@mohasinac/appkit 4.42.18 → 4.43.0

package/dist/features/homepage/components/MarketplaceHomepageView.js

@@ -2,7 +2,13 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { sieveFilter, SIEVE_OP } from "@mohasinac/appkit";
 import { sortBy } from "@mohasinac/appkit";
 import { Div, Main } from "../../../ui";
-import { carouselRepository, faqsRepository, siteSettingsRepository } from "../../../repositories";
+import { carouselRepository } from "../../../repositories";
+// Both are React.cache wrappers around a single repository call, shared with
+// other readers in the same request tree (the locale layout for settings,
+// page.tsx's FAQ JSON-LD for the FAQs). Importing the repositories directly
+// here is what made each of those a second Firestore read.
+import { getSiteSettingsGlobal } from "../../admin/utils/getSiteSettingsGlobal";
+import { getHomepageFaqsCached } from "../../faq/utils/getHomepageFaqsCached";
 import { safeRead } from "../../../errors/safe-read";
 import { fetchLiveStats } from "../lib/live-stats";
 import { renderSection, AnnouncementBar } from "../lib/section-renderer";
@@ -46,7 +52,10 @@ export async function MarketplaceHomepageView({ adSlots, newsletterFormSlot, onB
     const slides = await safeRead(() => carouselRepository.getActiveSlides(), {
         route: "/", key: "homepage.carouselSlides", fallback: [],
     });
-    const siteSettings = await safeRead(() => siteSettingsRepository.getSingleton(), {
+    // getSiteSettingsGlobal, not the repository directly — the locale layout and
+    // generateMetadata already read the same singleton through it, so this is one
+    // Firestore read for the whole request tree instead of a second one.
+    const siteSettings = await safeRead(() => getSiteSettingsGlobal(), {
         route: "/", key: "homepage.siteSettings", fallback: null,
     });
     // The fallback used to be a hardcoded seasonal Pokémon TCG discount, which
@@ -58,7 +67,8 @@ export async function MarketplaceHomepageView({ adSlots, newsletterFormSlot, onB
         safeRead(() => homepageSectionsRepository.getEnabledSections(), {
             route: "/", key: "homepage.enabledSections", fallback: [],
         }),
-        safeRead(() => faqsRepository.getHomepageFAQs(), {
+        // Shared with the FAQ JSON-LD built in src/app/[locale]/page.tsx — one read.
+        safeRead(() => getHomepageFaqsCached(), {
             route: "/", key: "homepage.faqs", fallback: [],
         }),
     ]);

package/dist/features/homepage/lib/live-stats.js

@@ -47,16 +47,26 @@ export async function fetchLiveStats(requests) {
             .catch((err) => { void normalizeError(err); serverLogger.warn("live-stats: total_orders query failed — stat omitted", { error: err instanceof Error ? err.message : String(err) }); }));
     }
     if (neededPresets.has("total_reviews") || neededPresets.has("platform_rating")) {
-        tasks.push(reviewRepository.findAll()
-            .then((res) => {
-            const all = Array.isArray(res) ? res : (res?.data ?? []);
-            const approved = all.filter((r) => !r.status || r.status === "approved");
+        tasks.push(
+        /*
+         * 🛑 One aggregation, ~1 read — was `findAll()`, an UNBOUNDED full-collection
+         * scan of `reviews` on every cold homepage render, whose entire output was
+         * these two strings. Billed one read per document, it was the largest single
+         * Firestore read on the site (Hobby free tier is 50K reads/day, and the
+         * project measured 2.1M/week).
+         *
+         * The dropped `!r.status ||` branch was dead: `status` is a REQUIRED field
+         * defaulting to `"pending"` (features/reviews/schemas/firestore.ts), so no
+         * stored review lacks it, and treating a missing status as approved would
+         * have counted unmoderated reviews anyway.
+         */
+        reviewRepository.getApprovedSiteRatingSummary()
+            .then(({ count, average }) => {
             if (neededPresets.has("total_reviews")) {
-                resolvedPresets.total_reviews = String(approved.length);
+                resolvedPresets.total_reviews = String(count);
             }
-            if (neededPresets.has("platform_rating") && approved.length > 0) {
-                const avg = approved.reduce((sum, r) => sum + (r.rating ?? 0), 0) / approved.length;
-                resolvedPresets.platform_rating = avg.toFixed(1) + "★";
+            if (neededPresets.has("platform_rating") && average !== null) {
+                resolvedPresets.platform_rating = average.toFixed(1) + "★";
             }
         })
             .catch((err) => { void normalizeError(err); serverLogger.warn("live-stats: reviews/rating query failed — stat omitted", { error: err instanceof Error ? err.message : String(err) }); }));

package/dist/features/media/MediaImage.js

@@ -4,7 +4,7 @@ import Image from "next/image";
 import { useEffect, useRef, useState } from "react";
 import { Div, Row, Span } from "../../ui";
 import { ROUNDED_MAP, SHADOW_MAP } from "../../ui/components/surface-tokens";
-import { resolveMediaUrl } from "../../utils/media-url";
+import { MEDIA_PROXY_PREFIX, resolveMediaUrl } from "../../utils/media-url";
 const SIZE_HINTS = {
     thumbnail: "(max-width: 640px) 80px, (max-width: 1024px) 96px, 112px",
     card: "(max-width: 640px) 50vw, (max-width: 1024px) 33vw, 25vw",
@@ -32,6 +32,23 @@ const FALLBACK_ICONS = {
 // icon, instead of failing permanently on the very first request.
 const MAX_LOAD_RETRIES = 3;
 const RETRY_BACKOFF_MS = [600, 1200, 2400];
+/**
+ * Only `/media/<slug>` may be retried.
+ *
+ * 🛑 The retry appends `?retry=N`, which mints a BRAND-NEW CDN cache key that is
+ * guaranteed cold — so a failing image costs up to 4 cold function invocations
+ * instead of 1, on precisely the images that are already flaky. That is a real
+ * cost multiplier and it suspended this project once (HTTP 402, 2026-10-09).
+ *
+ * It is worth paying for our own Storage objects, because the post-upload race
+ * above is genuine and transient — retrying actually succeeds. It is NOT worth
+ * paying for `/api/media/ext`: there is no upload, the upstream is a third party
+ * we do not control, and an upstream that just failed will almost certainly fail
+ * again. Those fall straight through to the fallback icon on the first error.
+ */
+function isRetryableSrc(resolvedSrc) {
+    return resolvedSrc.startsWith(MEDIA_PROXY_PREFIX);
+}
 /** Resolve every URL in a comma-separated srcset string through the media proxy. */
 function resolveSrcSet(input) {
     return input
@@ -78,7 +95,7 @@ export function MediaImage({ src, alt, size = "card", priority = false, loading,
         className ?? "",
     ].filter(Boolean).join(" ");
     const handleError = () => {
-        if (retryCount < MAX_LOAD_RETRIES) {
+        if (resolvedSrc && isRetryableSrc(resolvedSrc) && retryCount < MAX_LOAD_RETRIES) {
             retryTimeoutRef.current = setTimeout(() => {
                 setRetryCount((count) => count + 1);
             }, RETRY_BACKOFF_MS[retryCount]);

package/dist/features/products/actions/product-actions.d.ts

@@ -15,15 +15,6 @@ export interface ProductListActionParams {
 export type ProductListResult = FirebaseSieveResult<ProductDocument>;
 export declare function listProducts(params?: ProductListActionParams): Promise<ProductListResult>;
 export declare function getProductById(id: string): Promise<ProductDocument | null>;
-/**
- * Featured items for the homepage's generic "Featured Products" strip.
- *
- * Scoped to `GENERIC_PRODUCT_LISTING_TYPES` for the same reason `/products` is:
- * the homepage already has dedicated Live Auctions, Pre-Orders and Prize Draws
- * sections, so leaving this unscoped put the same item in two strips on one
- * page — and an auction rendered as a generic product card shows Buy-Now chrome
- * instead of bid affordances.
- */
 export declare function getFeaturedProducts(pageSize?: number): Promise<ProductListResult>;
 /**
  * The soonest-ending LIVE auctions.

package/dist/features/products/actions/product-actions.js

@@ -73,6 +73,28 @@ function toListResult(result, pageSize) {
  * page — and an auction rendered as a generic product card shows Buy-Now chrome
  * instead of bid affordances.
  */
+/**
+ * How many documents a fixed-size homepage strip may read.
+ *
+ * 🛑 These strips land on `listPublicProducts`' in-memory window path — every
+ * anonymous viewer sets `hidesTestData`, which forces it — and that path pins
+ * the fetch to 50 documents regardless of the requested `pageSize`. So
+ * `getFeaturedProducts(12)` read 51 to render 12, and the homepage does this
+ * four times: ~200 reads for 44 cards, against a 50K-reads/day free tier that
+ * the project was exceeding 6× (2.1M/week, measured 2026-10-09).
+ *
+ * Headroom is genuinely required, not optional: availability and test-data are
+ * per-row predicates applied AFTER the fetch, so a window equal to `pageSize`
+ * would under-fill the strip the moment one row is unavailable. 2× with a floor
+ * of +8 absorbs that while still cutting the read roughly in half.
+ *
+ * Deliberately NOT derived inside `listPublicProducts` from `pageSize` — a
+ * browse page must keep the full 50 so it can page deeply, and silently
+ * shrinking its window would drop rows from page 2 onward.
+ */
+function featuredWindow(pageSize) {
+    return Math.max(pageSize * 2, pageSize + 8);
+}
 export async function getFeaturedProducts(pageSize = 8) {
     return toListResult(await listPublicProducts({
         featured: true,
@@ -81,6 +103,7 @@ export async function getFeaturedProducts(pageSize = 8) {
         sorts: sortBy("createdAt", "DESC"),
         page: 1,
         pageSize,
+        windowSize: featuredWindow(pageSize),
     }), pageSize);
 }
 /**
@@ -103,6 +126,7 @@ export async function getFeaturedAuctions(pageSize = 6) {
         sorts: sortBy(PRODUCT_FIELDS.AUCTION_END_DATE, "ASC"),
         page: 1,
         pageSize,
+        windowSize: featuredWindow(pageSize),
     }), pageSize);
 }
 export async function getLatestProducts(pageSize = 12) {
@@ -138,6 +162,7 @@ export async function getFeaturedPreOrders(pageSize = 6) {
         sorts: sortBy(PRODUCT_FIELDS.PRE_ORDER_DELIVERY_DATE, "ASC"),
         page: 1,
         pageSize,
+        windowSize: featuredWindow(pageSize),
     }), pageSize);
 }
 export async function getLatestPreOrders(pageSize = 12) {

package/dist/features/products/components/ArtStickersListView.js

@@ -20,5 +20,11 @@ export async function ArtStickersListView({ searchParams = {} }) {
         // about the default view (Root Cause #30).
         ...defaultAvailabilityForListingTypes(ART_STICKERS_LISTING_TYPES),
     }));
-    return (_jsxs(Main, { children: [_jsx(Section, { border: "bottom-subtle", paddingY: "b-md", padding: "t-xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "bold", color: "primary", children: "Art & Stickers" }), _jsx(Text, { className: "mt-1", color: "muted", size: "sm", children: "Original art prints and sticker packs from independent sellers" })] }) }), _jsxs(Container, { size: "xl", padding: "x-md", children: [_jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-4 mt-4" }), _jsx(ProductsIndexListing, { initialData: result ?? null, listingTypes: ART_STICKERS_LISTING_TYPES, typeTabs: ART_STICKERS_TYPE_FILTER_TABS, searchPlaceholder: "Search art & stickers..." }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] })] }));
+    return (_jsxs(Main, { children: [_jsx(Section, { border: "bottom-subtle", paddingY: "b-md", padding: "t-xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "bold", color: "primary", children: "Art & Stickers" }), _jsx(Text, { className: "mt-1", color: "muted", size: "sm", children: "Original art prints and sticker packs from independent sellers" })] }) }), _jsxs(Container, { size: "xl", padding: "x-md", children: [_jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-4 mt-4" }), _jsx(ProductsIndexListing
+                    // `undefined`, not `null` — React Query treats null as defined data,
+                    // so a failed query froze an empty grid. See ProductsIndexPageView.
+                    , { 
+                        // `undefined`, not `null` — React Query treats null as defined data,
+                        // so a failed query froze an empty grid. See ProductsIndexPageView.
+                        initialData: result ?? undefined, listingTypes: ART_STICKERS_LISTING_TYPES, typeTabs: ART_STICKERS_TYPE_FILTER_TABS, searchPlaceholder: "Search art & stickers..." }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] })] }));
 }

package/dist/features/products/components/PrizeDrawsSection.js

@@ -34,6 +34,11 @@ export async function PrizeDrawsSection({ config, }) {
         sorts: sortBy(PRODUCT_FIELDS.CREATED_AT, "DESC"),
         page: 1,
         pageSize: config.maxItems ?? 8,
+        // Fixed-size strip that never pages — cap the bounded window instead of
+        // inheriting the 50-document default. Headroom over `pageSize` because
+        // availability and test-data are per-row predicates applied after the fetch.
+        // See `featuredWindow` in features/products/actions/product-actions.ts.
+        windowSize: Math.max((config.maxItems ?? 8) * 2, (config.maxItems ?? 8) + 8),
     });
     const draws = (result?.items ?? []);
     if (draws.length === 0)

package/dist/features/products/components/ProductsIndexPageView.js

@@ -53,5 +53,5 @@ export async function ProductsIndexPageView({ searchParams = {} }) {
         sorts: DEFAULT_SORT,
         ...defaultAvailabilityForListingTypes(effectiveTypes),
     }));
-    return (_jsxs(Main, { children: [_jsx(Section, { border: "bottom-subtle", paddingY: "b-md", padding: "t-xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "bold", color: "primary", children: "Products" }), _jsx(Text, { className: "mt-1", color: "muted", size: "sm", children: "Discover amazing products and deals" }), _jsx(Div, { className: "mt-3", children: _jsx(TextLink, { variant: "bare", href: String(ROUTES.PUBLIC.AUCTIONS), rounded: "full", paddingX: "sm", paddingY: "2xs", size: "xs", weight: "medium", layout: "inline-flex", align: "center", gap: "sm", className: "border border-primary/30 bg-primary/10 text-primary-700 dark:text-primary-400 hover:bg-primary/15 transition-colors", children: "\uD83C\uDFF7\uFE0F Looking for unique deals? Browse Auctions \u2192" }) })] }) }), _jsxs(Container, { size: "xl", padding: "x-md", children: [_jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-4 mt-4" }), _jsx(ProductsIndexListing, { initialData: products }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] })] }));
+    return (_jsxs(Main, { children: [_jsx(Section, { border: "bottom-subtle", paddingY: "b-md", padding: "t-xl", children: _jsxs(Container, { size: "xl", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "bold", color: "primary", children: "Products" }), _jsx(Text, { className: "mt-1", color: "muted", size: "sm", children: "Discover amazing products and deals" }), _jsx(Div, { className: "mt-3", children: _jsx(TextLink, { variant: "bare", href: String(ROUTES.PUBLIC.AUCTIONS), rounded: "full", paddingX: "sm", paddingY: "2xs", size: "xs", weight: "medium", layout: "inline-flex", align: "center", gap: "sm", className: "border border-primary/30 bg-primary/10 text-primary-700 dark:text-primary-400 hover:bg-primary/15 transition-colors", children: "\uD83C\uDFF7\uFE0F Looking for unique deals? Browse Auctions \u2192" }) })] }) }), _jsxs(Container, { size: "xl", padding: "x-md", children: [_jsx(AdSlot, { id: "listing-sidebar-top", className: "mb-4 mt-4" }), _jsx(ProductsIndexListing, { initialData: products ?? undefined }), _jsx(AdSlot, { id: "listing-sidebar-bottom", className: "mt-8" })] })] }));
 }

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -42,6 +42,28 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
     findApprovedByUser(userId: string): Promise<ReviewDocument[]>;
     findPending(): Promise<ReviewDocument[]>;
     findByStatus(status: ReviewStatus): Promise<ReviewDocument[]>;
+    /**
+     * How many approved reviews there are site-wide, and their mean rating.
+     *
+     * 🛑 Replaces `reviewRepository.findAll()` on the homepage render path, which
+     * was an **unbounded full-collection scan** whose entire output was a count
+     * and an average: two numbers, billed one read per document, on every cold
+     * render. It was the single largest Firestore read on the site and it existed
+     * to print `"35+"` and `"4.6★"`.
+     *
+     * A Firestore aggregation is billed at **one read per 1000 index entries
+     * matched**, so this is ~1 read at any catalogue size this project will see,
+     * and it is EXACT rather than a daily-stale rollup — which is why no scheduled
+     * job was added for it (the three sibling presets in `live-stats.ts` already
+     * use `count()` for the same reason).
+     *
+     * Returns `average: null` when there are no approved reviews, so the caller
+     * renders nothing rather than `0.0★` — an empty catalogue is not a bad rating.
+     */
+    getApprovedSiteRatingSummary(): Promise<{
+        count: number;
+        average: number | null;
+    }>;
     findFeatured(limit?: number): Promise<ReviewDocument[]>;
     approve(reviewId: string, moderatorId: string, moderatorNote?: string): Promise<ReviewDocument>;
     reject(reviewId: string, moderatorId: string, rejectionReason: string, moderatorNote?: string): Promise<ReviewDocument>;

package/dist/features/reviews/repository/reviews.repository.js

@@ -130,6 +130,41 @@ class ReviewRepository extends BaseRepository {
     async findByStatus(status) {
         return this.findBy(REVIEW_FIELDS.STATUS, status);
     }
+    /**
+     * How many approved reviews there are site-wide, and their mean rating.
+     *
+     * 🛑 Replaces `reviewRepository.findAll()` on the homepage render path, which
+     * was an **unbounded full-collection scan** whose entire output was a count
+     * and an average: two numbers, billed one read per document, on every cold
+     * render. It was the single largest Firestore read on the site and it existed
+     * to print `"35+"` and `"4.6★"`.
+     *
+     * A Firestore aggregation is billed at **one read per 1000 index entries
+     * matched**, so this is ~1 read at any catalogue size this project will see,
+     * and it is EXACT rather than a daily-stale rollup — which is why no scheduled
+     * job was added for it (the three sibling presets in `live-stats.ts` already
+     * use `count()` for the same reason).
+     *
+     * Returns `average: null` when there are no approved reviews, so the caller
+     * renders nothing rather than `0.0★` — an empty catalogue is not a bad rating.
+     */
+    async getApprovedSiteRatingSummary() {
+        const base = this.getCollection().where(REVIEW_FIELDS.STATUS, "==", "approved");
+        const buckets = [];
+        for (let r = REVIEW_MIN_RATING; r <= REVIEW_MAX_RATING; r++)
+            buckets.push(r);
+        const counts = await Promise.all(buckets.map((rating) => getFirestoreCount(base.where(REVIEW_FIELDS.RATING, "==", rating))));
+        let count = 0;
+        let weighted = 0;
+        buckets.forEach((rating, i) => {
+            const n = counts[i] ?? 0;
+            count += n;
+            weighted += n * rating;
+        });
+        // null, not 0 — an empty catalogue has no rating, and rendering "0.0★" would
+        // state the opposite of the truth.
+        return { count, average: count > 0 ? weighted / count : null };
+    }
     async findFeatured(limit = 18) {
         const snapshot = await this.db
             .collection(this.collection)

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -509,8 +509,8 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "seed-images-are-labelled-tiles",
-                    label: "Every seeded product image is a readable tile showing the item's own name — NOT a broken-image icon and NOT an empty grey box",
-                    description: "Fixed 2026-08-31. BEFORE: 409 of the ~437 seeded image URLs pointed at picsum.photos, which went down (503 from its origin AND its CDN), so nearly every image on the site returned 502 and rendered as the browser's broken-image icon. AFTER: images come from `seedPhoto()`, which names its host in ONE place and renders the item's name on the tile. Open a product grid and confirm the tiles show text like \"Dranzer Phoenix\" rather than broken icons. A grid of identical blank tiles is also a fail — each should differ.",
+                    label: "Every seeded product image is a coloured local tile — NOT a broken-image icon, and NOT all the same colour",
+                    description: "Updated 2026-10-09. BEFORE: seeded images were fetched from a third party through /api/media/ext — one Node lambda plus a sharp re-encode PER IMAGE, 160 of them on the homepage alone. That is what exceeded the Vercel Hobby caps and suspended the site (HTTP 402). AFTER: `seedPhoto()` returns a static local file under `/images/seed-tiles/<hex>.svg`, so a seeded image costs no function and no upstream request. Open a product grid and confirm each card shows a coloured tile with a faint ring motif. Two checks that matter: view-source on a card image and confirm the src starts with `/images/seed-tiles/` and NOT `/api/media/ext`; and confirm the tiles are not all one colour (the colour is hashed per item, so a grid should show several). NOTE: tiles deliberately no longer render the item's NAME — that text cost a function invocation per card to draw, and the card already displays the title beside the image.", // audit-hardcoded-api-routes-ok: prose, not a call site — the tester must be told the exact string to look for in an image src, and "the external-media proxy route" is not checkable
                     href: "/products",
                 },
                 {

package/dist/seed/_helpers/media.d.ts

@@ -17,4 +17,4 @@ export declare function seedPhotoLabel(seed: string): string;
  * `appkit-seed` invocation, so anything non-stable here would give the same
  * fixture a different URL on every run.
  */
-export declare function seedPhoto(seed: string, width: number, height: number): string;
+export declare function seedPhoto(seed: string, _width?: number, _height?: number): string;

package/dist/seed/_helpers/media.js

@@ -47,16 +47,49 @@ export function seedExtMedia(url) {
  * photography for a demo catalogue: every card now says what it is, and nobody
  * can mistake seeded data for real inventory.
  */
-/** The one place a seed image host is named. Changing it is a one-line edit. */
-const SEED_PHOTO_HOST = "https://placehold.co";
+/*
+ * 🛑 SUPERSEDED 2026-10-09 — seed photography is now LOCAL and costs nothing.
+ *
+ * The reasoning above is still correct about third-party fragility, and the
+ * one-line-to-move property is still the goal. What it missed is the cost: every
+ * one of these URLs was persisted as `/api/media/ext?url=…`, so every render of
+ * every card was a Node lambda doing a third-party fetch (up to 2 × 4 s) plus a
+ * full sharp decode/watermark/encode — ONE INVOCATION PER IMAGE. The homepage
+ * alone referenced 160 of them at ~49.5 KB; `52.52 GB of origin transfer ÷
+ * 49.5 KB ≈ 1.06 M` proxy responses in a week, which suspended the project
+ * (HTTP 402).
+ *
+ * A placeholder is synthetic by definition, so there was never anything to
+ * fetch. Six static tiles ship in `public/images/seed-tiles/`, chosen by the
+ * same deterministic hash, and the homepage goes 160 images → 6.
+ *
+ * The trade accepted: the tile no longer renders the item's NAME. That text was
+ * a genuine gain and it is lost here — but it cost a function invocation per
+ * card to render text the card already displays beside the image, and `alt` still
+ * carries it for assistive tech. `seedPhotoLabel` is kept and still exported for
+ * exactly that use.
+ *
+ * 🛑 Do NOT reintroduce a third-party host here, and do NOT encode width/height
+ * into the path — a per-size URL is a per-size CDN cache key, which is how 6
+ * files become 400 again. `audit-media-proxy-hosts` blocks the first; this
+ * comment is the only thing guarding the second.
+ */
+const SEED_TILE_PREFIX = "/images/seed-tiles/";
 /**
  * Muted backgrounds, all dark enough for the same light foreground.
  *
- * Raw hex rather than theme tokens because these are baked into a URL that a
- * third party renders — no stylesheet and no CSS custom property is in scope.
+ * Raw hex rather than theme tokens because an SVG served as the body of an
+ * `<img>` has no stylesheet and no `var(--appkit-color-*)` in scope — the same
+ * reason `_placeholder.ts` keeps its artwork in an asset file.
+ *
+ * 🛑 These six values ARE the filenames in `public/images/seed-tiles/`, and they
+ * are mirrored a third time in `PLACEHOLDER_MEDIA_HOSTS`' sibling
+ * `SEED_TILE_COLOURS` (`appkit/src/utils/media-url.ts`), which maps a legacy
+ * stored `placehold.co` URL back to the same tile. Add a colour and all three
+ * must move together; a missing one degrades to a deterministic fallback tile
+ * rather than a broken image, so the failure mode is "less variety", never a 404.
  */
 const SEED_PHOTO_COLOURS = ["1e293b", "334155", "3f3f46", "44403c", "312e81", "164e63"];
-const SEED_PHOTO_FG = "f8fafc";
 /** Deterministic 32-bit hash. Same seed, same colour, every reseed. */
 function seedHash(input) {
     let h = 2166136261;
@@ -95,8 +128,11 @@ export function seedPhotoLabel(seed) {
  * `appkit-seed` invocation, so anything non-stable here would give the same
  * fixture a different URL on every run.
  */
-export function seedPhoto(seed, width, height) {
+export function seedPhoto(seed, _width, _height) {
     const bg = SEED_PHOTO_COLOURS[seedHash(seed) % SEED_PHOTO_COLOURS.length];
-    const text = encodeURIComponent(seedPhotoLabel(seed));
-    return seedExtMedia(`${SEED_PHOTO_HOST}/${width}x${height}/${bg}/${SEED_PHOTO_FG}/png?text=${text}`);
+    // Width/height are accepted and ignored. All 366 call sites pass them, and the
+    // tiles carry `preserveAspectRatio="xMidYMid slice"` so one file fits every
+    // aspect — baking the dimensions into the path would mint a separate cache
+    // entry per size, which is the thing this change removes.
+    return `${SEED_TILE_PREFIX}${bg}.svg`;
 }

package/dist/seed/orders-seed-data.js

@@ -67,9 +67,11 @@ const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
  * authored against one day's ids and could never resolve afterwards.
  */
 const SEED_EPOCH = new Date("2026-01-01T00:00:00.000Z");
-// Deterministic per-product thumbnail — picsum.photos returns a stable image
-// for any seed string, so this doesn't need to match the real product seed's
-// own image, just be present and consistent across reseeds. Backfills the
+// Deterministic per-product thumbnail — `seedPhoto` maps a seed string to one
+// of six LOCAL tiles, so this doesn't need to match the real product seed's
+// own image, just be present and consistent across reseeds. (It used to name
+// picsum.photos here; seeded imagery stopped being a third-party fetch on
+// 2026-10-09 — see seedPhoto's header.) Backfills the
 // `image`/`imageUrls` fields real checkout orders only started carrying
 // 2026-08-20 (see OrderDocumentItem.image), so seeded order fixtures show a
 // thumbnail on My Orders / order-detail like real orders do.

package/dist/server.d.ts

@@ -536,6 +536,8 @@ export type { SitemapOptions, RobotsOptions, ManifestOptions, DefaultOgOptions }
 export { checkActionAllowed } from "./features/admin/utils/checkActionAllowed";
 export { getDisabledRoutes } from "./features/admin/utils/getDisabledRoutes";
 export { getSiteSettingsGlobal } from "./features/admin/utils/getSiteSettingsGlobal";
+export { getHomepageFaqsCached } from "./features/faq/utils/getHomepageFaqsCached";
+export { revalidateTargetsFor, type RevalidateHints, } from "./_internal/shared/cache/revalidate-targets";
 export { getSiteSettingsSafe } from "./_internal/server/features/site-settings/safe-settings";
 export { toPublicSiteSettings, PUBLIC_SITE_SETTINGS_FIELDS, PRIVATE_SITE_SETTINGS_FIELDS, type ToPublicSiteSettingsOptions, } from "./_internal/server/features/site-settings/adapters";
 export { callFirebaseIdentityToolkit } from "./_internal/server/features/auth/firebase-identity";

package/dist/server.js

@@ -1404,6 +1404,12 @@ export { buildSitemap, buildRobots, buildManifest, buildDefaultOgImage, DEFAULT_
 export { checkActionAllowed } from "./features/admin/utils/checkActionAllowed";
 export { getDisabledRoutes } from "./features/admin/utils/getDisabledRoutes";
 export { getSiteSettingsGlobal } from "./features/admin/utils/getSiteSettingsGlobal";
+// Same React.cache dedup, for the FAQ list the homepage reads twice per render
+// (once for the section, once for its JSON-LD).
+export { getHomepageFaqsCached } from "./features/faq/utils/getHomepageFaqsCached";
+// Which PAGE paths a write makes stale — the input to revalidatePath(). Long
+// detail-route TTLs are only safe because this exists.
+export { revalidateTargetsFor, } from "./_internal/shared/cache/revalidate-targets";
 // Null-safe wrapper — returns null on Firestore failure instead of throwing.
 export { getSiteSettingsSafe } from "./_internal/server/features/site-settings/safe-settings";
 // Public site-settings allow-list projection — the ONLY sanctioned shape for

package/dist/utils/media-url.d.ts

@@ -30,6 +30,32 @@ export declare const MEDIA_URL_MAX_LENGTH = 2048;
  */
 export declare const APPROVED_MEDIA_DOMAINS: readonly string[];
 export declare const MEDIA_URL_MESSAGE = "Must be a stored media reference (/media/<slug>) or a URL on an approved CDN domain";
+/**
+ * Local, static stand-ins for seed photography. Served straight out of
+ * `public/` — no function, no upstream fetch, no sharp pipeline.
+ *
+ * 🛑 This is the single most load-bearing cost control in the app. Every seed
+ * image used to resolve to `/api/media/ext?url=https://placehold.co/…`, i.e. a
+ * Node lambda that fetched a third party (up to 2 × 4 s) and ran a full sharp
+ * decode/watermark/encode — ONE INVOCATION PER IMAGE. Measured 2026-10-09: the
+ * homepage referenced **160** such images at ~49.5 KB each, and
+ * `52.52 GB of Fast Origin Transfer ÷ 49.5 KB ≈ 1.06 M` proxy responses in a
+ * week. That is what suspended the project (HTTP 402).
+ *
+ * Six tiles, because the stored URL already encodes which of the six
+ * `SEED_PHOTO_COLOURS` it was generated with — so the mapping needs no new
+ * data and no migration. The homepage goes 160 images → 6.
+ */
+export declare const SEED_TILE_PREFIX = "/images/seed-tiles/";
+/**
+ * A local tile for `absUrl` when it points at a placeholder host, else undefined.
+ *
+ * placehold.co bakes its colours into the path (`/{w}x{h}/{bg}/{fg}/png`), so the
+ * first 6-hex segment IS the background the fixture was generated with — the
+ * size segment contains an `x` and cannot match, and the foreground comes after
+ * the background, so `.find()` picks the right one.
+ */
+export declare function placeholderTileFor(absUrl: string): string | undefined;
 /**
  * Is `value` something we are willing to PERSIST as a media reference?
  *