@mohasinac/appkit 4.44.0 → 4.45.0

package/dist/monitoring/browser.js

@@ -1,8 +1,8 @@
-export { ErrorSeverity, ErrorCategory, setErrorTracker, trackError, trackApiError, trackAuthError, trackValidationError, trackDatabaseError, trackPermissionError, } from "./error-tracking";
-export { getCacheMetrics, recordCacheHit, recordCacheMiss, resetCacheMetrics, getCacheHitRate, isCacheHitRateLow, getCacheStatistics, } from "./cache-metrics";
-export { setupGlobalErrorHandler, setupCacheMonitoring } from "./runtime";
-export { logClientError, logClientWarning, logClientInfo, logClientDebug, logApiError, logValidationError, logNavigationError, logAuthError, logUploadError, logPaymentError, logApplicationError, initializeClientLogger, } from "./client-logger";
-export { setPerformanceProvider, startTrace, stopTrace, addTraceAttribute, addTraceMetric, } from "./performance";
+export { ErrorSeverity, ErrorCategory, setErrorTracker, trackError, trackApiError, trackAuthError, trackValidationError, trackDatabaseError, trackPermissionError, } from "./error-tracking.js";
+export { getCacheMetrics, recordCacheHit, recordCacheMiss, resetCacheMetrics, getCacheHitRate, isCacheHitRateLow, getCacheStatistics, } from "./cache-metrics.js";
+export { setupGlobalErrorHandler, setupCacheMonitoring } from "./runtime.js";
+export { logClientError, logClientWarning, logClientInfo, logClientDebug, logApiError, logValidationError, logNavigationError, logAuthError, logUploadError, logPaymentError, logApplicationError, initializeClientLogger, } from "./client-logger.js";
+export { setPerformanceProvider, startTrace, stopTrace, addTraceAttribute, addTraceMetric, } from "./performance.js";
 /*
  * The Firebase-Analytics module that lived at ./analytics was deleted
  * 2026-08-31. It defined 11 events, `initializeAnalytics` and `trackEvent`, and

package/dist/monitoring/cache-metrics.js

@@ -2,7 +2,7 @@
  * Cache Performance Metrics — pure localStorage implementation.
  * No Firebase dependencies.
  */
-import { normalizeError } from "../errors/normalize";
+import { normalizeError } from "../errors/normalize.js";
 const STORAGE_KEY = "mohasinac:cache_metrics";
 const RESET_INTERVAL_MS = 3600000; // 1 hour
 function nowISO() {

package/dist/monitoring/client-logger.js

@@ -6,9 +6,9 @@
  *
  * For server-side logging use `server-logger.ts`.
  */
-import { logger } from "../core/Logger";
-import { normalizeError } from "../errors/normalize";
-import { AppError } from "../errors";
+import { logger } from "../core/Logger.js";
+import { normalizeError } from "../errors/normalize.js";
+import { AppError } from "../errors/index.js";
 function buildClientMeta(error, context) {
     const base = {
         ...context,

package/dist/monitoring/index.js

@@ -1,6 +1,6 @@
-export { ErrorSeverity, ErrorCategory, setErrorTracker, trackError, trackApiError, trackAuthError, trackValidationError, trackDatabaseError, trackPermissionError, } from "./error-tracking";
-export { getCacheMetrics, recordCacheHit, recordCacheMiss, resetCacheMetrics, getCacheHitRate, isCacheHitRateLow, getCacheStatistics, } from "./cache-metrics";
-export { setupGlobalErrorHandler, setupCacheMonitoring } from "./runtime";
-export { logClientError, logClientWarning, logClientInfo, logClientDebug, logApiError, logValidationError, logNavigationError, logAuthError, logUploadError, logPaymentError, logApplicationError, initializeClientLogger, } from "./client-logger";
-export { serverLogger, logServerError, logServerWarning, logServerInfo, logServerDebug, extractRequestMetadata, logApiRouteError, logDatabaseError, logServerAuthError, logAuthorizationError, logEmailError, logStorageError, logExternalApiError, logSlowOperation, logSecurityEvent, } from "./server-logger";
-export { setPerformanceProvider, startTrace, stopTrace, addTraceAttribute, addTraceMetric, } from "./performance";
+export { ErrorSeverity, ErrorCategory, setErrorTracker, trackError, trackApiError, trackAuthError, trackValidationError, trackDatabaseError, trackPermissionError, } from "./error-tracking.js";
+export { getCacheMetrics, recordCacheHit, recordCacheMiss, resetCacheMetrics, getCacheHitRate, isCacheHitRateLow, getCacheStatistics, } from "./cache-metrics.js";
+export { setupGlobalErrorHandler, setupCacheMonitoring } from "./runtime.js";
+export { logClientError, logClientWarning, logClientInfo, logClientDebug, logApiError, logValidationError, logNavigationError, logAuthError, logUploadError, logPaymentError, logApplicationError, initializeClientLogger, } from "./client-logger.js";
+export { serverLogger, logServerError, logServerWarning, logServerInfo, logServerDebug, extractRequestMetadata, logApiRouteError, logDatabaseError, logServerAuthError, logAuthorizationError, logEmailError, logStorageError, logExternalApiError, logSlowOperation, logSecurityEvent, } from "./server-logger.js";
+export { setPerformanceProvider, startTrace, stopTrace, addTraceAttribute, addTraceMetric, } from "./performance.js";

package/dist/monitoring/runtime.js

@@ -4,7 +4,7 @@
  * Sets up window-level unhandled error/rejection forwarding to the
  * configured error tracker. Import once in instrumentation.ts or layout.tsx.
  */
-import { trackError } from "./error-tracking";
+import { trackError } from "./error-tracking.js";
 /**
  * Attach window-level listeners that forward uncaught errors and unhandled
  * promise rejections to `trackError`. Safe to call multiple times — only

package/dist/monitoring/server-logger.js

@@ -1,6 +1,6 @@
-import { normalizeError } from "../errors/normalize";
-import { redactPii } from "../security/pii-redact";
-import { AppError } from "../errors";
+import { normalizeError } from "../errors/normalize.js";
+import { redactPii } from "../security/pii-redact.js";
+import { AppError } from "../errors/index.js";
 // fs/path are Node.js built-ins that must NOT be imported at the top level.
 // Doing so causes Next.js Edge bundler warnings because this file is reachable
 // from the instrumentation hook, which is compiled for both Edge and Node.

package/dist/next/ErrorBoundary.js

@@ -1,9 +1,9 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Component } from "react";
-import { Button } from "../ui/components/Button";
-import { Stack } from "../ui/components/Layout";
-import { Heading, Text } from "../ui/components/Typography";
+import { Button } from "../ui/components/Button.js";
+import { Stack } from "../ui/components/Layout.js";
+import { Heading, Text } from "../ui/components/Typography.js";
 function DefaultFallback({ error, onReset, }) {
     return (_jsxs(Stack, { centered: true, gap: "md", surface: "default", padding: "lg", rounded: "xl", border: "default", className: "min-h-[40vh] text-center", "data-section": "errorboundary-div-445", children: [_jsx(Heading, { level: 2, children: "Something went wrong" }), _jsx(Text, { variant: "secondary", children: "An unexpected error occurred. Please try again." }), process.env.NODE_ENV === "development" && error ? (_jsx("pre", { className: "max-w-full overflow-auto rounded-md bg-[var(--appkit-color-surface)] p-3 text-left text-xs bg-[var(--appkit-color-surface-elevated)]", children: error.message })) : null, _jsx(Button, { type: "button", onClick: onReset, children: "Try again" })] }));
 }

package/dist/next/api/api-response.js

@@ -4,8 +4,8 @@
  * Provides consistent response formatting across all Next.js API routes.
  * No app-specific dependencies — safe to use in any project.
  */
-import { NextResponse } from "next/server";
-import { buildErrorEnvelope, } from "../../errors/error-envelope";
+import { NextResponse } from "next/server.js";
+import { buildErrorEnvelope, } from "../../errors/error-envelope.js";
 export function successResponse(data, message, status = 200, meta) {
     return NextResponse.json({
         success: true,

package/dist/next/api/apiHandler.js

@@ -1,6 +1,6 @@
-import { normalizeError } from "../../errors/normalize";
-import { toApiIssues } from "../../errors/error-envelope";
-import { HTTP_ERROR_CODES } from "../../errors/error-mapping";
+import { normalizeError } from "../../errors/normalize.js";
+import { toApiIssues } from "../../errors/error-envelope.js";
+import { HTTP_ERROR_CODES } from "../../errors/error-mapping.js";
 async function validateSchema(request, schema) {
     if (typeof schema.safeParse === "function") {
         const body = await request.json();

package/dist/next/api/parseJsonBody.js

@@ -1,4 +1,4 @@
-import { ValidationError } from "../../errors";
+import { ValidationError } from "../../errors/index.js";
 /**
  * Strict JSON body parser for createRouteHandler handlers that need a body
  * but don't yet use the wrapper's `schema` option. Replaces the silent

package/dist/next/api/routeHandler.js

@@ -1,4 +1,4 @@
-import { normalizeError } from "../../errors/normalize";
+import { normalizeError } from "../../errors/normalize.js";
 /**
  * createRouteHandler — provider-aware API route handler factory for feat-* packages.
  *
@@ -29,14 +29,14 @@ import { normalizeError } from "../../errors/normalize";
  * ```
  */
 import { NextResponse } from "next/server.js";
-import { getProviders } from "../../contracts";
-import { isEffectiveAdminUser, isTesterUser, canTestAdminSurfaces } from "../../features/auth/role-predicates";
-import { mapToHttpError, HTTP_ERROR_CODES } from "../../errors/error-mapping";
-import { describeCauseChain } from "../../errors/describe-cause";
-import { buildErrorEnvelope, toApiIssues } from "../../errors/error-envelope";
-import { serverErrorsRepository } from "../../features/server-errors/repository/server-errors.repository";
-import { userRepository } from "../../repositories";
-import { SCHEMAS } from "../../schemas/registry";
+import { getProviders } from "../../contracts/index.js";
+import { isEffectiveAdminUser, isTesterUser, canTestAdminSurfaces } from "../../features/auth/role-predicates.js";
+import { mapToHttpError, HTTP_ERROR_CODES } from "../../errors/error-mapping.js";
+import { describeCauseChain } from "../../errors/describe-cause.js";
+import { buildErrorEnvelope, toApiIssues } from "../../errors/error-envelope.js";
+import { serverErrorsRepository } from "../../features/server-errors/repository/server-errors.repository.js";
+import { userRepository } from "../../repositories/index.js";
+import { SCHEMAS } from "../../schemas/registry.js";
 function buildPublicCacheControl(policy) {
     const maxAge = policy?.maxAge ?? 30;
     const sMaxAge = policy?.sMaxAge ?? 300;

package/dist/next/cache-middleware.js

@@ -12,7 +12,7 @@
  * ```
  */
 import { NextResponse } from "next/server.js";
-import { CacheManager } from "../core/CacheManager";
+import { CacheManager } from "../core/CacheManager.js";
 const DEFAULT_TTL = 5 * 60 * 1000;
 const cache = CacheManager.getInstance(500);
 function buildCacheKey(request, config) {

package/dist/next/components/ErrorView.js

@@ -17,10 +17,10 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *   }
  */
 import { useEffect } from "react";
-import { Heading, Text } from "../../ui/components/Typography";
-import { Button } from "../../ui/components/Button";
+import { Heading, Text } from "../../ui/components/Typography.js";
+import { Button } from "../../ui/components/Button.js";
 import { Stack } from "@mohasinac/appkit/client";
-import { trackError, ErrorCategory, ErrorSeverity, } from "../../monitoring/error-tracking";
+import { trackError, ErrorCategory, ErrorSeverity, } from "../../monitoring/error-tracking.js";
 export function ErrorView({ error, reset, heading = "Something went wrong", description = "An unexpected error occurred. Please try again.", retryLabel = "Try again", }) {
     useEffect(() => {
         trackError(error, ErrorCategory.UNKNOWN, ErrorSeverity.HIGH, {

package/dist/next/components/GlobalError.js

@@ -12,8 +12,29 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *   export { GlobalError as default } from "@mohasinac/appkit/next";
  */
 import { useEffect } from "react";
-import { Button, Heading, Pre, Text } from "../../ui";
-import { trackError, ErrorCategory, ErrorSeverity, } from "../../monitoring/error-tracking";
+/*
+ * 🛑 FROM THE DEFINING MODULES, NOT `../../ui`.
+ *
+ * This file is re-exported by `next/index.ts`, which is appkit's SERVER
+ * integration surface (middleware, route handlers, metadata). Importing the UI
+ * barrel from here is what put a stylesheet in the server graph: `ui/index.ts`
+ * opens with
+ *     import "./components/index.style.css";
+ *     import "./forms/FormShell.style.css";
+ * and Node cannot load CSS at any path. That single edge — three hops,
+ * next/index -> GlobalError -> ui/index — is what made
+ * `serverExternalPackages: ["@mohasinac/appkit"]` fail with
+ * ERR_UNKNOWN_FILE_EXTENSION.
+ *
+ * The CSS lives on the BARREL, not on the components, so importing Button /
+ * Typography / Semantic directly keeps the component behaviour identical and
+ * drops the stylesheet edge. It also pulls ~258 modules of UI graph out of the
+ * `/next` entry. Root Cause #18 — import from the file that defines the symbol.
+ */
+import { Button } from "../../ui/components/Button.js";
+import { Heading, Text } from "../../ui/components/Typography.js";
+import { Pre } from "../../ui/components/Semantic.js";
+import { trackError, ErrorCategory, ErrorSeverity, } from "../../monitoring/error-tracking.js";
 export function GlobalError({ error, reset }) {
     useEffect(() => {
         trackError(error, ErrorCategory.UNKNOWN, ErrorSeverity.CRITICAL, {

package/dist/next/components/NotFoundView.js

@@ -16,10 +16,10 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *     return <NotFoundView heading="Page not found" homeHref="/en" />;
  *   }
  */
-import { Heading, Text } from "../../ui/components/Typography";
-import { TextLink } from "../../ui/components/TextLink";
-import { SiteMark } from "../../ui/components/SiteMark";
-import { DEFAULT_ROUTE_MAP } from "../routing/route-map";
+import { Heading, Text } from "../../ui/components/Typography.js";
+import { TextLink } from "../../ui/components/TextLink.js";
+import { SiteMark } from "../../ui/components/SiteMark.js";
+import { DEFAULT_ROUTE_MAP } from "../routing/route-map.js";
 import { Stack } from "@mohasinac/appkit/client";
 export function NotFoundView({ heading = "404 — Page not found", description = "The page you are looking for does not exist.", homeLabel = "Go home", homeHref = DEFAULT_ROUTE_MAP.HOME, }) {
     return (_jsxs(Stack, { justify: "center", className: "min-h-[60vh] text-center", padding: "x-xl", align: "center", children: [_jsx(SiteMark, { size: "xl" }), _jsx(Heading, { level: 1, variant: "primary", size: "7xl", className: "mb-2", weight: "bold", children: "404" }), _jsx(Heading, { level: 2, className: "mb-3", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-8", children: description }), _jsx(TextLink, { href: homeHref, children: homeLabel })] }));

package/dist/next/components/UnauthorizedView.js

@@ -12,10 +12,10 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  *     return <UnauthorizedView loginHref="/en/auth/login" />;
  *   }
  */
-import { Row } from "../../ui/components/Layout";
-import { Heading, Text } from "../../ui/components/Typography";
-import { TextLink } from "../../ui/components/TextLink";
-import { DEFAULT_ROUTE_MAP } from "../routing/route-map";
+import { Row } from "../../ui/components/Layout.js";
+import { Heading, Text } from "../../ui/components/Typography.js";
+import { TextLink } from "../../ui/components/TextLink.js";
+import { DEFAULT_ROUTE_MAP } from "../routing/route-map.js";
 import { Stack } from "@mohasinac/appkit/client";
 export function UnauthorizedView({ heading = "401 — Unauthorized", description = "You need to be signed in to view this page.", loginLabel = "Sign in", loginHref = DEFAULT_ROUTE_MAP.AUTH.LOGIN, homeLabel = "Go home", homeHref = DEFAULT_ROUTE_MAP.HOME, }) {
     return (_jsxs(Stack, { justify: "center", className: "min-h-[60vh] text-center", padding: "x-xl", align: "center", children: [_jsx(Heading, { level: 1, variant: "primary", size: "7xl", className: "mb-2", weight: "bold", children: "401" }), _jsx(Heading, { level: 2, className: "mb-3", children: heading }), _jsx(Text, { variant: "secondary", className: "mb-8", children: description }), _jsxs(Row, { gap: "md", children: [_jsx(TextLink, { href: loginHref, children: loginLabel }), _jsx(TextLink, { href: homeHref, children: homeLabel })] })] }));

package/dist/next/index.js

@@ -4,29 +4,29 @@
  * Stage B4: IAuthVerifier interface + createApiErrorHandler factory.
  */
 // Generic API error handler factory
-export { createApiErrorHandler } from "./api/errorHandler";
+export { createApiErrorHandler } from "./api/errorHandler.js";
 // Provider-aware route handler factory for feat-* packages
-export { createRouteHandler } from "./api/routeHandler";
+export { createRouteHandler } from "./api/routeHandler.js";
 // Generic API handler factory (auth + rate-limit + validation wrapper)
-export { createApiHandlerFactory } from "./api/apiHandler";
-export { createRouteHandler as createApiHandler } from "./api/routeHandler";
+export { createApiHandlerFactory } from "./api/apiHandler.js";
+export { createRouteHandler as createApiHandler } from "./api/routeHandler.js";
 // Request parsing helpers
-export { getSearchParams, getOptionalSessionCookie, getRequiredSessionCookie, getBooleanParam, getStringParam, getNumberParam, } from "./request-helpers";
+export { getSearchParams, getOptionalSessionCookie, getRequiredSessionCookie, getBooleanParam, getStringParam, getNumberParam, } from "./request-helpers.js";
 // Shared route-map primitives (SSR apps can extend/override)
-export { DEFAULT_ROUTE_MAP, createRouteMap, ROUTES, PUBLIC_ROUTES, PROTECTED_ROUTES, AUTH_ROUTES, } from "./routing/route-map";
+export { DEFAULT_ROUTE_MAP, createRouteMap, ROUTES, PUBLIC_ROUTES, PROTECTED_ROUTES, AUTH_ROUTES, } from "./routing/route-map.js";
 // Response caching middleware
-export { withCache, invalidateCache } from "./cache-middleware";
+export { withCache, invalidateCache } from "./cache-middleware.js";
 // PII-aware composable middleware chain (Phase 21)
-export { createApiMiddleware, runChain, buildBaseContext, } from "./middleware/chain";
-export { piiScrubberMiddleware } from "./middleware/pii-scrubber";
+export { createApiMiddleware, runChain, buildBaseContext, } from "./middleware/chain.js";
+export { piiScrubberMiddleware } from "./middleware/pii-scrubber.js";
 // Standardized API response helpers
-export { successResponse, errorResponse, ApiErrors } from "./api/api-response";
+export { successResponse, errorResponse, ApiErrors } from "./api/api-response.js";
 // Error UI view components
-export { GlobalError } from "./components/GlobalError";
-export { ErrorView } from "./components/ErrorView";
-export { NotFoundView } from "./components/NotFoundView";
-export { UnauthorizedView } from "./components/UnauthorizedView";
-export { ErrorBoundary } from "./ErrorBoundary";
+export { GlobalError } from "./components/GlobalError.js";
+export { ErrorView } from "./components/ErrorView.js";
+export { NotFoundView } from "./components/NotFoundView.js";
+export { UnauthorizedView } from "./components/UnauthorizedView.js";
+export { ErrorBoundary } from "./ErrorBoundary.js";
 /*
  * Pure, isomorphic nav helpers — deliberately re-exported HERE as well as from
  * the main and client entries.
@@ -47,8 +47,8 @@ export { ErrorBoundary } from "./ErrorBoundary";
  * satisfies both. This is the same reasoning that keeps `/ui` and `/tokens`
  * separate entries.
  */
-export { navItemId } from "../_internal/shared/features/layout/types";
-export { matchesNavQuery } from "../_internal/shared/features/layout/matchesNavQuery";
+export { navItemId } from "../_internal/shared/features/layout/types.js";
+export { matchesNavQuery } from "../_internal/shared/features/layout/matchesNavQuery.js";
 /*
  * The action-index derivation — same reasoning as the nav helpers above.
  *
@@ -60,7 +60,7 @@ export { matchesNavQuery } from "../_internal/shared/features/layout/matchesNavQ
  * Found by `audit-client-entry-in-server`'s R2 the first time it ran — the same
  * defect as navItemId, one file over, and the next build failure in line.
  */
-export { buildActionIndexBase, deriveNavEntries, deriveQuickActionEntries, } from "../features/search/action-index/derive";
-export { deriveSettingsEntries } from "../features/search/action-index/settings-entries";
-export { deriveConsolidatedTabEntries, CONSOLIDATED_TAB_SURFACES, } from "../features/search/action-index/tab-entries";
-export { mergeActionIndex, projectActionIndexForViewer, } from "../features/search/action-index/types";
+export { buildActionIndexBase, deriveNavEntries, deriveQuickActionEntries, } from "../features/search/action-index/derive.js";
+export { deriveSettingsEntries } from "../features/search/action-index/settings-entries.js";
+export { deriveConsolidatedTabEntries, CONSOLIDATED_TAB_SURFACES, } from "../features/search/action-index/tab-entries.js";
+export { mergeActionIndex, projectActionIndexForViewer, } from "../features/search/action-index/types.js";

package/dist/next/middleware/chain.js

@@ -1,6 +1,6 @@
-import { normalizeError } from "../../errors/normalize";
-import { NextResponse } from "next/server";
-import { piiScrubberMiddleware } from "./pii-scrubber";
+import { normalizeError } from "../../errors/normalize.js";
+import { NextResponse } from "next/server.js";
+import { piiScrubberMiddleware } from "./pii-scrubber.js";
 /**
  * runChain — sequential middleware runner.
  *

package/dist/next/middleware/index.js

@@ -1,2 +1,2 @@
-export { piiScrubberMiddleware } from "./pii-scrubber";
-export { createApiMiddleware, runChain, buildBaseContext } from "./chain";
+export { piiScrubberMiddleware } from "./pii-scrubber.js";
+export { createApiMiddleware, runChain, buildBaseContext } from "./chain.js";

package/dist/next/middleware/pii-scrubber.js

@@ -1,6 +1,6 @@
-import { normalizeError } from "../../errors/normalize";
-import { NextResponse } from "next/server";
-import { hasEncPrefix } from "../../security/pii-mask";
+import { normalizeError } from "../../errors/normalize.js";
+import { NextResponse } from "next/server.js";
+import { hasEncPrefix } from "../../security/pii-mask.js";
 // Scrubbing wants EVERY `enc:v1:` value gone, whichever of the two crypto
 // systems wrote it and even if malformed — so `hasEncPrefix`, not
 // `isPiiEncrypted`, which is now specifically the PII format.

package/dist/next/request-helpers.js

@@ -5,7 +5,7 @@
  * Uses structural request types (not NextRequest) to avoid cross-package
  * type identity issues when multiple Next.js installs exist in a monorepo.
  */
-import { AuthenticationError } from "../errors";
+import { AuthenticationError } from "../errors/index.js";
 function readCookieFromHeader(request, name) {
     const cookieHeader = request.headers.get("cookie") ?? "";
     const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]+)`));

package/dist/next/routing/route-map.d.ts

@@ -104,6 +104,8 @@ export declare const DEFAULT_ROUTE_MAP: {
         readonly ITEM_REQUESTS: "/item-requests";
         readonly ITEM_REQUEST_DETAIL: (id: string) => string;
         readonly ITEM_REQUESTS_NEW: "/item-requests/new";
+        readonly TOOLS: "/tools";
+        readonly TOOL_PRICE_INDEX: "/tools/price-index";
         readonly SCAM_TYPES: "/scams/types";
         readonly SCAM_FAQS: "/scams/faqs";
         readonly CLASSIFIED: "/classified";
@@ -507,6 +509,8 @@ export declare const ROUTES: {
         readonly ITEM_REQUESTS: "/item-requests";
         readonly ITEM_REQUEST_DETAIL: (id: string) => string;
         readonly ITEM_REQUESTS_NEW: "/item-requests/new";
+        readonly TOOLS: "/tools";
+        readonly TOOL_PRICE_INDEX: "/tools/price-index";
         readonly SCAM_TYPES: "/scams/types";
         readonly SCAM_FAQS: "/scams/faqs";
         readonly CLASSIFIED: "/classified";

package/dist/next/routing/route-map.js

@@ -97,6 +97,15 @@ export const DEFAULT_ROUTE_MAP = {
         ITEM_REQUESTS: "/item-requests",
         ITEM_REQUEST_DETAIL: (id) => `/item-requests/${id}`,
         ITEM_REQUESTS_NEW: "/item-requests/new",
+        /*
+         * The TOOLS group — surfaces that answer a question rather than sell
+         * something. `/tools` itself is a real index page, not a `#` placeholder:
+         * the navbar dropdown's trigger is a link, so anyone without a hovering
+         * pointer has to land somewhere, and `audit-nav-page-wiring` checks that
+         * every nav href resolves to a real page.
+         */
+        TOOLS: "/tools",
+        TOOL_PRICE_INDEX: "/tools/price-index",
         SCAM_TYPES: "/scams/types",
         SCAM_FAQS: "/scams/faqs",
         CLASSIFIED: "/classified",

package/dist/providers/auth-firebase/helpers.js

@@ -1,6 +1,6 @@
-import { normalizeError } from "../../errors/normalize";
-import { getAdminAuthLite } from "../db-firebase/admin-auth-lite";
-import { createSessionCookieFromToken } from "./session";
+import { normalizeError } from "../../errors/normalize.js";
+import { getAdminAuthLite } from "../db-firebase/admin-auth-lite.js";
+import { createSessionCookieFromToken } from "./session.js";
 export { createSessionCookieFromToken };
 const EXPECTED_AUTH_CODES = new Set([
     "auth/argument-error",
@@ -125,7 +125,7 @@ export async function requireRole(cookies, role, resolveRole) {
  * Returns `AuthPayload` or throws 401.
  */
 export async function requireAuthUser() {
-    const { cookies } = await import("next/headers");
+    const { cookies } = await import("next/headers.js");
     const cookieStore = await cookies();
     return requireAuth(cookieStore);
 }
@@ -134,7 +134,7 @@ export async function requireAuthUser() {
  * Reads cookies via `next/headers` and resolves role via optional `resolveRole`.
  */
 export async function requireRoleUser(role, resolveRole) {
-    const { cookies } = await import("next/headers");
+    const { cookies } = await import("next/headers.js");
     const cookieStore = await cookies();
     return requireRole(cookieStore, role, resolveRole);
 }

package/dist/providers/auth-firebase/index.js

@@ -7,10 +7,10 @@
  * Server-side only — never import in browser/client-component code.
  */
 // IAuthProvider implementation
-export { firebaseAuthProvider } from "./provider";
+export { firebaseAuthProvider } from "./provider.js";
 // ISessionProvider implementation
 export { firebaseSessionProvider, createSessionCookieFromToken, 
 // Alias for backwards compatibility
-createSessionCookieFromToken as createSessionCookie, } from "./session";
+createSessionCookieFromToken as createSessionCookie, } from "./session.js";
 // Standalone helpers (drop-in replacements for auth-server.ts)
-export { verifyIdToken, verifySessionCookie, createMiddlewareAuthChain, requireAuth, requireRole, requireAuthUser, requireRoleUser, getUserFromRequest, requireAuthFromRequest, requireRoleFromRequest, revokeUserTokens, } from "./helpers";
+export { verifyIdToken, verifySessionCookie, createMiddlewareAuthChain, requireAuth, requireRole, requireAuthUser, requireRoleUser, getUserFromRequest, requireAuthFromRequest, requireRoleFromRequest, revokeUserTokens, } from "./helpers.js";

package/dist/providers/auth-firebase/provider.js

@@ -4,8 +4,8 @@
  * Implements `@mohasinac/contracts` `IAuthProvider` using the Firebase Admin SDK.
  * Server-side only.  Never import this in browser/client-component code.
  */
-import { getAdminAuthLite } from "../db-firebase/admin-auth-lite";
-import { normalizeError } from "../../errors/normalize";
+import { getAdminAuthLite } from "../db-firebase/admin-auth-lite.js";
+import { normalizeError } from "../../errors/normalize.js";
 /** Firebase error codes that represent a normal "not authenticated" state. */
 const EXPECTED_AUTH_CODES = new Set([
     "auth/argument-error",

package/dist/providers/auth-firebase/session.js

@@ -6,8 +6,8 @@
  *
  * Server-side only.
  */
-import { getAdminAuthLite } from "../db-firebase/admin-auth-lite";
-import { normalizeError } from "../../errors/normalize";
+import { getAdminAuthLite } from "../db-firebase/admin-auth-lite.js";
+import { normalizeError } from "../../errors/normalize.js";
 /** Default session duration: 5 days (in milliseconds). */
 const DEFAULT_EXPIRES_IN_MS = 60 * 60 * 24 * 5 * 1000;
 const EXPECTED_SESSION_CODES = new Set([

package/dist/providers/db-firebase/admin-app-lite.js

@@ -3,7 +3,7 @@ import { initializeApp, getApps, cert } from "firebase-admin/app";
 // logic byte-for-byte, so the region-wrong fallback bug existed twice.
 // Imported from its own dependency-free module, NOT from ./admin, because the
 // whole point of admin-app-lite is not pulling the full admin module in.
-import { resolveRtdbUrl } from "./rtdb-url";
+import { resolveRtdbUrl } from "./rtdb-url.js";
 function nodePath() { return require("path"); }
 function nodeFs() { return require("fs"); }
 // process.cwd() is Node.js-only; access via module.require so the Edge

package/dist/providers/db-firebase/admin-auth-lite.js

@@ -1,5 +1,5 @@
 import { getAuth } from "firebase-admin/auth";
-import { getAdminAppLite } from "./admin-app-lite";
+import { getAdminAppLite } from "./admin-app-lite.js";
 export function getAdminAuthLite() {
     if (globalThis.__mohasinac_firebase_admin_auth_lite__) {
         return globalThis.__mohasinac_firebase_admin_auth_lite__;

package/dist/providers/db-firebase/admin-storage-lite.js

@@ -1,5 +1,5 @@
 import { getStorage as getFirebaseStorage, } from "firebase-admin/storage";
-import { getAdminAppLite } from "./admin-app-lite";
+import { getAdminAppLite } from "./admin-app-lite.js";
 export function getAdminStorageLite() {
     if (globalThis.__mohasinac_firebase_admin_storage_lite__) {
         return globalThis.__mohasinac_firebase_admin_storage_lite__;

package/dist/providers/db-firebase/admin.js

@@ -1,5 +1,5 @@
-import { normalizeError } from "../../errors/normalize";
-import { resolveRtdbUrl } from "./rtdb-url";
+import { normalizeError } from "../../errors/normalize.js";
+import { resolveRtdbUrl } from "./rtdb-url.js";
 function nodePath() { return require("path"); }
 function nodeFs() { return require("fs"); }
 // process.cwd() is Node.js-only; access via module.require so the Edge

package/dist/providers/db-firebase/base.js

@@ -17,8 +17,8 @@
  * `findAll(query?)` maps the provider-agnostic `SieveQuery` from
  * `@mohasinac/contracts` to Firestore native queries (no in-memory fan-out).
  */
-import { getAdminDb } from "./admin";
-import { prepareForFirestore, deserializeTimestamps, getFirestoreCount, } from "./helpers";
+import { getAdminDb } from "./admin.js";
+import { prepareForFirestore, deserializeTimestamps, getFirestoreCount, } from "./helpers.js";
 export class FirebaseRepository {
     constructor(collectionName) {
         this.collection = collectionName;

package/dist/providers/db-firebase/base.repository.d.ts

@@ -57,6 +57,60 @@ export declare abstract class BaseRepository<T extends DocumentData> {
      * super is harmless rather than double-encrypted.
      */
     protected applyWriteHooks<D extends object>(data: D): D;
+    /**
+     * Apply the SAME patch to many documents in ONE atomic batch — C4.
+     *
+     * 🛑 TWO defects this closes, and the second one is why the obvious fix is
+     * not enough on its own.
+     *
+     * **Atomicity.** Both bulk-location routes did
+     * `Promise.all(ids.map((id) => repo.update(id, patch)))` — 50 independent
+     * writes, not batched and not transactional. A failure part-way leaves a
+     * PARTIAL result and the route still returned `{ updated: ids.length }`,
+     * i.e. a count it had not achieved, with no way for the caller to learn
+     * which half landed. `batchCreate` and `batchDelete` have existed here all
+     * along; the update case was simply missing, so every bulk edit reached for
+     * `Promise.all`.
+     *
+     * **`searchTxt`.** A raw `batch.update()` writes the fields it is given and
+     * nothing else, while `update()` routes through `applyWriteHooks` and
+     * re-derives the index. So converting a bulk route to a plain batch is an
+     * atomicity win and a silent SEARCH REGRESSION in the same change: the rows
+     * a seller just filed to a bin become exactly the rows the search cannot
+     * find. That failure is invisible in the usual way — the field is stored,
+     * the column renders, nothing errors, and only a query comes back empty.
+     *
+     * Hence the caller passes the DOCUMENTS it already holds. Every bulk route
+     * fetches them for the ownership check, so this costs no extra read, and
+     * `applyWriteHooks` can then run against the merged shape — which also
+     * means PII encryption and blind indices apply, exactly as on a single
+     * write. A collection that overrides nothing behaves like a plain batch.
+     *
+     * `null` entries are skipped rather than throwing: the ownership check
+     * upstream already rejects the request on a missing document, so a `null`
+     * here means a concurrent delete, and failing the whole batch for it would
+     * turn a race into an error the seller cannot act on.
+     */
+    batchUpdateMany(docs: ReadonlyArray<T | null | undefined>, patch: Partial<T>): Promise<number>;
+    /**
+     * Same atomic single-batch write as `batchUpdateMany`, but with a PER-DOCUMENT
+     * patch.
+     *
+     * 🛑 It exists because not every bulk edit is one value applied N times. A
+     * bulk STOCK edit is the forcing case: `availableQuantity` carries each
+     * product's own outstanding reservation forward
+     * (`resolveStockResync`), so the figure written differs per row even when the
+     * seller typed one number. `batchUpdateMany` would have to be called once per
+     * distinct patch, which is one batch per row — i.e. not atomic, which is the
+     * whole property these two methods exist to provide.
+     *
+     * Hooks, the patched-keys-only write and the 500-op refusal are identical to
+     * `batchUpdateMany`; see its comments for why each is that way.
+     */
+    batchUpdateEach(entries: ReadonlyArray<{
+        doc: T | null | undefined;
+        patch: Partial<T>;
+    }>): Promise<number>;
     create(data: Partial<T> | FirestoreDocument): Promise<T>;
     createWithId(id: string, data: Partial<T>): Promise<T>;
     update(id: string, data: Partial<T>): Promise<T>;