@mohasinac/appkit 4.30.18 → 4.31.0

package/dist/next/index.d.ts

@@ -19,8 +19,7 @@ export type { CacheConfig } from "./cache-middleware";
 export { createApiMiddleware, runChain, buildBaseContext, } from "./middleware/chain";
 export type { CreateApiMiddlewareConfig } from "./middleware/chain";
 export { piiScrubberMiddleware } from "./middleware/pii-scrubber";
-export { createPiiRedactorMiddleware } from "./middleware/pii-redactor";
-export type { BaseRequestContext, AuthRequestContext, Middleware, PiiRedactionRule, } from "./middleware";
+export type { BaseRequestContext, AuthRequestContext, Middleware, } from "./middleware";
 export { successResponse, errorResponse, ApiErrors } from "./api/api-response";
 export type { ApiSuccessResponse, ApiErrorResponse } from "./api/api-response";
 export { GlobalError } from "./components/GlobalError";

package/dist/next/index.js

@@ -19,7 +19,6 @@ export { withCache, invalidateCache } from "./cache-middleware";
 // PII-aware composable middleware chain (Phase 21)
 export { createApiMiddleware, runChain, buildBaseContext, } from "./middleware/chain";
 export { piiScrubberMiddleware } from "./middleware/pii-scrubber";
-export { createPiiRedactorMiddleware } from "./middleware/pii-redactor";
 // Standardized API response helpers
 export { successResponse, errorResponse, ApiErrors } from "./api/api-response";
 // Error UI view components

package/dist/next/middleware/index.d.ts

@@ -1,6 +1,4 @@
 export type { BaseRequestContext, AuthRequestContext, Middleware, } from "./types";
 export { piiScrubberMiddleware } from "./pii-scrubber";
-export { createPiiRedactorMiddleware } from "./pii-redactor";
-export type { PiiRedactionRule } from "./pii-redactor";
 export { createApiMiddleware, runChain, buildBaseContext } from "./chain";
 export type { CreateApiMiddlewareConfig } from "./chain";

package/dist/next/middleware/index.js

@@ -1,3 +1,2 @@
 export { piiScrubberMiddleware } from "./pii-scrubber";
-export { createPiiRedactorMiddleware } from "./pii-redactor";
 export { createApiMiddleware, runChain, buildBaseContext } from "./chain";

package/dist/next/routing/route-map.d.ts

@@ -149,7 +149,6 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly ORDER_INVOICE: (id: string) => string;
         readonly ORDER_PAYMENT: (id: string) => string;
         readonly NOTIFICATIONS: "/user/notifications";
-        readonly MESSAGES: "/user/messages";
         /** Plan §10 — claimed-coupons wallet (Active / Expired / Used tabs). */
         readonly CLAIMED_COUPONS: "/user/coupons";
         readonly BECOME_SELLER: "/user/become-seller";
@@ -175,7 +174,6 @@ export declare const DEFAULT_ROUTE_MAP: {
     };
     readonly STORE: {
         readonly DASHBOARD: "/store";
-        readonly MESSAGES: "/store/messages";
         readonly PRODUCTS: "/store/products";
         readonly PRODUCTS_NEW: "/store/products/new";
         readonly PRODUCTS_EDIT: (id: string) => string;
@@ -211,6 +209,8 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly FEATURES_NEW: "/store/features/new";
         readonly FEATURES_EDIT: (id: string) => string;
         readonly SLUG: "/store/slug";
+        /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+        readonly SUPPORT: "/store/support";
         readonly BUNDLES: "/store/bundles";
         readonly BUNDLES_NEW: "/store/bundles/new";
         readonly BUNDLES_EDIT: (id: string) => string;
@@ -282,6 +282,7 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly CAROUSELS_EDIT: (id: string) => string;
         readonly SECTIONS: "/admin/sections";
         readonly NAVIGATION: "/admin/navigation";
+        readonly ACTION_INDEX: "/admin/action-index";
         readonly NAVIGATION_NEW: "/admin/navigation/new";
         readonly NAVIGATION_EDIT: (id: string) => string;
         readonly CATEGORIES: "/admin/categories";
@@ -333,7 +334,6 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly EVENT_ENTRIES: (id: string) => string;
         readonly STORES: "/admin/stores";
         readonly STORE_DETAIL: (id: string) => string;
-        readonly FEATURE_FLAGS: "/admin/feature-flags";
         readonly COPILOT: "/admin/copilot";
         readonly ADS: "/admin/ads";
         readonly ADS_NEW: "/admin/ads/new";
@@ -552,7 +552,6 @@ export declare const ROUTES: {
         readonly ORDER_INVOICE: (id: string) => string;
         readonly ORDER_PAYMENT: (id: string) => string;
         readonly NOTIFICATIONS: "/user/notifications";
-        readonly MESSAGES: "/user/messages";
         /** Plan §10 — claimed-coupons wallet (Active / Expired / Used tabs). */
         readonly CLAIMED_COUPONS: "/user/coupons";
         readonly BECOME_SELLER: "/user/become-seller";
@@ -578,7 +577,6 @@ export declare const ROUTES: {
     };
     readonly STORE: {
         readonly DASHBOARD: "/store";
-        readonly MESSAGES: "/store/messages";
         readonly PRODUCTS: "/store/products";
         readonly PRODUCTS_NEW: "/store/products/new";
         readonly PRODUCTS_EDIT: (id: string) => string;
@@ -614,6 +612,8 @@ export declare const ROUTES: {
         readonly FEATURES_NEW: "/store/features/new";
         readonly FEATURES_EDIT: (id: string) => string;
         readonly SLUG: "/store/slug";
+        /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+        readonly SUPPORT: "/store/support";
         readonly BUNDLES: "/store/bundles";
         readonly BUNDLES_NEW: "/store/bundles/new";
         readonly BUNDLES_EDIT: (id: string) => string;
@@ -685,6 +685,7 @@ export declare const ROUTES: {
         readonly CAROUSELS_EDIT: (id: string) => string;
         readonly SECTIONS: "/admin/sections";
         readonly NAVIGATION: "/admin/navigation";
+        readonly ACTION_INDEX: "/admin/action-index";
         readonly NAVIGATION_NEW: "/admin/navigation/new";
         readonly NAVIGATION_EDIT: (id: string) => string;
         readonly CATEGORIES: "/admin/categories";
@@ -736,7 +737,6 @@ export declare const ROUTES: {
         readonly EVENT_ENTRIES: (id: string) => string;
         readonly STORES: "/admin/stores";
         readonly STORE_DETAIL: (id: string) => string;
-        readonly FEATURE_FLAGS: "/admin/feature-flags";
         readonly COPILOT: "/admin/copilot";
         readonly ADS: "/admin/ads";
         readonly ADS_NEW: "/admin/ads/new";
@@ -818,7 +818,6 @@ export declare const ROUTES: {
 /** @deprecated Use ROUTES.STORE instead */
 export declare const SELLER_ROUTES: {
     readonly DASHBOARD: "/store";
-    readonly MESSAGES: "/store/messages";
     readonly PRODUCTS: "/store/products";
     readonly PRODUCTS_NEW: "/store/products/new";
     readonly PRODUCTS_EDIT: (id: string) => string;
@@ -854,6 +853,8 @@ export declare const SELLER_ROUTES: {
     readonly FEATURES_NEW: "/store/features/new";
     readonly FEATURES_EDIT: (id: string) => string;
     readonly SLUG: "/store/slug";
+    /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+    readonly SUPPORT: "/store/support";
     readonly BUNDLES: "/store/bundles";
     readonly BUNDLES_NEW: "/store/bundles/new";
     readonly BUNDLES_EDIT: (id: string) => string;

package/dist/next/routing/route-map.js

@@ -153,7 +153,6 @@ export const DEFAULT_ROUTE_MAP = {
         ORDER_INVOICE: (id) => `/user/orders/${id}/invoice`,
         ORDER_PAYMENT: (id) => `/user/orders/${id}/payment`,
         NOTIFICATIONS: "/user/notifications",
-        MESSAGES: "/user/messages",
         /** Plan §10 — claimed-coupons wallet (Active / Expired / Used tabs). */
         CLAIMED_COUPONS: "/user/coupons",
         BECOME_SELLER: "/user/become-seller",
@@ -179,7 +178,6 @@ export const DEFAULT_ROUTE_MAP = {
     },
     STORE: {
         DASHBOARD: "/store",
-        MESSAGES: "/store/messages",
         PRODUCTS: "/store/products",
         PRODUCTS_NEW: "/store/products/new",
         PRODUCTS_EDIT: (id) => `/store/products/${id}/edit`,
@@ -215,6 +213,8 @@ export const DEFAULT_ROUTE_MAP = {
         FEATURES_NEW: "/store/features/new",
         FEATURES_EDIT: (id) => `/store/features/${id}/edit`,
         SLUG: "/store/slug",
+        /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+        SUPPORT: "/store/support",
         // SB1-J — bundles + prize draws
         BUNDLES: "/store/bundles",
         BUNDLES_NEW: "/store/bundles/new",
@@ -296,6 +296,14 @@ export const DEFAULT_ROUTE_MAP = {
         CAROUSELS_EDIT: (id) => `/admin/carousels/${id}/edit`,
         SECTIONS: "/admin/sections",
         NAVIGATION: "/admin/navigation",
+        /*
+         * The action index (W7 / D7) — one control plane for every page, setting
+         * and toggle a user can reach. It supersedes NAVIGATION and
+         * SETTINGS_NAVIGATION, neither of whose data ever reached a sidebar:
+         * `filterNavItems` short-circuits on a missing `id`, and no nav item had
+         * one until W6.
+         */
+        ACTION_INDEX: "/admin/action-index",
         NAVIGATION_NEW: "/admin/navigation/new",
         NAVIGATION_EDIT: (id) => `/admin/navigation/${id}/edit`,
         CATEGORIES: "/admin/categories",
@@ -348,7 +356,6 @@ export const DEFAULT_ROUTE_MAP = {
         EVENT_ENTRIES: (id) => `/admin/events/${id}/entries`,
         STORES: "/admin/stores",
         STORE_DETAIL: (id) => `/admin/stores/${id}/view`,
-        FEATURE_FLAGS: "/admin/feature-flags",
         COPILOT: "/admin/copilot",
         ADS: "/admin/ads",
         ADS_NEW: "/admin/ads/new",

package/dist/providers/auth-firebase/session.js

@@ -71,8 +71,10 @@ export const firebaseSessionProvider = {
             await getAdminAuthLite().revokeRefreshTokens(decoded.uid);
         }
         catch (_err) {
+            // Best-effort teardown: an expired/revoked/malformed cookie cannot be
+            // verified, and that is the state destroySession is trying to reach —
+            // reporting it would alarm on the success case.
             void normalizeError(_err);
-            // Best-effort: if cookie is already invalid, treat as already destroyed
         }
     },
 };

package/dist/providers/db-firebase/admin-app-lite.js

@@ -1,4 +1,9 @@
 import { initializeApp, getApps, cert } from "firebase-admin/app";
+// One resolver, not a second copy — this file duplicated admin.ts's URL
+// logic byte-for-byte, so the region-wrong fallback bug existed twice.
+// Imported from its own dependency-free module, NOT from ./admin, because the
+// whole point of admin-app-lite is not pulling the full admin module in.
+import { resolveRtdbUrl } from "./rtdb-url";
 function nodePath() { return require("path"); }
 function nodeFs() { return require("fs"); }
 // process.cwd() is Node.js-only; access via module.require so the Edge
@@ -26,17 +31,14 @@ export function getAdminAppLite() {
     let app;
     if (nodeFs().existsSync(keyPath)) {
         const sa = JSON.parse(nodeFs().readFileSync(keyPath, "utf8"));
-        const dbUrl = process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-            `https://${sa.project_id}-default-rtdb.firebaseio.com`;
+        const dbUrl = resolveRtdbUrl();
         app = initializeApp({ credential: cert(keyPath), databaseURL: dbUrl, ...(storageBucket && { storageBucket }) });
     }
     else if (process.env.FIREBASE_ADMIN_PROJECT_ID &&
         process.env.FIREBASE_ADMIN_CLIENT_EMAIL &&
         process.env.FIREBASE_ADMIN_PRIVATE_KEY) {
         const projectId = process.env.FIREBASE_ADMIN_PROJECT_ID.trim();
-        const dbUrl = process.env.FIREBASE_ADMIN_DATABASE_URL?.trim() ??
-            process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL?.trim() ??
-            `https://${projectId}-default-rtdb.firebaseio.com`;
+        const dbUrl = resolveRtdbUrl();
         app = initializeApp({
             credential: cert({
                 projectId,
@@ -63,9 +65,7 @@ export function getAdminAppLite() {
             : {};
         const projectId = firebaseConfig.projectId ?? process.env.GCLOUD_PROJECT ?? "";
         const dbUrl = firebaseConfig.databaseURL ??
-            process.env.FIREBASE_ADMIN_DATABASE_URL ??
-            process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-            (projectId ? `https://${projectId}-default-rtdb.firebaseio.com` : undefined);
+            resolveRtdbUrl();
         app = initializeApp({
             ...(dbUrl && { databaseURL: dbUrl }),
             ...(storageBucket && { storageBucket }),

package/dist/providers/db-firebase/admin.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../errors/normalize";
+import { resolveRtdbUrl } from "./rtdb-url";
 function nodePath() { return require("path"); }
 function nodeFs() { return require("fs"); }
 // process.cwd() is Node.js-only; access via module.require so the Edge
@@ -63,23 +64,36 @@ export function getAdminApp() {
         return existing;
     }
     const keyPath = nodePath().join(nodeCwd(), "firebase-admin-key.json");
-    const storageBucket = process.env.FIREBASE_ADMIN_STORAGE_BUCKET?.trim() ??
+    /*
+     * 🛑 `||`, not `??`.
+     *
+     * A Vercel env var that EXISTS but is empty yields `""`, and `""` is not
+     * nullish — so `??` short-circuits, the NEXT_PUBLIC fallback never runs, and
+     * `...(storageBucket && …)` then drops the key entirely. The app initialises
+     * with NO bucket and every own-bucket media request 500s with
+     * "Bucket name not specified".
+     *
+     * Invisible locally: `.env.local` does not define FIREBASE_ADMIN_STORAGE_BUCKET
+     * at all, so the fallback always runs here. `scripts/test-storage-flow.mjs`
+     * and `scripts/test-storage.mjs` both already use `||` for this same
+     * expression — this was the odd one out.
+     */
+    const storageBucket = process.env.FIREBASE_ADMIN_STORAGE_BUCKET?.trim() ||
         process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET?.trim();
     let app;
     try {
         if (nodeFs().existsSync(keyPath)) {
             const sa = JSON.parse(nodeFs().readFileSync(keyPath, "utf8"));
-            const dbUrl = process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-                `https://${sa.project_id}-default-rtdb.firebaseio.com`;
+            // Was NEXT_PUBLIC-only here while the other two branches honoured
+            // FIREBASE_ADMIN_DATABASE_URL, so setting it had no effect on this path.
+            const dbUrl = resolveRtdbUrl();
             app = initializeApp({ credential: cert(keyPath), databaseURL: dbUrl, ...(storageBucket && { storageBucket }) });
         }
         else if (process.env.FIREBASE_ADMIN_PROJECT_ID &&
             process.env.FIREBASE_ADMIN_CLIENT_EMAIL &&
             process.env.FIREBASE_ADMIN_PRIVATE_KEY) {
             const projectId = process.env.FIREBASE_ADMIN_PROJECT_ID.trim();
-            const dbUrl = process.env.FIREBASE_ADMIN_DATABASE_URL?.trim() ??
-                process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL?.trim() ??
-                `https://${projectId}-default-rtdb.firebaseio.com`;
+            const dbUrl = resolveRtdbUrl();
             app = initializeApp({
                 credential: cert({
                     projectId,
@@ -105,12 +119,9 @@ export function getAdminApp() {
                 ? JSON.parse(process.env.FIREBASE_CONFIG)
                 : {};
             const projectId = firebaseConfig.projectId ?? process.env.GCLOUD_PROJECT ?? "";
-            const dbUrl = firebaseConfig.databaseURL ??
-                process.env.FIREBASE_ADMIN_DATABASE_URL ??
-                process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL ??
-                (projectId
-                    ? `https://${projectId}-default-rtdb.firebaseio.com`
-                    : undefined);
+            // FIREBASE_CONFIG is injected by the Functions runtime and is
+            // authoritative there; env vars are the fallback for other runtimes.
+            const dbUrl = firebaseConfig.databaseURL || resolveRtdbUrl();
             app = initializeApp({
                 ...(dbUrl && { databaseURL: dbUrl }),
                 ...(storageBucket && { storageBucket }),
@@ -153,8 +164,11 @@ export function getAdminDb() {
         db.settings({ ignoreUndefinedProperties: true });
     }
     catch (_err) {
+        // Firestore rejects a second settings() call on an already-initialised
+        // instance, which is the only way this throws (HMR reload / duplicate
+        // module instance re-entering the memoised bootstrap). The instance is
+        // fully usable either way, so there is nothing degraded to report.
         void normalizeError(_err);
-        // Already configured — safe to ignore.
     }
     set("__mohasinac_firebase_admin_db__", db);
     return db;

package/dist/providers/db-firebase/browser-stub.d.ts

@@ -22,17 +22,7 @@ export declare function prepareForFirestore(data: any): any;
 export declare function deserializeTimestamps<T>(data: any): T;
 export declare const FirebaseRepository: any;
 export declare const FirebaseSieveRepository: any;
-export declare const FirebaseRealtimeRepository: any;
 export declare const firebaseDbProvider: any;
-export declare const RTDB_PATHS: {
-    readonly PRESENCE: "presence";
-    readonly CHAT: "chat";
-    readonly NOTIFICATIONS: "notifications";
-    readonly LIVE_UPDATES: "live_updates";
-    readonly AUTH_EVENTS: "auth_events";
-    readonly PAYMENT_EVENTS: "payment_events";
-    readonly BULK_EVENTS: "bulk_events";
-    readonly SEED_EVENTS: "seed_events";
-};
+export { RTDB_PATHS } from "./rtdb-paths";
 export { buildFirebaseClientConfig, normalizeFirebaseConfigValue } from './client-config';
 export type { FirebaseClientConfig } from './client-config';

package/dist/providers/db-firebase/browser-stub.js

@@ -40,17 +40,12 @@ export function deserializeTimestamps(data) {
 }
 export const FirebaseRepository = null;
 export const FirebaseSieveRepository = null;
-export const FirebaseRealtimeRepository = null;
 export const firebaseDbProvider = null;
-export const RTDB_PATHS = {
-    PRESENCE: "presence",
-    CHAT: "chat",
-    NOTIFICATIONS: "notifications",
-    LIVE_UPDATES: "live_updates",
-    AUTH_EVENTS: "auth_events",
-    PAYMENT_EVENTS: "payment_events",
-    BULK_EVENTS: "bulk_events",
-    SEED_EVENTS: "seed_events",
-};
+// Re-exported, NOT re-declared. This file is the `browser` resolution target, so
+// the byte-for-byte copy that used to live here meant client code and server
+// code read two independently-maintained definitions of the same constant, with
+// nothing guarding the drift. `rtdb-paths.ts` has no imports, so it is safe to
+// pull into a browser bundle directly.
+export { RTDB_PATHS } from "./rtdb-paths";
 // Client config builder � safe in all environments
 export { buildFirebaseClientConfig, normalizeFirebaseConfigValue } from './client-config';

package/dist/providers/db-firebase/index.d.ts

@@ -20,7 +20,6 @@ export type { DocumentSnapshot } from "firebase-admin/firestore";
 export { FirebaseRepository } from "./base";
 export { BaseRepository } from "./base.repository";
 export { FirebaseSieveRepository } from "./sieve";
-export { FirebaseRealtimeRepository } from "./realtime";
 export { RTDB_PATHS } from "./rtdb-paths";
 import type { IDbProvider } from "../../contracts";
 export declare const firebaseDbProvider: IDbProvider;

package/dist/providers/db-firebase/index.js

@@ -27,7 +27,6 @@ export { firebaseFieldOps } from "./field-ops";
 export { FirebaseRepository } from "./base";
 export { BaseRepository } from "./base.repository";
 export { FirebaseSieveRepository } from "./sieve";
-export { FirebaseRealtimeRepository } from "./realtime";
 // Re-export RTDB paths
 export { RTDB_PATHS } from "./rtdb-paths";
 import { FirebaseRepository as _FirebaseRepository } from "./base";

package/dist/providers/db-firebase/rtdb-paths.d.ts

@@ -1,13 +1,22 @@
 /**
- * Shared Realtime Database path constants for auth/payment/bulk event channels.
+ * Shared Realtime Database path constants for the auth/payment/bulk event channels.
+ *
+ * 🛑 Only paths that are actually referenced through this constant belong here.
+ * Five keys were removed on 2026-08-29 — `PRESENCE`, `CHAT`, `NOTIFICATIONS`,
+ * `LIVE_UPDATES`, `SEED_EVENTS` — every one with **zero consumers**, because
+ * each live call site hardcodes its path string instead. A constant nobody uses
+ * is not a source of truth; it is a second place for the value to be wrong, and
+ * three of those five named RTDB nodes that no longer exist at all.
+ *
+ * If you add a key, migrate the call sites to it in the same change.
+ *
+ * This module has NO imports on purpose — that is what lets `browser-stub.ts`
+ * re-export it rather than keep the byte-for-byte duplicate it used to carry.
+ * The stub is the `browser` resolution target, so that duplicate meant client
+ * code and server code were reading two independently-maintained copies.
  */
 export declare const RTDB_PATHS: {
-    readonly PRESENCE: "presence";
-    readonly CHAT: "chat";
-    readonly NOTIFICATIONS: "notifications";
-    readonly LIVE_UPDATES: "live_updates";
     readonly AUTH_EVENTS: "auth_events";
     readonly PAYMENT_EVENTS: "payment_events";
     readonly BULK_EVENTS: "bulk_events";
-    readonly SEED_EVENTS: "seed_events";
 };

package/dist/providers/db-firebase/rtdb-paths.js

@@ -1,13 +1,22 @@
 /**
- * Shared Realtime Database path constants for auth/payment/bulk event channels.
+ * Shared Realtime Database path constants for the auth/payment/bulk event channels.
+ *
+ * 🛑 Only paths that are actually referenced through this constant belong here.
+ * Five keys were removed on 2026-08-29 — `PRESENCE`, `CHAT`, `NOTIFICATIONS`,
+ * `LIVE_UPDATES`, `SEED_EVENTS` — every one with **zero consumers**, because
+ * each live call site hardcodes its path string instead. A constant nobody uses
+ * is not a source of truth; it is a second place for the value to be wrong, and
+ * three of those five named RTDB nodes that no longer exist at all.
+ *
+ * If you add a key, migrate the call sites to it in the same change.
+ *
+ * This module has NO imports on purpose — that is what lets `browser-stub.ts`
+ * re-export it rather than keep the byte-for-byte duplicate it used to carry.
+ * The stub is the `browser` resolution target, so that duplicate meant client
+ * code and server code were reading two independently-maintained copies.
  */
 export const RTDB_PATHS = {
-    PRESENCE: "presence",
-    CHAT: "chat",
-    NOTIFICATIONS: "notifications",
-    LIVE_UPDATES: "live_updates",
     AUTH_EVENTS: "auth_events",
     PAYMENT_EVENTS: "payment_events",
     BULK_EVENTS: "bulk_events",
-    SEED_EVENTS: "seed_events",
 };

package/dist/providers/db-firebase/rtdb-url.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Resolve the Realtime Database URL from the environment.
+ *
+ * Its own module, with **no imports**, because both `admin.ts` and
+ * `admin-app-lite.ts` need it and `admin-app-lite` exists precisely to avoid
+ * pulling in the full admin module. They previously carried byte-for-byte
+ * duplicate resolution logic, which meant the bug below existed twice.
+ *
+ * 🛑 Returns `undefined` rather than guessing.
+ *
+ * All six copies used to fall back to `https://${projectId}-default-rtdb.firebaseio.com`.
+ * That is the **us-central1** URL shape; this project's instance lives at
+ * `…-default-rtdb.asia-southeast1.firebasedatabase.app`. So whenever the env var
+ * was missing, every server RTDB write silently targeted a database that does
+ * not exist — and since all nine RTDB writers wrap their call in a swallowing
+ * try/catch, messaging, bids, job status and payment signalling would every one
+ * of them degrade to "nothing ever updates", with clean warn-level logs.
+ *
+ * A guessed URL cannot be correct for a non-default region, so guessing buys
+ * nothing and costs the ability to notice. With no `databaseURL`,
+ * `getAdminRealtimeDb()` fails loudly at first use instead, which is the
+ * outcome you want.
+ *
+ * `||` not `??`: an env var that is present but empty must fall through, and
+ * `??` only falls through on null/undefined.
+ */
+export declare function resolveRtdbUrl(): string | undefined;

package/dist/providers/db-firebase/rtdb-url.js

@@ -0,0 +1,50 @@
+/**
+ * Resolve the Realtime Database URL from the environment.
+ *
+ * Its own module, with **no imports**, because both `admin.ts` and
+ * `admin-app-lite.ts` need it and `admin-app-lite` exists precisely to avoid
+ * pulling in the full admin module. They previously carried byte-for-byte
+ * duplicate resolution logic, which meant the bug below existed twice.
+ *
+ * 🛑 Returns `undefined` rather than guessing.
+ *
+ * All six copies used to fall back to `https://${projectId}-default-rtdb.firebaseio.com`.
+ * That is the **us-central1** URL shape; this project's instance lives at
+ * `…-default-rtdb.asia-southeast1.firebasedatabase.app`. So whenever the env var
+ * was missing, every server RTDB write silently targeted a database that does
+ * not exist — and since all nine RTDB writers wrap their call in a swallowing
+ * try/catch, messaging, bids, job status and payment signalling would every one
+ * of them degrade to "nothing ever updates", with clean warn-level logs.
+ *
+ * A guessed URL cannot be correct for a non-default region, so guessing buys
+ * nothing and costs the ability to notice. With no `databaseURL`,
+ * `getAdminRealtimeDb()` fails loudly at first use instead, which is the
+ * outcome you want.
+ *
+ * `||` not `??`: an env var that is present but empty must fall through, and
+ * `??` only falls through on null/undefined.
+ */
+export function resolveRtdbUrl() {
+    // 🛑 Emulator first.
+    //
+    // `firebase.json` has declared a database emulator on port 9000 for a long
+    // time and NOTHING ever connected to it. Client writes were shielded only
+    // because every rule is `.write: false`; server writes use the Admin SDK and
+    // bypass rules entirely — so `npm run dev` wrote to PRODUCTION. A local bid
+    // overwrote the prod `auction-bids` node that live auction pages subscribe to,
+    // and a local message send wrote prod `chats/**`.
+    //
+    // `FIREBASE_DATABASE_EMULATOR_HOST` is the standard variable the Firebase CLI
+    // exports for exactly this, so honouring it costs one branch and makes
+    // `firebase emulators:start` do what everyone already assumed it did.
+    const emulatorHost = process.env.FIREBASE_DATABASE_EMULATOR_HOST?.trim();
+    if (emulatorHost) {
+        const ns = process.env.FIREBASE_ADMIN_PROJECT_ID?.trim() ||
+            process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID?.trim() ||
+            "default";
+        return `http://${emulatorHost}?ns=${ns}`;
+    }
+    return (process.env.FIREBASE_ADMIN_DATABASE_URL?.trim() ||
+        process.env.NEXT_PUBLIC_FIREBASE_DATABASE_URL?.trim() ||
+        undefined);
+}

package/dist/providers/db-firebase/sieve.d.ts

@@ -117,6 +117,28 @@ export interface SieveOptions {
      */
     aliases?: SieveFilterAliases;
 }
+/**
+ * 🛑 THE canonical list envelope. Every repository returns this shape.
+ *
+ * A list endpoint should emit it unchanged — `return successResponse(result)` —
+ * and a listing view should read `response.items`. Where a route instead
+ * destructures `result.items` and re-emits it as `products` / `orders` /
+ * `tickets`, the view has to rename it back in `mapRows`, and the two renames
+ * are a pair that can drift. Fifteen such keys exist; `audit-list-envelope`
+ * names them and refuses a sixteenth.
+ *
+ * Nothing type-errors when they drift, which is why they accumulated:
+ * `ListingViewConfig<TResponse, TRow>` treats `TResponse` as opaque and
+ * delegates the read to a per-view callback.
+ *
+ * **`pageSize`, never `perPage`.** Three other spellings existed and all three
+ * were dead on 2026-08-31 — `GenericListResponse` (which declared BOTH, each
+ * optional, so a value could supply neither), appkit's `AdminListResponse`, and
+ * the whole `pagination.helper.ts` module. All deleted. `PagedResult` in
+ * contracts/repository.ts still spells it `perPage` and is genuinely live in 14
+ * repositories via `IReadRepository.findAll`; converging that is a change to the
+ * repository contract itself, not to an envelope.
+ */
 export interface SieveResult<T> {
     items: T[];
     total: number;

package/dist/providers/firebase-client/realtime.d.ts

@@ -11,7 +11,27 @@ export interface FirebaseClientRealtimeConfig {
 export declare class FirebaseClientRealtimeProvider implements IClientRealtimeProvider {
     private app;
     private db;
+    private readonly config;
+    private readonly appName;
+    private readonly scoped;
     constructor(config: FirebaseClientRealtimeConfig);
+    /**
+     * A provider bound to its OWN Firebase app for this claim scope.
+     *
+     * 🛑 This is what makes concurrent channels safe. Firebase Auth state is
+     * per-app, so with one shared app every `signInWithToken` REPLACED the claims
+     * of every other live subscriber: a bulk job signing in with a
+     * `{ bulkJobId }`-only token instantly stripped `conversationIds` from an open
+     * messages subscription, and vice versa. Whoever signed in last won.
+     *
+     * Reference-counting fixed only the sign-OUT half of that (a finishing job no
+     * longer ends someone else's session). Sign-IN needed separate apps, because
+     * there is nothing to coordinate — two channels legitimately need two
+     * different claim sets at the same time.
+     *
+     * Apps are cached per scope and reused, so a remount does not leak one.
+     */
+    forScope(scope: string): IClientRealtimeProvider;
     signInWithToken(token: string): Promise<void>;
     signOut(): Promise<void>;
     subscribe(path: string, onData: (snapshot: RealtimeSnapshot) => void, onError?: (error: Error) => void): Unsubscribe;

package/dist/providers/firebase-client/realtime.js

@@ -7,12 +7,44 @@ import { getAuth, signInWithCustomToken, signOut } from "firebase/auth";
  */
 export class FirebaseClientRealtimeProvider {
     constructor(config) {
+        this.scoped = new Map();
         const appName = config.appName ?? "appkit-realtime";
+        this.config = config;
+        this.appName = appName;
         this.app =
             getApps().find((a) => a.name === appName) ??
                 initializeApp(config.firebaseConfig, appName);
         this.db = getDatabase(this.app);
     }
+    /**
+     * A provider bound to its OWN Firebase app for this claim scope.
+     *
+     * 🛑 This is what makes concurrent channels safe. Firebase Auth state is
+     * per-app, so with one shared app every `signInWithToken` REPLACED the claims
+     * of every other live subscriber: a bulk job signing in with a
+     * `{ bulkJobId }`-only token instantly stripped `conversationIds` from an open
+     * messages subscription, and vice versa. Whoever signed in last won.
+     *
+     * Reference-counting fixed only the sign-OUT half of that (a finishing job no
+     * longer ends someone else's session). Sign-IN needed separate apps, because
+     * there is nothing to coordinate — two channels legitimately need two
+     * different claim sets at the same time.
+     *
+     * Apps are cached per scope and reused, so a remount does not leak one.
+     */
+    forScope(scope) {
+        const existing = this.scoped.get(scope);
+        if (existing)
+            return existing;
+        // Firebase app names are freeform, but keep them predictable in devtools.
+        const safe = scope.replace(/[^a-zA-Z0-9_-]/g, "-");
+        const child = new FirebaseClientRealtimeProvider({
+            ...this.config,
+            appName: `${this.appName}-${safe}`,
+        });
+        this.scoped.set(scope, child);
+        return child;
+    }
     async signInWithToken(token) {
         await signInWithCustomToken(getAuth(this.app), token);
     }
@@ -21,8 +53,9 @@ export class FirebaseClientRealtimeProvider {
             await signOut(getAuth(this.app));
         }
         catch (_err) {
+            // A secondary Firebase app that was never signed in has nothing to sign
+            // out of; the caller's goal (no credential on this app) already holds.
             void normalizeError(_err);
-            // no-op — signing out of a secondary app can fail harmlessly
         }
     }
     subscribe(path, onData, onError) {

package/dist/providers.d.ts

@@ -12,7 +12,7 @@
 export { registerProviders, getProviders } from "./contracts/index";
 export { configureMarketDefaults } from "./core/baseline-resolver";
 export { firebaseAuthProvider, firebaseSessionProvider, createSessionCookieFromToken, createSessionCookie, verifyIdToken, verifySessionCookie, createMiddlewareAuthChain, requireAuth, requireRole, requireAuthUser, requireRoleUser, getUserFromRequest, requireAuthFromRequest, requireRoleFromRequest, revokeUserTokens, } from "./providers/auth-firebase/index";
-export { firebaseDbProvider, getAdminApp, getAdminAuth, getAdminDb, getAdminStorage, getAdminRealtimeDb, _resetAdminSingletons, FirebaseRepository, BaseRepository, FirebaseSieveRepository, FirebaseRealtimeRepository, RTDB_PATHS, firebaseFieldOps, removeUndefined, prepareForFirestore, deserializeTimestamps, } from "./providers/db-firebase/index";
+export { firebaseDbProvider, getAdminApp, getAdminAuth, getAdminDb, getAdminStorage, getAdminRealtimeDb, _resetAdminSingletons, FirebaseRepository, BaseRepository, FirebaseSieveRepository, RTDB_PATHS, firebaseFieldOps, removeUndefined, prepareForFirestore, deserializeTimestamps, } from "./providers/db-firebase/index";
 export type { DocumentSnapshot } from "firebase-admin/firestore";
 export { firebaseStorageProvider } from "./providers/storage-firebase/index";
 export { createResendProvider } from "./providers/email-resend/index";