@mohasinac/appkit 4.38.0 → 4.39.0

package/dist/features/stores/api/[storeSlug]/reviews/route.js

@@ -7,15 +7,27 @@
  * export { storeReviewsGET as GET } from "@mohasinac/feat-stores";
  * ```
  *
- * Aggregates approved reviews from up to 20 published products in a store.
+ * Aggregates every approved review filed against a store, by `storeId`.
  * Returns: reviews[], averageRating, totalReviews, ratingDistribution.
  *
+ * It used to aggregate "up to 20 published products by itemsSold" and fan out a
+ * review query per product — and since no product carries `itemsSold`, that
+ * `orderBy` matched nothing and the endpoint returned zero reviews for every
+ * store. See the block comment at the query for the full account.
+ *
  * Requires `db` registered in providers.config via `registerProviders()`.
  * Collections: "stores", "products", "reviews"
  */
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../../contracts";
 import { normalizeError } from "../../../../../errors/normalize";
+/**
+ * Upper bound on the reviews scanned to build a store's aggregate. The average
+ * rating and the distribution are computed over this window, so it must be
+ * generous — but it is still a bound, because the alternative is an unbounded
+ * read on a public, cacheable endpoint (Rule #6).
+ */
+const STORE_REVIEW_SCAN_CAP = 500;
 // --- GET /api/stores/[storeSlug]/reviews --------------------------------------
 export async function GET(request, context) {
     try {
@@ -44,40 +56,53 @@ export async function GET(request, context) {
         if (!store) {
             return NextResponse.json({ success: false, error: "Store not found" }, { status: 404 });
         }
-        // Fetch up to 20 published products for this seller
-        const productsRepo = db.getRepository("products");
-        const productsResult = await productsRepo.findAll({
-            filters: `storeId==${store.id},status==published`,
-            sort: "itemsSold",
-            order: "desc",
-            perPage: 20,
-        });
-        const products = productsResult.data;
-        // Fetch approved reviews for each product in parallel (cap 50 per product)
+        /*
+         * 🛑 REVIEWS ARE FETCHED BY `storeId`, IN ONE QUERY. Do not route this back
+         * through products.
+         *
+         * It used to select "the store's top 20 products by `itemsSold`" and then
+         * fan out one review query per product. Two independent defects, and the
+         * second hid the first:
+         *
+         *  - **`orderBy("itemsSold")` silently drops every document that lacks the
+         *    field**, exactly like the documented `!=` trap. Measured on production
+         *    2026-09-14: **0 of 95 products carry `itemsSold`**, so that query
+         *    returned an empty array — and therefore so did the whole endpoint.
+         *    Every store's reviews tab had been empty since it shipped, answering
+         *    HTTP 200 with `totalReviews: 0` while 79 approved reviews sat in
+         *    Firestore. Nothing errored; there was no symptom to report beyond "this
+         *    store has no reviews yet", which reads as a fact about the store.
+         *  - Even populated, a 20-product window is a SAMPLE, not the store: 14
+         *    distinct products carry reviews here and the store has 65 listings, so
+         *    an arbitrary slice would under-report the average rating and the
+         *    distribution — the two numbers buyers actually judge a seller by.
+         *
+         * `ReviewDocument` carries `storeId` (74/79 here belong to this store), so
+         * the store's reviews are one equality away. This also turns 21 Firestore
+         * queries into 1, well inside Rule #6's ~3-round-trip budget.
+         */
         const reviewsRepo = db.getRepository("reviews");
-        const reviewArrays = await Promise.all(products.map((p) => reviewsRepo
-            .findAll({
-            filters: `productId==${p.id},status==approved`,
+        const reviewsResult = await reviewsRepo.findAll({
+            filters: `storeId==${store.id},status==approved`,
             sort: "createdAt",
             order: "desc",
-            perPage: 50,
-        })
-            .then((r) => r.data)));
+            perPage: STORE_REVIEW_SCAN_CAP,
+        });
+        const allFlat = reviewsResult.data;
         // Compute aggregate metrics from ALL reviews (unfiltered)
         const ratingDistribution = { 1: 0, 2: 0, 3: 0, 4: 0, 5: 0 };
         let ratingSum = 0;
         let totalReviews = 0;
-        for (const reviews of reviewArrays) {
-            for (const review of reviews) {
-                totalReviews++;
-                ratingSum += review.rating;
-                ratingDistribution[review.rating] = (ratingDistribution[review.rating] ?? 0) + 1;
-            }
+        for (const review of allFlat) {
+            totalReviews++;
+            ratingSum += review.rating;
+            ratingDistribution[review.rating] = (ratingDistribution[review.rating] ?? 0) + 1;
         }
         const averageRating = totalReviews > 0 ? ratingSum / totalReviews : 0;
-        // Flatten all reviews
-        const productMap = new Map(products.map((p) => [p.id, p]));
-        const allFlat = reviewArrays.flat();
+        // Titles and images are enriched further down, from only the products the
+        // reviews on the CURRENT PAGE name. Every review already carries a
+        // denormalised `productTitle`, so a miss still renders a usable card.
+        const productsRepo = db.getRepository("products");
         // Apply sort
         const sorted = [...allFlat].sort((a, b) => {
             if (sort === "createdAt" || sort === "+createdAt") {
@@ -99,10 +124,20 @@ export async function GET(request, context) {
         // Apply search
         if (q) {
             filtered = filtered.filter((r) => {
-                const title = (r.title ?? "").toLowerCase();
-                const body = (r.body ?? "").toLowerCase();
+                const rv = r;
+                const title = (rv.title ?? "").toLowerCase();
+                /*
+                 * `comment` FIRST. The stored field is `comment` — verified against all
+                 * 79 production review documents, none of which has a `body`. This read
+                 * `body` alone, so searching a store's reviews only ever matched the
+                 * title or the product name, never a word the reviewer actually wrote.
+                 * `body` is kept as a fallback because it is what CLAUDE.md's reviews
+                 * row and several types call it; the two spellings have drifted and only
+                 * the data settles which is real.
+                 */
+                const text = (rv.comment ?? rv.body ?? "").toLowerCase();
                 const pt = (r.productTitle ?? "").toLowerCase();
-                return title.includes(q) || body.includes(q) || pt.includes(q);
+                return title.includes(q) || text.includes(q) || pt.includes(q);
             });
         }
         // Apply date range
@@ -124,7 +159,31 @@ export async function GET(request, context) {
         const totalFiltered = filtered.length;
         const totalPages = Math.max(1, Math.ceil(totalFiltered / pageSize));
         const pageSlice = filtered.slice((page - 1) * pageSize, page * pageSize);
-        // Enrich with product title + main image
+        // Enrich with product title + main image — only the ids on this page.
+        const pageProductIds = [...new Set(pageSlice.map((r) => r.productId).filter(Boolean))];
+        /*
+         * 🛑 DOCUMENT GETS, not a filter. The generic `findAll` on this provider
+         * parses a clause as `.where(field, op, coerceValue(value))` and has no
+         * pipe-join OR handling — so `id==a|b|c` would query for the LITERAL string
+         * "a|b|c" and match nothing, silently, which is the exact defect class this
+         * whole route is being fixed for. (Pipe-joins are a `sieveQuery` feature;
+         * this repository is not that path.) `id` is also not a stored field.
+         *
+         * Bounded by `pageSize`, capped at 50 above and typically ~12.
+         */
+        const productMap = new Map();
+        const fetched = await Promise.all(pageProductIds.map((id) => productsRepo.findById(id).catch((err) => {
+            // Named and logged, not swallowed: enrichment is genuinely optional
+            // (every review carries a denormalised productTitle), but a silent
+            // null here is indistinguishable from "that product was deleted" —
+            // Root Cause #59's shape, which is what this whole route was fixed for.
+            void normalizeError(err);
+            console.warn(`[feat-stores] products.findById failed for ${id}`);
+            return null;
+        })));
+        for (const p of fetched)
+            if (p)
+                productMap.set(p.id, p);
         const reviewsWithProduct = pageSlice.map((review) => ({
             ...review,
             productTitle: productMap.get(review.productId)?.title ?? review.productTitle,

package/dist/features/stores/components/StoresIndexPageView.js

@@ -13,7 +13,23 @@ export async function StoresIndexPageView({ searchParams = {} }) {
     const sort = sp(searchParams, "sort") || "-createdAt";
     const page = Number(sp(searchParams, "page")) || 1;
     const pageSize = Number(sp(searchParams, "pageSize")) || 24;
-    const result = await safeRead(() => storeRepository.listStores({ page, pageSize, sorts: sort }, true), { route: "/stores", key: "stores.listStores", fallback: null });
+    /*
+     * 🛑 `q` MUST be read here, and passed as the third argument exactly as
+     * /api/stores does — `listStores(model, true, { search })`.
+     *
+     * It was not, so /stores?q=anything rendered the FULL store list: measured
+     * live, `?q=zzzznope` returned two real store cards and no empty state. The
+     * search box looked like it worked because a real term also returns rows —
+     * only a nonsense term exposes a filter that is not filtering.
+     *
+     * And it could not self-correct on the client: this result is handed to
+     * <StoresIndexListing initialData=...>, and every public listing hook sets
+     * `staleTime: Infinity` when given SSR data, so the unfiltered first paint is
+     * frozen for that query key. Root Cause #30 — the SSR builder has to compute
+     * the same filters the client would, because it never gets a second chance.
+     */
+    const q = sp(searchParams, "q").trim();
+    const result = await safeRead(() => storeRepository.listStores({ page, pageSize, sorts: sort }, true, q ? { search: q } : undefined), { route: "/stores", key: "stores.listStores", fallback: null });
     /*
      * The API already filters this; the SSR page called the repository directly
      * and did not, so the first paint rendered a card for `store-tester-sandbox`

package/dist/features/tester/seed-data/authored/admin__users-trust.js

@@ -213,7 +213,7 @@ export const authored = {
     },
     "checklist-admin-users-trust-support-tickets-triage-admin": {
         roles: ["admin"],
-        startPage: "/admin/support",
+        startPage: "/admin/support-tickets",
         steps: [
             "Sign in as admin@letitrip.in / TempPass123!.",
             "Open the admin support tickets surface and read every column.",

package/dist/features/tester/seed-data/authored/buying__offers.js

@@ -468,7 +468,7 @@ export const authored = {
     },
     "checklist-buying-offers-ticket-resolution-timestamp-stamped": {
         roles: ["admin"],
-        startPage: "/admin/support",
+        startPage: "/admin/support-tickets",
         steps: [
             "Sign in as admin@letitrip.in / TempPass123!.",
             "Open the admin support tickets surface and open an open ticket.",

package/dist/features/tester/seed-data/authored/buying__user-dashboard-extras.js

@@ -52,7 +52,7 @@ export const authored = {
     },
     "checklist-buying-user-dashboard-extras-catalogue-crud": {
         roles: ["buyer"],
-        startPage: "/user",
+        startPage: "/user/catalogue",
         steps: [
             "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
             "Open the personal catalogue surface and read the existing items.",
@@ -90,7 +90,7 @@ export const authored = {
     },
     "checklist-buying-user-dashboard-extras-my-prize-draws": {
         roles: ["buyer"],
-        startPage: "/user",
+        startPage: "/user/prize-draws",
         steps: [
             "Sign in as tester@letitrip.in / TempPass123!.",
             "Open the buyer's prize-draws surface and read every row.",
@@ -106,7 +106,7 @@ export const authored = {
     },
     "checklist-buying-user-dashboard-extras-my-digital-codes": {
         roles: ["buyer"],
-        startPage: "/user",
+        startPage: "/user/digital-codes",
         steps: [
             "Sign in as tester@letitrip.in / TempPass123!.",
             "Open the buyer's digital-codes surface and read every row.",
@@ -232,7 +232,7 @@ export const authored = {
     },
     "checklist-buying-user-dashboard-extras-my-returns": {
         roles: ["buyer"],
-        startPage: "/user",
+        startPage: "/user/returns",
         steps: [
             "Sign in as tester@letitrip.in / TempPass123!.",
             "Open the buyer's returns surface and read every row.",
@@ -247,7 +247,7 @@ export const authored = {
     },
     "checklist-buying-user-dashboard-extras-my-reviews": {
         roles: ["buyer"],
-        startPage: "/user",
+        startPage: "/user/reviews",
         steps: [
             "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
             "Open the buyer's reviews surface and read every row.",
@@ -264,7 +264,7 @@ export const authored = {
     },
     "checklist-buying-user-dashboard-extras-user-personal-listings-search-sort": {
         roles: ["buyer"],
-        startPage: "/user",
+        startPage: "/user/digital-codes",
         steps: [
             "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
             "Open the personal catalogue surface and note the unfiltered item count.",

package/dist/features/tester/utils/phases.js

@@ -25,22 +25,88 @@ export const DEFAULT_TESTER_PHASE_SIZE = 25;
  * already be in catalog order (e.g. sorted by the `order` field).
  */
 export function assignDefaultPhases(itemsInCatalogOrder, targetPhaseSize = DEFAULT_TESTER_PHASE_SIZE) {
-    const phaseNumbers = new Array(itemsInCatalogOrder.length);
+    /*
+     * 🛑 PAGES ARE INTERLEAVED ACROSS GROUPS, NOT PACKED IN CATALOGUE ORDER.
+     *
+     * This used to walk the catalogue straight through, so a group's phase number
+     * was an accident of where its `...group(...)` spread sat in a 6,200-line
+     * literal. `admin` is the 9th spread, so its 231 cases landed at phases
+     * **25–32** — and any run that stops early is therefore GUARANTEED to lose
+     * the largest, most privileged group in its entirety. The same held for every
+     * infrastructure group in the tail: page-wiring (32–33), cta-layout (33),
+     * addresses and search-and-nav (34).
+     *
+     * That is not hypothetical. Run run-1789300124915 stopped at phase 17 of 34
+     * and ten of fourteen groups had ZERO coverage — 527 cases, including all 233
+     * admin ones — while the run looked about half done.
+     *
+     * Round-robin over groups fixes the shape rather than the symptom: an early
+     * stop now costs a proportional slice of every group instead of the whole
+     * tail. Groups are visited largest-first within each round so the big ones do
+     * not bunch up at the end as the small ones run out.
+     *
+     * A phase may now span several groups. That is fine for a tester session —
+     * it is ~25 cases either way — and every read path already groups by the
+     * STORED `item.phase`, never by position.
+     *
+     * 🛑 The RETURN IS STILL POSITIONAL. Items keep their catalogue order and
+     * their `order` field; only the phase LABEL changes. Nothing downstream
+     * reorders, and `fetch-cases` still sorts by (phase, order) to build batches.
+     */
+    const pageOrder = [];
+    const pageSize = new Map();
+    const pageGroup = new Map();
+    for (const item of itemsInCatalogOrder) {
+        const pageId = `${item.groupKey}␟${item.pageKey}`;
+        if (!pageSize.has(pageId)) {
+            pageOrder.push(pageId);
+            pageSize.set(pageId, 0);
+            pageGroup.set(pageId, item.groupKey);
+        }
+        pageSize.set(pageId, pageSize.get(pageId) + 1);
+    }
+    // Queues of pages per group, each still in catalogue order within its group.
+    const byGroup = new Map();
+    for (const pageId of pageOrder) {
+        const g = pageGroup.get(pageId);
+        if (!byGroup.has(g))
+            byGroup.set(g, []);
+        byGroup.get(g).push(pageId);
+    }
+    const groupsLargestFirst = [...byGroup.entries()]
+        .map(([g, pages]) => ({
+        g,
+        pages,
+        cases: pages.reduce((n, p) => n + pageSize.get(p), 0),
+    }))
+        .sort((a, b) => b.cases - a.cases || a.g.localeCompare(b.g))
+        .map((e) => e.g);
+    const cursor = new Map(groupsLargestFirst.map((g) => [g, 0]));
+    const interleaved = [];
+    let remaining = pageOrder.length;
+    while (remaining > 0) {
+        for (const g of groupsLargestFirst) {
+            const i = cursor.get(g);
+            const pages = byGroup.get(g);
+            if (i >= pages.length)
+                continue;
+            interleaved.push(pages[i]);
+            cursor.set(g, i + 1);
+            remaining--;
+        }
+    }
+    // Pack the interleaved page sequence into phases, never splitting a page.
+    const phaseOfPage = new Map();
     let currentPhase = 1;
     let currentPhaseCount = 0;
-    let lastPageKey = null;
-    for (let i = 0; i < itemsInCatalogOrder.length; i++) {
-        const item = itemsInCatalogOrder[i];
-        const pageId = `${item.groupKey}␟${item.pageKey}`;
-        const isNewPage = pageId !== lastPageKey;
-        // Only allow a phase boundary between pages, never mid-page.
-        if (isNewPage && currentPhaseCount >= targetPhaseSize) {
+    for (const pageId of interleaved) {
+        const size = pageSize.get(pageId);
+        if (currentPhaseCount > 0 && currentPhaseCount >= targetPhaseSize) {
             currentPhase += 1;
             currentPhaseCount = 0;
         }
-        phaseNumbers[i] = currentPhase;
-        currentPhaseCount += 1;
-        lastPageKey = pageId;
+        phaseOfPage.set(pageId, currentPhase);
+        currentPhaseCount += size;
     }
-    return phaseNumbers;
+    return itemsInCatalogOrder.map((item) => phaseOfPage.get(`${item.groupKey}␟${item.pageKey}`));
 }

package/dist/providers/db-firebase/rtdb-paths.d.ts

@@ -19,4 +19,11 @@ export declare const RTDB_PATHS: {
     readonly AUTH_EVENTS: "auth_events";
     readonly PAYMENT_EVENTS: "payment_events";
     readonly BULK_EVENTS: "bulk_events";
+    /**
+     * Tester-only. A one-line ping per email decision so the harness can poll
+     * instead of reading a real mailbox — see `send-recorder.ts` for why, and for
+     * the gate that keeps real users' mail out of it. Pruned by
+     * `cleanupRtdbEvents` alongside the other three.
+     */
+    readonly EMAIL_EVENTS: "email_events";
 };

package/dist/providers/db-firebase/rtdb-paths.js

@@ -19,4 +19,11 @@ export const RTDB_PATHS = {
     AUTH_EVENTS: "auth_events",
     PAYMENT_EVENTS: "payment_events",
     BULK_EVENTS: "bulk_events",
+    /**
+     * Tester-only. A one-line ping per email decision so the harness can poll
+     * instead of reading a real mailbox — see `send-recorder.ts` for why, and for
+     * the gate that keeps real users' mail out of it. Pruned by
+     * `cleanupRtdbEvents` alongside the other three.
+     */
+    EMAIL_EVENTS: "email_events",
 };

package/dist/server.d.ts

@@ -556,6 +556,9 @@ export { getDigitalCodeForDetail } from "./_internal/server/features/digital-cod
 export { toClientDigitalCode, type DigitalCodeClientShape } from "./_internal/server/features/digital-code/adapters";
 export { buildDigitalCodeMetadata, type DigitalCodeMetadataOptions } from "./_internal/server/features/digital-code/metadata";
 export { renderDigitalCodeOg, renderDigitalCodeOgImage, renderDigitalCodeOgFromDoc, type DigitalCodeOgData } from "./_internal/server/features/digital-code/og";
+export { addPoolEntries, listPoolEntries, deletePoolEntry, recountPool, assertCanUploadContentKind, DIGITAL_CONTENT_PREFIX, type AddPoolEntryInput, } from "./_internal/server/features/digital-code/pool";
+export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForMime, type SignedDigitalContent, type FinalizedDigitalContent, } from "./_internal/server/features/digital-code/upload";
+export { resolveCodeAssetForOrder, codeAssetHeaders, CODE_DOWNLOAD_STATUSES, type CodeAssetResolution, } from "./_internal/server/features/digital-code/download";
 export { getLiveItemForDetail } from "./_internal/server/features/live/data";
 export { toClientLiveItem, type LiveItemClientShape } from "./_internal/server/features/live/adapters";
 export { buildLiveItemMetadata, type LiveItemMetadataOptions } from "./_internal/server/features/live/metadata";

package/dist/server.js

@@ -1444,6 +1444,18 @@ export { getDigitalCodeForDetail } from "./_internal/server/features/digital-cod
 export { toClientDigitalCode } from "./_internal/server/features/digital-code/adapters";
 export { buildDigitalCodeMetadata } from "./_internal/server/features/digital-code/metadata";
 export { renderDigitalCodeOg, renderDigitalCodeOgImage, renderDigitalCodeOgFromDoc } from "./_internal/server/features/digital-code/og";
+/*
+ * The digital-CONTENT pool: the half of this feature that had no writer at all
+ * until 2026-09-14, so every digital-code purchase delivered nothing.
+ *
+ * Server-only, and that is structural rather than tidy — `pool` and `download`
+ * both reach `getAdminDb`/`getAdminStorage`, and `upload` mints signed URLs.
+ * None of it may appear in `index.ts` or `client.ts` (the Turbopack
+ * client-bundle trap, Root Cause #6/#24).
+ */
+export { addPoolEntries, listPoolEntries, deletePoolEntry, recountPool, assertCanUploadContentKind, DIGITAL_CONTENT_PREFIX, } from "./_internal/server/features/digital-code/pool";
+export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForMime, } from "./_internal/server/features/digital-code/upload";
+export { resolveCodeAssetForOrder, codeAssetHeaders, CODE_DOWNLOAD_STATUSES, } from "./_internal/server/features/digital-code/download";
 // ── Live-item listing — data + adapters + metadata + OG ──────────────────────
 export { getLiveItemForDetail } from "./_internal/server/features/live/data";
 export { toClientLiveItem } from "./_internal/server/features/live/adapters";

package/dist/ui/components/FilePickerButton.d.ts

@@ -0,0 +1,32 @@
+import React from "react";
+import type { ButtonProps } from "./Button";
+/**
+ * A button that opens the native file picker.
+ *
+ * 🛑 THE RAW `<input type="file">` BELONGS HERE, and only here. Rule #9 bans raw
+ * form elements in product code and points every case at a primitive; there was
+ * no primitive for a file picker, so the one feature that needed one
+ * (`DigitalContentPoolManager`) had to carry a raw input plus a suppression
+ * marker — and `audit-no-suppression-comments` is strict-zero and says, in its
+ * own header, "do NOT add a new marker or exception". The only close available
+ * was to extend the primitive layer, which is exactly what Root Cause #22 says
+ * to do before reaching for a marker.
+ *
+ * Deliberately NOT built on `MediaUploadField`. That component drives the public
+ * `/api/media/*` pipeline, which ends by minting a `/media/{shortId}` URL served
+ * with no authentication — correct for product photography, catastrophic for a
+ * paid download. This primitive hands the caller a `File` and has no opinion
+ * about where the bytes go.
+ *
+ * The input is visually hidden rather than styled, because a styled file input
+ * cannot be made to match `<Button>` across browsers — Safari and Firefox each
+ * render their own immovable "Choose file" text inside it.
+ */
+export interface FilePickerButtonProps extends Omit<ButtonProps, "onClick" | "type" | "children"> {
+    /** Called with the chosen file. Never called with null. */
+    onFile: (file: File) => void;
+    /** Native `accept` string, e.g. `"image/*"`. Omit to accept anything. */
+    accept?: string;
+    children: React.ReactNode;
+}
+export declare function FilePickerButton({ onFile, accept, children, ...buttonProps }: FilePickerButtonProps): React.JSX.Element;

package/dist/ui/components/FilePickerButton.js

@@ -0,0 +1,23 @@
+"use client";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { useId, useRef } from "react";
+import { Button } from "./Button";
+// No forwardRef: appkit's <Button> does not accept a ref, so there is nothing
+// to forward one to. Adding the plumbing would be a prop that silently does
+// nothing, which is worse than its absence.
+export function FilePickerButton({ onFile, accept, children, ...buttonProps }) {
+    const inputRef = useRef(null);
+    const inputId = useId();
+    return (_jsxs(_Fragment, { children: [_jsx(Button, { ...buttonProps, type: "button", onClick: () => inputRef.current?.click(), children: children }), _jsx("input", { ref: inputRef, id: inputId, type: "file", accept: accept, hidden: true, onChange: (ev) => {
+                    const file = ev.target.files?.[0];
+                    /*
+                     * Reset BEFORE handing the file on. Without it, picking the same file
+                     * twice in a row fires no change event the second time — the value is
+                     * unchanged — and the control silently does nothing, which reads as a
+                     * broken button rather than as a no-op.
+                     */
+                    ev.target.value = "";
+                    if (file)
+                        onFile(file);
+                } })] }));
+}

package/dist/ui/index.d.ts

@@ -33,6 +33,8 @@ export type { SkeletonProps } from "./components/Skeleton";
 export { Skeleton } from "./components/Skeleton";
 export type { ButtonProps } from "./components/Button";
 export { Button } from "./components/Button";
+export { FilePickerButton } from "./components/FilePickerButton";
+export type { FilePickerButtonProps } from "./components/FilePickerButton";
 export type { IconButtonProps } from "./components/IconButton";
 export { IconButton } from "./components/IconButton";
 export type { IconProps, IconTone } from "./components/Icon";

package/dist/ui/index.js

@@ -19,6 +19,13 @@ export { SiteLogo } from "./components/SiteLogo";
 export { SiteMark } from "./components/SiteMark";
 export { Skeleton } from "./components/Skeleton";
 export { Button } from "./components/Button";
+/*
+ * The one primitive allowed to own a raw <input type="file">. Rule #9 sends
+ * every raw form element to a primitive and there was none for a file picker,
+ * so the only feature that needed one had to carry a suppression marker that
+ * audit-no-suppression-comments (strict-zero) correctly refuses.
+ */
+export { FilePickerButton } from "./components/FilePickerButton";
 export { IconButton } from "./components/IconButton";
 export { Icon } from "./components/Icon";
 export { ICONS, ICON_SIZE, isIconKey, resolveIcon, } from "./icons/icon-registry";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.38.0",
+  "version": "4.39.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"