 @@ export { verifyIdToken } from "./providers/auth-firebase/index";
 export { verifySessionCookie } from "./providers/auth-firebase/index";
 // ./providers/db-firebase/index
 // [DB]-Database layer â€" uses firebase-admin or another server-side DB SDK; can only run in a trusted server environment.
-// FirebaseRealtimeRepository - Shared export for firebase realtime repository.
-export { FirebaseRealtimeRepository } from "./providers/db-firebase/index";
 // [DB]-Database layer â€" uses firebase-admin or another server-side DB SDK; can only run in a trusted server environment.
 // FirebaseRepository - Shared export for firebase repository.
 export { FirebaseRepository } from "./providers/db-firebase/index";

package/dist/next/api/routeHandler.js

@@ -182,10 +182,12 @@ export function createRouteHandler(options) {
             else if (options.authOptional) {
                 try {
                     user = await verifySession(request);
+                    // Deliberate: this is the OPTIONAL-auth path. A bad or absent session means
+                    // anonymous, which is a legitimate outcome here — routes that require a
+                    // user use `auth: true`, which throws instead.
                 }
                 catch (_err) {
                     void normalizeError(_err);
-                    // anonymous
                 }
             }
             // -- Role check --------------------------------------------------------

package/dist/providers/auth-firebase/session.js

@@ -71,8 +71,10 @@ export const firebaseSessionProvider = {
             await getAdminAuthLite().revokeRefreshTokens(decoded.uid);
         }
         catch (_err) {
+            // Best-effort teardown: an expired/revoked/malformed cookie cannot be
+            // verified, and that is the state destroySession is trying to reach —
+            // reporting it would alarm on the success case.
             void normalizeError(_err);
-            // Best-effort: if cookie is already invalid, treat as already destroyed
         }
     },
 };

package/dist/providers/db-firebase/admin-app-lite.js

@@ -1,4 +1,9 @@
 import { initializeApp, getApps, cert } from "firebase-admin/app";
+// One resolver, not a second copy — this file duplicated admin.ts's URL
+// logic byte-for-byte, so the region-wrong fallback bug existed twice.
+// Imported from its own dependency-free module, NOT from ./admin, because the
+// whole point of admin-app-lite is not pulling the full admin module in.
+import { resolveRtdbUrl } from "./rtdb-url";
 function nodePath() { return require("path"); }
 function nodeFs() { return require("fs"); }
 // process.cwd() is Node.js-only; access via module.require so the Edge
@@ -26,17 +31,14 @@ export function getAdminAppLite() {
     let app;
     if (nodeFs().existsSync(keyPath)) {
         const sa = JSON.parse(nodeFs().readFileSync(keyPath, "utf8"));
-        const dbUrl = process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-            `https://${sa.project_id}-default-rtdb.firebaseio.com`;
+        const dbUrl = resolveRtdbUrl();
         app = initializeApp({ credential: cert(keyPath), databaseURL: dbUrl, ...(storageBucket && { storageBucket }) });
     }
     else if (process.env.FIREBASE_ADMIN_PROJECT_ID &&
         process.env.FIREBASE_ADMIN_CLIENT_EMAIL &&
         process.env.FIREBASE_ADMIN_PRIVATE_KEY) {
         const projectId = process.env.FIREBASE_ADMIN_PROJECT_ID.trim();
-        const dbUrl = process.env.FIREBASE_ADMIN_DATABASE_URL?.trim() ??
-            process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL?.trim() ??
-            `https://${projectId}-default-rtdb.firebaseio.com`;
+        const dbUrl = resolveRtdbUrl();
         app = initializeApp({
             credential: cert({
                 projectId,
@@ -63,9 +65,7 @@ export function getAdminAppLite() {
             : {};
         const projectId = firebaseConfig.projectId ?? process.env.GCLOUD_PROJECT ?? "";
         const dbUrl = firebaseConfig.databaseURL ??
-            process.env.FIREBASE_ADMIN_DATABASE_URL ??
-            process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-            (projectId ? `https://${projectId}-default-rtdb.firebaseio.com` : undefined);
+            resolveRtdbUrl();
         app = initializeApp({
             ...(dbUrl && { databaseURL: dbUrl }),
             ...(storageBucket && { storageBucket }),

package/dist/providers/db-firebase/admin.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../errors/normalize";
+import { resolveRtdbUrl } from "./rtdb-url";
 function nodePath() { return require("path"); }
 function nodeFs() { return require("fs"); }
 // process.cwd() is Node.js-only; access via module.require so the Edge
@@ -69,17 +70,16 @@ export function getAdminApp() {
     try {
         if (nodeFs().existsSync(keyPath)) {
             const sa = JSON.parse(nodeFs().readFileSync(keyPath, "utf8"));
-            const dbUrl = process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-                `https://${sa.project_id}-default-rtdb.firebaseio.com`;
+            // Was NEXT_PUBLIC-only here while the other two branches honoured
+            // FIREBASE_ADMIN_DATABASE_URL, so setting it had no effect on this path.
+            const dbUrl = resolveRtdbUrl();
             app = initializeApp({ credential: cert(keyPath), databaseURL: dbUrl, ...(storageBucket && { storageBucket }) });
         }
         else if (process.env.FIREBASE_ADMIN_PROJECT_ID &&
             process.env.FIREBASE_ADMIN_CLIENT_EMAIL &&
             process.env.FIREBASE_ADMIN_PRIVATE_KEY) {
             const projectId = process.env.FIREBASE_ADMIN_PROJECT_ID.trim();
-            const dbUrl = process.env.FIREBASE_ADMIN_DATABASE_URL?.trim() ??
-                process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL?.trim() ??
-                `https://${projectId}-default-rtdb.firebaseio.com`;
+            const dbUrl = resolveRtdbUrl();
             app = initializeApp({
                 credential: cert({
                     projectId,
@@ -105,12 +105,9 @@ export function getAdminApp() {
                 ? JSON.parse(process.env.FIREBASE_CONFIG)
                 : {};
             const projectId = firebaseConfig.projectId ?? process.env.GCLOUD_PROJECT ?? "";
-            const dbUrl = firebaseConfig.databaseURL ??
-                process.env.FIREBASE_ADMIN_DATABASE_URL ??
-                process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-                (projectId
-                    ? `https://${projectId}-default-rtdb.firebaseio.com`
-                    : undefined);
+            // FIREBASE_CONFIG is injected by the Functions runtime and is
+            // authoritative there; env vars are the fallback for other runtimes.
+            const dbUrl = firebaseConfig.databaseURL || resolveRtdbUrl();
             app = initializeApp({
                 ...(dbUrl && { databaseURL: dbUrl }),
                 ...(storageBucket && { storageBucket }),
@@ -153,8 +150,11 @@ export function getAdminDb() {
         db.settings({ ignoreUndefinedProperties: true });
     }
     catch (_err) {
+        // Firestore rejects a second settings() call on an already-initialised
+        // instance, which is the only way this throws (HMR reload / duplicate
+        // module instance re-entering the memoised bootstrap). The instance is
+        // fully usable either way, so there is nothing degraded to report.
         void normalizeError(_err);
-        // Already configured — safe to ignore.
     }
     set("__mohasinac_firebase_admin_db__", db);
     return db;

package/dist/providers/db-firebase/browser-stub.d.ts

@@ -22,17 +22,7 @@ export declare function prepareForFirestore(data: any): any;
 export declare function deserializeTimestamps<T>(data: any): T;
 export declare const FirebaseRepository: any;
 export declare const FirebaseSieveRepository: any;
-export declare const FirebaseRealtimeRepository: any;
 export declare const firebaseDbProvider: any;
-export declare const RTDB_PATHS: {
-    readonly PRESENCE: "presence";
-    readonly CHAT: "chat";
-    readonly NOTIFICATIONS: "notifications";
-    readonly LIVE_UPDATES: "live_updates";
-    readonly AUTH_EVENTS: "auth_events";
-    readonly PAYMENT_EVENTS: "payment_events";
-    readonly BULK_EVENTS: "bulk_events";
-    readonly SEED_EVENTS: "seed_events";
-};
+export { RTDB_PATHS } from "./rtdb-paths";
 export { buildFirebaseClientConfig, normalizeFirebaseConfigValue } from './client-config';
 export type { FirebaseClientConfig } from './client-config';

package/dist/providers/db-firebase/browser-stub.js

@@ -40,17 +40,12 @@ export function deserializeTimestamps(data) {
 }
 export const FirebaseRepository = null;
 export const FirebaseSieveRepository = null;
-export const FirebaseRealtimeRepository = null;
 export const firebaseDbProvider = null;
-export const RTDB_PATHS = {
-    PRESENCE: "presence",
-    CHAT: "chat",
-    NOTIFICATIONS: "notifications",
-    LIVE_UPDATES: "live_updates",
-    AUTH_EVENTS: "auth_events",
-    PAYMENT_EVENTS: "payment_events",
-    BULK_EVENTS: "bulk_events",
-    SEED_EVENTS: "seed_events",
-};
+// Re-exported, NOT re-declared. This file is the `browser` resolution target, so
+// the byte-for-byte copy that used to live here meant client code and server
+// code read two independently-maintained definitions of the same constant, with
+// nothing guarding the drift. `rtdb-paths.ts` has no imports, so it is safe to
+// pull into a browser bundle directly.
+export { RTDB_PATHS } from "./rtdb-paths";
 // Client config builder � safe in all environments
 export { buildFirebaseClientConfig, normalizeFirebaseConfigValue } from './client-config';

package/dist/providers/db-firebase/index.d.ts

@@ -20,7 +20,6 @@ export type { DocumentSnapshot } from "firebase-admin/firestore";
 export { FirebaseRepository } from "./base";
 export { BaseRepository } from "./base.repository";
 export { FirebaseSieveRepository } from "./sieve";
-export { FirebaseRealtimeRepository } from "./realtime";
 export { RTDB_PATHS } from "./rtdb-paths";
 import type { IDbProvider } from "../../contracts";
 export declare const firebaseDbProvider: IDbProvider;