@mohasinac/appkit 4.30.19 → 4.31.1

package/dist/next/index.js

@@ -19,7 +19,6 @@ export { withCache, invalidateCache } from "./cache-middleware";
 // PII-aware composable middleware chain (Phase 21)
 export { createApiMiddleware, runChain, buildBaseContext, } from "./middleware/chain";
 export { piiScrubberMiddleware } from "./middleware/pii-scrubber";
-export { createPiiRedactorMiddleware } from "./middleware/pii-redactor";
 // Standardized API response helpers
 export { successResponse, errorResponse, ApiErrors } from "./api/api-response";
 // Error UI view components
@@ -28,3 +27,39 @@ export { ErrorView } from "./components/ErrorView";
 export { NotFoundView } from "./components/NotFoundView";
 export { UnauthorizedView } from "./components/UnauthorizedView";
 export { ErrorBoundary } from "./ErrorBoundary";
+/*
+ * Pure, isomorphic nav helpers — deliberately re-exported HERE as well as from
+ * the main and client entries.
+ *
+ * 🛑 `src/constants/navigation.tsx` CALLS `navItemId()` at module scope and is
+ * imported by BOTH server code (the locale and store layouts, the action index)
+ * and client code (every sidebar). That leaves it nowhere to import from:
+ *
+ *   - `@mohasinac/appkit/client` is `"use client"`, so on the server the binding
+ *     is a client-reference proxy and calling it throws (Root Cause #76). It did
+ *     — "Attempted to call navItemId() from the server" failed the Vercel build.
+ *   - the bare `@mohasinac/appkit` entry then trips
+ *     `audit-client-server-only-leak` on all 57 client components that reach
+ *     navigation.tsx transitively (Root Cause #6).
+ *
+ * The two audits pull in opposite directions, and both are right. `./next` is
+ * the third door: not `"use client"`, and not a path to firebase-admin — so it
+ * satisfies both. This is the same reasoning that keeps `/ui` and `/tokens`
+ * separate entries.
+ */
+export { navItemId } from "../_internal/shared/features/layout/types";
+export { matchesNavQuery } from "../_internal/shared/features/layout/matchesNavQuery";
+/*
+ * The action-index derivation — same reasoning as the nav helpers above.
+ *
+ * `src/constants/action-index.ts` calls `buildActionIndexBase()` at module
+ * scope and is imported by `GET /api/action-index` (a server route) as well as
+ * by `LayoutShellClient` (a client component). Neither the `"use client"` entry
+ * nor the bare one works for both; `./next` does.
+ *
+ * Found by `audit-client-entry-in-server`'s R2 the first time it ran — the same
+ * defect as navItemId, one file over, and the next build failure in line.
+ */
+export { buildActionIndexBase, deriveNavEntries, deriveQuickActionEntries, } from "../features/search/action-index/derive";
+export { deriveSettingsEntries } from "../features/search/action-index/settings-entries";
+export { mergeActionIndex, projectActionIndexForViewer, } from "../features/search/action-index/types";

package/dist/next/middleware/index.d.ts

@@ -1,6 +1,4 @@
 export type { BaseRequestContext, AuthRequestContext, Middleware, } from "./types";
 export { piiScrubberMiddleware } from "./pii-scrubber";
-export { createPiiRedactorMiddleware } from "./pii-redactor";
-export type { PiiRedactionRule } from "./pii-redactor";
 export { createApiMiddleware, runChain, buildBaseContext } from "./chain";
 export type { CreateApiMiddlewareConfig } from "./chain";

package/dist/next/middleware/index.js

@@ -1,3 +1,2 @@
 export { piiScrubberMiddleware } from "./pii-scrubber";
-export { createPiiRedactorMiddleware } from "./pii-redactor";
 export { createApiMiddleware, runChain, buildBaseContext } from "./chain";

package/dist/next/routing/route-map.d.ts

@@ -149,7 +149,6 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly ORDER_INVOICE: (id: string) => string;
         readonly ORDER_PAYMENT: (id: string) => string;
         readonly NOTIFICATIONS: "/user/notifications";
-        readonly MESSAGES: "/user/messages";
         /** Plan §10 — claimed-coupons wallet (Active / Expired / Used tabs). */
         readonly CLAIMED_COUPONS: "/user/coupons";
         readonly BECOME_SELLER: "/user/become-seller";
@@ -175,7 +174,6 @@ export declare const DEFAULT_ROUTE_MAP: {
     };
     readonly STORE: {
         readonly DASHBOARD: "/store";
-        readonly MESSAGES: "/store/messages";
         readonly PRODUCTS: "/store/products";
         readonly PRODUCTS_NEW: "/store/products/new";
         readonly PRODUCTS_EDIT: (id: string) => string;
@@ -211,6 +209,8 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly FEATURES_NEW: "/store/features/new";
         readonly FEATURES_EDIT: (id: string) => string;
         readonly SLUG: "/store/slug";
+        /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+        readonly SUPPORT: "/store/support";
         readonly BUNDLES: "/store/bundles";
         readonly BUNDLES_NEW: "/store/bundles/new";
         readonly BUNDLES_EDIT: (id: string) => string;
@@ -282,6 +282,7 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly CAROUSELS_EDIT: (id: string) => string;
         readonly SECTIONS: "/admin/sections";
         readonly NAVIGATION: "/admin/navigation";
+        readonly ACTION_INDEX: "/admin/action-index";
         readonly NAVIGATION_NEW: "/admin/navigation/new";
         readonly NAVIGATION_EDIT: (id: string) => string;
         readonly CATEGORIES: "/admin/categories";
@@ -333,7 +334,6 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly EVENT_ENTRIES: (id: string) => string;
         readonly STORES: "/admin/stores";
         readonly STORE_DETAIL: (id: string) => string;
-        readonly FEATURE_FLAGS: "/admin/feature-flags";
         readonly COPILOT: "/admin/copilot";
         readonly ADS: "/admin/ads";
         readonly ADS_NEW: "/admin/ads/new";
@@ -552,7 +552,6 @@ export declare const ROUTES: {
         readonly ORDER_INVOICE: (id: string) => string;
         readonly ORDER_PAYMENT: (id: string) => string;
         readonly NOTIFICATIONS: "/user/notifications";
-        readonly MESSAGES: "/user/messages";
         /** Plan §10 — claimed-coupons wallet (Active / Expired / Used tabs). */
         readonly CLAIMED_COUPONS: "/user/coupons";
         readonly BECOME_SELLER: "/user/become-seller";
@@ -578,7 +577,6 @@ export declare const ROUTES: {
     };
     readonly STORE: {
         readonly DASHBOARD: "/store";
-        readonly MESSAGES: "/store/messages";
         readonly PRODUCTS: "/store/products";
         readonly PRODUCTS_NEW: "/store/products/new";
         readonly PRODUCTS_EDIT: (id: string) => string;
@@ -614,6 +612,8 @@ export declare const ROUTES: {
         readonly FEATURES_NEW: "/store/features/new";
         readonly FEATURES_EDIT: (id: string) => string;
         readonly SLUG: "/store/slug";
+        /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+        readonly SUPPORT: "/store/support";
         readonly BUNDLES: "/store/bundles";
         readonly BUNDLES_NEW: "/store/bundles/new";
         readonly BUNDLES_EDIT: (id: string) => string;
@@ -685,6 +685,7 @@ export declare const ROUTES: {
         readonly CAROUSELS_EDIT: (id: string) => string;
         readonly SECTIONS: "/admin/sections";
         readonly NAVIGATION: "/admin/navigation";
+        readonly ACTION_INDEX: "/admin/action-index";
         readonly NAVIGATION_NEW: "/admin/navigation/new";
         readonly NAVIGATION_EDIT: (id: string) => string;
         readonly CATEGORIES: "/admin/categories";
@@ -736,7 +737,6 @@ export declare const ROUTES: {
         readonly EVENT_ENTRIES: (id: string) => string;
         readonly STORES: "/admin/stores";
         readonly STORE_DETAIL: (id: string) => string;
-        readonly FEATURE_FLAGS: "/admin/feature-flags";
         readonly COPILOT: "/admin/copilot";
         readonly ADS: "/admin/ads";
         readonly ADS_NEW: "/admin/ads/new";
@@ -818,7 +818,6 @@ export declare const ROUTES: {
 /** @deprecated Use ROUTES.STORE instead */
 export declare const SELLER_ROUTES: {
     readonly DASHBOARD: "/store";
-    readonly MESSAGES: "/store/messages";
     readonly PRODUCTS: "/store/products";
     readonly PRODUCTS_NEW: "/store/products/new";
     readonly PRODUCTS_EDIT: (id: string) => string;
@@ -854,6 +853,8 @@ export declare const SELLER_ROUTES: {
     readonly FEATURES_NEW: "/store/features/new";
     readonly FEATURES_EDIT: (id: string) => string;
     readonly SLUG: "/store/slug";
+    /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+    readonly SUPPORT: "/store/support";
     readonly BUNDLES: "/store/bundles";
     readonly BUNDLES_NEW: "/store/bundles/new";
     readonly BUNDLES_EDIT: (id: string) => string;

package/dist/next/routing/route-map.js

@@ -153,7 +153,6 @@ export const DEFAULT_ROUTE_MAP = {
         ORDER_INVOICE: (id) => `/user/orders/${id}/invoice`,
         ORDER_PAYMENT: (id) => `/user/orders/${id}/payment`,
         NOTIFICATIONS: "/user/notifications",
-        MESSAGES: "/user/messages",
         /** Plan §10 — claimed-coupons wallet (Active / Expired / Used tabs). */
         CLAIMED_COUPONS: "/user/coupons",
         BECOME_SELLER: "/user/become-seller",
@@ -179,7 +178,6 @@ export const DEFAULT_ROUTE_MAP = {
     },
     STORE: {
         DASHBOARD: "/store",
-        MESSAGES: "/store/messages",
         PRODUCTS: "/store/products",
         PRODUCTS_NEW: "/store/products/new",
         PRODUCTS_EDIT: (id) => `/store/products/${id}/edit`,
@@ -215,6 +213,8 @@ export const DEFAULT_ROUTE_MAP = {
         FEATURES_NEW: "/store/features/new",
         FEATURES_EDIT: (id) => `/store/features/${id}/edit`,
         SLUG: "/store/slug",
+        /** Tickets raised ABOUT this store (W11). Read-only for the seller. */
+        SUPPORT: "/store/support",
         // SB1-J — bundles + prize draws
         BUNDLES: "/store/bundles",
         BUNDLES_NEW: "/store/bundles/new",
@@ -296,6 +296,14 @@ export const DEFAULT_ROUTE_MAP = {
         CAROUSELS_EDIT: (id) => `/admin/carousels/${id}/edit`,
         SECTIONS: "/admin/sections",
         NAVIGATION: "/admin/navigation",
+        /*
+         * The action index (W7 / D7) — one control plane for every page, setting
+         * and toggle a user can reach. It supersedes NAVIGATION and
+         * SETTINGS_NAVIGATION, neither of whose data ever reached a sidebar:
+         * `filterNavItems` short-circuits on a missing `id`, and no nav item had
+         * one until W6.
+         */
+        ACTION_INDEX: "/admin/action-index",
         NAVIGATION_NEW: "/admin/navigation/new",
         NAVIGATION_EDIT: (id) => `/admin/navigation/${id}/edit`,
         CATEGORIES: "/admin/categories",
@@ -348,7 +356,6 @@ export const DEFAULT_ROUTE_MAP = {
         EVENT_ENTRIES: (id) => `/admin/events/${id}/entries`,
         STORES: "/admin/stores",
         STORE_DETAIL: (id) => `/admin/stores/${id}/view`,
-        FEATURE_FLAGS: "/admin/feature-flags",
         COPILOT: "/admin/copilot",
         ADS: "/admin/ads",
         ADS_NEW: "/admin/ads/new",

package/dist/providers/db-firebase/admin.js

@@ -64,7 +64,21 @@ export function getAdminApp() {
         return existing;
     }
     const keyPath = nodePath().join(nodeCwd(), "firebase-admin-key.json");
-    const storageBucket = process.env.FIREBASE_ADMIN_STORAGE_BUCKET?.trim() ??
+    /*
+     * 🛑 `||`, not `??`.
+     *
+     * A Vercel env var that EXISTS but is empty yields `""`, and `""` is not
+     * nullish — so `??` short-circuits, the NEXT_PUBLIC fallback never runs, and
+     * `...(storageBucket && …)` then drops the key entirely. The app initialises
+     * with NO bucket and every own-bucket media request 500s with
+     * "Bucket name not specified".
+     *
+     * Invisible locally: `.env.local` does not define FIREBASE_ADMIN_STORAGE_BUCKET
+     * at all, so the fallback always runs here. `scripts/test-storage-flow.mjs`
+     * and `scripts/test-storage.mjs` both already use `||` for this same
+     * expression — this was the odd one out.
+     */
+    const storageBucket = process.env.FIREBASE_ADMIN_STORAGE_BUCKET?.trim() ||
         process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET?.trim();
     let app;
     try {

package/dist/providers/db-firebase/sieve.d.ts

@@ -117,6 +117,28 @@ export interface SieveOptions {
      */
     aliases?: SieveFilterAliases;
 }
+/**
+ * 🛑 THE canonical list envelope. Every repository returns this shape.
+ *
+ * A list endpoint should emit it unchanged — `return successResponse(result)` —
+ * and a listing view should read `response.items`. Where a route instead
+ * destructures `result.items` and re-emits it as `products` / `orders` /
+ * `tickets`, the view has to rename it back in `mapRows`, and the two renames
+ * are a pair that can drift. Fifteen such keys exist; `audit-list-envelope`
+ * names them and refuses a sixteenth.
+ *
+ * Nothing type-errors when they drift, which is why they accumulated:
+ * `ListingViewConfig<TResponse, TRow>` treats `TResponse` as opaque and
+ * delegates the read to a per-view callback.
+ *
+ * **`pageSize`, never `perPage`.** Three other spellings existed and all three
+ * were dead on 2026-08-31 — `GenericListResponse` (which declared BOTH, each
+ * optional, so a value could supply neither), appkit's `AdminListResponse`, and
+ * the whole `pagination.helper.ts` module. All deleted. `PagedResult` in
+ * contracts/repository.ts still spells it `perPage` and is genuinely live in 14
+ * repositories via `IReadRepository.findAll`; converging that is a change to the
+ * repository contract itself, not to an envelope.
+ */
 export interface SieveResult<T> {
     items: T[];
     total: number;

package/dist/react/hooks/useListingTypeFlags.d.ts

@@ -3,7 +3,7 @@ import type { ListingType } from "../../features/products/types/index";
  * W1-43 — useListingTypeFlags
  *
  * Returns the enabled-state for each listing type as configured in
- * `siteSettings.featureFlags.listingTypes`. Consumers should hide nav items,
+ * `siteSettings.listings.listingTypes`. Consumers should hide nav items,
  * filter TypeDropdown options, and reject API requests for disabled types.
  *
  * Defaults to all-enabled when settings haven't loaded yet — match the

package/dist/react/hooks/useListingTypeFlags.js

@@ -3,7 +3,7 @@ import { useSiteSettings } from "../../core/hooks/useSiteSettings";
 import { ALL_LISTING_TYPES } from "../../_internal/shared/listing-types/feature-flags";
 export function useListingTypeFlags() {
     const { data } = useSiteSettings();
-    const lt = data?.featureFlags?.listingTypes;
+    const lt = data?.listings?.listingTypes;
     // A type is disabled only when EXPLICITLY set to false — a missing flag (or
     // settings that haven't loaded) means enabled.
     const flags = Object.fromEntries(ALL_LISTING_TYPES.map((type) => [type, lt?.[type] !== false]));

package/dist/react/hooks/usePendingFilters.js

@@ -1,5 +1,6 @@
 "use client";
 import { useCallback, useMemo, useState } from "react";
+import { joinFilterValues, splitFilterValues } from "../../constants/table-keys";
 /**
  * usePendingFilters
  *
@@ -30,8 +31,9 @@ import { useCallback, useMemo, useState } from "react";
  */
 export function usePendingFilters({ table, keys, }) {
     const parseValues = useCallback((key) => {
-        const raw = table.get(key);
-        return raw ? raw.split(",").filter(Boolean) : [];
+        // `|`, not `,` — see FILTER_VALUE_DELIMITER. Splitting on a comma
+        // made a 3-value selection one element, so the badge read 1.
+        return splitFilterValues(table.get(key));
     }, [table]);
     const [pending, setPending] = useState(() => Object.fromEntries(keys.map((k) => [k, parseValues(k)])));
     const applied = useMemo(() => Object.fromEntries(keys.map((k) => [k, parseValues(k)])), [keys, parseValues]);
@@ -50,7 +52,7 @@ export function usePendingFilters({ table, keys, }) {
     const apply = useCallback((extras) => {
         const updates = { page: "1", ...extras };
         for (const k of keys) {
-            updates[k] = (pending[k] ?? []).join(",");
+            updates[k] = joinFilterValues(pending[k] ?? []);
         }
         table.setMany(updates);
     }, [keys, pending, table]);

package/dist/react/hooks/usePendingTable.js

@@ -1,6 +1,7 @@
 "use client";
 import { useMemo } from "react";
 import { usePendingFilters } from "./usePendingFilters";
+import { joinFilterValues, splitFilterValues } from "../../constants/table-keys";
 /**
  * usePendingTable
  *
@@ -24,14 +25,25 @@ import { usePendingFilters } from "./usePendingFilters";
  */
 export function usePendingTable(table, keys) {
     const filters = usePendingFilters({ table, keys });
+    /*
+     * `PendingTable` is a one-string-per-key view over an array-per-key buffer,
+     * so both directions have to go through the delimiter.
+     *
+     * `get` was `filters.pending[key]?.[0]` and `set` wrapped the whole string in
+     * a single-element array. That round-tripped a pipe-joined multi-select ONLY
+     * because `usePendingFilters` was splitting on a comma, which never divided
+     * it — `["a|b|c"]` in, `"a|b|c"` out. The moment that split became `|` (as it
+     * had to, for the badge to count), `[0]` would have started returning `"a"`
+     * and silently dropped every value after the first.
+     */
     const pendingTable = useMemo(() => ({
-        get: (key) => filters.pending[key]?.[0] ?? "",
+        get: (key) => joinFilterValues(filters.pending[key] ?? []),
         set: (key, value) => {
-            filters.set(key, value ? [value] : []);
+            filters.set(key, splitFilterValues(value));
         },
         setMany: (updates) => {
             for (const [k, v] of Object.entries(updates)) {
-                filters.set(k, v ? [v] : []);
+                filters.set(k, splitFilterValues(v));
             }
         },
     }), [filters.pending, filters.set]);

package/dist/repositories/index.d.ts

@@ -20,7 +20,6 @@ export { siteSettingsRepository } from "../features/admin/repository/site-settin
 export { analyticsRollupRepository } from "../features/admin/repository/analytics-rollup.repository";
 export type { AnalyticsRollupDocument } from "../features/admin/repository/analytics-rollup.repository";
 export { notificationRepository } from "../features/admin/repository/notification.repository";
-export { chatRepository } from "../features/admin/repository/chat.repository";
 export { carouselRepository } from "../features/homepage/repository/carousel.repository";
 export { carouselsRepository, CarouselsRepository } from "../features/homepage/repository/carousels.repository";
 export { homepageSectionsRepository } from "../features/homepage/repository/homepage-sections.repository";

package/dist/repositories/index.js

@@ -26,7 +26,6 @@ export { StoreRepository, storeRepository, } from "../features/stores/repository
 export { siteSettingsRepository } from "../features/admin/repository/site-settings.repository";
 export { analyticsRollupRepository } from "../features/admin/repository/analytics-rollup.repository";
 export { notificationRepository } from "../features/admin/repository/notification.repository";
-export { chatRepository } from "../features/admin/repository/chat.repository";
 export { carouselRepository } from "../features/homepage/repository/carousel.repository";
 export { carouselsRepository, CarouselsRepository } from "../features/homepage/repository/carousels.repository";
 export { homepageSectionsRepository } from "../features/homepage/repository/homepage-sections.repository";