@mohasinac/appkit 4.52.4 → 4.53.0

package/dist/client.js

@@ -60,6 +60,7 @@ export { Alert } from "./ui/components/Alert.js";
 export { Divider } from "./ui/components/Divider.js";
 export { Tabs, TabsList, TabsTrigger, TabsContent } from "./ui/components/Tabs.js";
 export { TabBarShell, TabBarButton, TabsNavSelect } from "./ui/components/TabBarShell.js";
+export { OverflowRow } from "./ui/components/OverflowRow.js";
 export { SellerProductsView } from "./features/seller/components/SellerProductsView.js";
 export { SellerOrderDetailPanel } from "./features/seller/components/SellerOrdersView.js";
 export { SellerPayoutDetailContent } from "./features/seller/components/SellerPayoutsView.js";
@@ -310,7 +311,7 @@ export { buildBidDetailFields, bidStatusBadge } from "./features/auctions/compon
 // Same reason, one feature over: the entry detail modal and its full page
 // render from one builder rather than two lists that can drift.
 export { buildEventEntryDetailFields } from "./features/events/components/event-entry-detail-fields.js";
-export { ProtectedRoute, AuthStatusPanel, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index.js";
+export { ProtectedRoute, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index.js";
 export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangeEmail } from "./features/auth/index.js";
 export { CartView, CartItemRow, CartGroupLineRow, CartSummary, CartPriceBreakdown, CartDrawer, CheckoutView, CheckoutSuccessView, CheckoutAddressStep, useGuestCart, useCartCount, useAddToCart, useCart, useGuestCartMerge, useCartQuery } from "./features/cart/index.js";
 export { StoreAddonsPicker, hasAnyStoreAddon } from "./features/cart/index.js";
@@ -323,12 +324,18 @@ export { useAddresses, useCreateAddress, useUpdateAddress, useDeleteAddress, use
 export { AddressBook, AddressCard, AddressForm } from "./features/account/index.js";
 export { useProfile, useUpdateProfile } from "./features/account/index.js";
 export { updateProfileSchema } from "./features/account/index.js";
-export { CategoryProductsView } from "./features/categories/index.js";
 export { MediaImage } from "./features/media/index.js";
 export { StoreSidebar } from "./features/seller/components/SellerSidebar.js";
 export { StoreProductsView, StoreAboutView } from "./features/stores/index.js";
 export { SearchView } from "./features/search/index.js";
-export { UserSettingsView } from "./features/account/index.js";
+/*
+ * The browser-side search index. Exported from its DEFINING module rather
+ * than through `features/search/index` (Root Cause #18) — `ensureSearchIndex`
+ * is a module-scope singleton, and routing it through a barrel is how a
+ * second copy of that module ends up in the graph, at which point the "one
+ * fetch per page session" guarantee quietly becomes two.
+ */
+export { useSearchIndex, ensureSearchIndex } from "./features/search/hooks/useSearchIndex.js";
 export { AdSlot } from "./features/homepage/components/AdSlot.js";
 export { useActiveAd } from "./features/homepage/hooks/useActiveAd.js";
 export { registerAdSlot, registerAdSlots, unregisterAdSlot, clearAdRegistry, setAdConsentGranted, isAdConsentGranted, isAdSlotRenderable, } from "./features/homepage/ad-registry.js";
@@ -385,7 +392,7 @@ export { SellerDashboardView as StoreDashboardView, SellerDashboardView, useSell
 export { SellerPayoutSettingsView, SellerShippingView, SellerReviewsView, SellerPayoutRequestView, SellerAnalyticsStats, SellerTopProducts, SellerAnalyticsView, SellerPayoutsView, SellerCouponEditorView, SellerBidsView, SellerAddressesView, PrintCenterView, SellerOffersView, SellerGroupedListingsView, StoreGroupedListingsView, SellerAnalyticsAlertsView, StoreAnalyticsAlertsView, BarcodeField, FulfillmentView, SellerListingTypeView, SELLER_LISTING_TYPE_SPECS } from "./features/seller/components/index.js";
 /* The draft → route conversion, so both coupon callsites share one rule. */
 export { couponDraftToPayload } from "./features/seller/schemas/coupon-form.js";
-export { UserAccountHubView, UserOrdersView, UserBidsView, OrderDetailView, UserNotificationsView, UserReturnsView, UserSupportView, useNotifications } from "./features/account/index.js";
+export { UserAccountHubView, UserOrdersView, UserBidsView, OrderDetailView, UserReturnsView, useNotifications } from "./features/account/index.js";
 export { useOrders, useOrder, OrdersList } from "./features/orders/index.js";
 export { OrderStatusTimeline } from "./features/orders/components/OrderStatusTimeline.js";
 export { CountdownDisplay } from "./ui/components/CountdownDisplay.js";
@@ -415,7 +422,7 @@ export { normalizeListingType, isAuctionListing, isPreOrderListing, isStandardLi
 // `finalSale` field. See the module docstring for why `!p.finalSale` is wrong.
 export { isFinalSale, acceptsChangeOfMindReturns, } from "./features/products/constants/final-sale.js";
 // SB-UNI-X4 2026-05-13 — per-type feature-flag helpers (client-safe).
-export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, } from "./_internal/shared/listing-types/feature-flags.js";
+export { isListingTypeEnabled, isCategoryTypeEnabled, enabledListingTypes, enabledCategoryTypes, ALL_LISTING_TYPES, isListingType, } from "./_internal/shared/listing-types/feature-flags.js";
 // SB-UNI-X5 2026-05-13 — action telemetry sink (client-safe; defaults to
 // a no-op + console.debug in dev).
 export { actionTracker, setActionTrackerSink, resetActionTrackerSink, } from "./_internal/shared/listing-types/action-tracker.js";

package/dist/configs/eslint.js

@@ -25,8 +25,28 @@
  */
 const VARIANT_CATALOGUE_RULES = [
     {
-        // Hardcoded route strings — use ROUTES.* constants.
-        selector: "Literal[value=/^\\/[a-z]+(\\?|#|$)/]",
+        /*
+         * Hardcoded route strings — use ROUTES.* constants.
+         *
+         * 🛑 The `:not(Property[key.name="route"] > Literal)` is load-bearing, not
+         * tidying. `safeRead({ route: "/products", key, fallback })` takes a route
+         * as an OBSERVABILITY LABEL — it is the string that appears on a
+         * DEGRADED_READ row, never something anything navigates to. Flagging it
+         * asked for `ROUTES.PUBLIC.PRODUCTS` in a log field.
+         *
+         * Measured 2026-10-17 across appkit/src: this rule produced 741 warnings
+         * of which 23 were real — a 97% false-positive rate. 653 were tester-case
+         * hrefs that MUST be literals (see the file-scoped exemption in the
+         * consumer's eslint.config.mjs), 43 were inside route-map.ts itself, and
+         * 22 were these labels. A rule at that ratio is not a soft gate, it is
+         * noise that teaches people to scroll past the other 23.
+         *
+         * 🛑 The combinator is DESCENDANT, not child. `>` missed
+         * `route: verifiedOnly ? "/sellers" : "/stores"`, where the literal's
+         * parent is the ConditionalExpression and not the Property — so a label
+         * behind a ternary was still flagged while the plain one beside it was not.
+         */
+        selector: 'Literal[value=/^\\/[a-z]+(\\?|#|$)/]:not(Property[key.name="route"] Literal)',
         message: "Use ROUTES.* constants from @mohasinac/appkit instead of hardcoded route strings.",
     },
     {

package/dist/constants/api-endpoints.d.ts

@@ -287,6 +287,36 @@ export declare const TOOL_ENDPOINTS: {
      */
     readonly PRICE_INDEX_SEARCH: (q: string) => string;
 };
+/**
+ * The sticker-sheet kiss-cut tracer. Admin-only, every route behind
+ * `admin:products:write`.
+ *
+ * 🛑 EVERY ONE OF THESE RETURNS JSON. Not one returns bytes — a binary is
+ * always a 5-minute signed GCS URL fetched by the browser directly, which is
+ * why `ASSET` takes a KIND and hands back `{ url, expiresAt }`. Vercel Hobby's
+ * Fast Origin Transfer allowance is 10 GB and exceeding a cap PAUSES THE
+ * PROJECT, which happened here at 52.52 GB (Root Cause #104).
+ * `audit-sticker-trace-egress` is strict-zero on it with no suppression marker.
+ */
+export declare const STICKER_SHEET_ENDPOINTS: {
+    /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+    readonly SHEETS: "/api/admin/sticker-sheets";
+    readonly SHEET_BY_ID: (id: string) => string;
+    /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+    readonly UPLOAD: (id: string) => string;
+    /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+    readonly RUNS: (id: string) => string;
+    /** POST a retry as a NEW named run. The response carries the resume clamp. */
+    readonly RUN_RETRY: (id: string, runId: string) => string;
+    /**
+     * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+     * the path itself — accepting a path would be a signed-URL mint for any
+     * object in the bucket.
+     */
+    readonly ASSET: (id: string, kind: string, runId?: string) => string;
+    /** The storage meter — bytes AND object count, biggest sheet first. */
+    readonly USAGE: "/api/admin/sticker-sheets/usage";
+};
 export declare const CHECKOUT_ENDPOINTS: {
     readonly PREFLIGHT: "/api/checkout/preflight";
     readonly PLACE_ORDER: "/api/checkout";
@@ -1018,6 +1048,25 @@ export declare const API_ENDPOINTS: {
     readonly REPORTS: {
         readonly SUBMIT: "/api/reports";
     };
+    readonly STICKER_SHEETS: {
+        /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+        readonly SHEETS: "/api/admin/sticker-sheets";
+        readonly SHEET_BY_ID: (id: string) => string;
+        /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+        readonly UPLOAD: (id: string) => string;
+        /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+        readonly RUNS: (id: string) => string;
+        /** POST a retry as a NEW named run. The response carries the resume clamp. */
+        readonly RUN_RETRY: (id: string, runId: string) => string;
+        /**
+         * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+         * the path itself — accepting a path would be a signed-URL mint for any
+         * object in the bucket.
+         */
+        readonly ASSET: (id: string, kind: string, runId?: string) => string;
+        /** The storage meter — bytes AND object count, biggest sheet first. */
+        readonly USAGE: "/api/admin/sticker-sheets/usage";
+    };
 };
 /** Canonical alias — prefer API_ROUTES over API_ENDPOINTS in new code. */
 export declare const API_ROUTES: {
@@ -1520,4 +1569,23 @@ export declare const API_ROUTES: {
     readonly REPORTS: {
         readonly SUBMIT: "/api/reports";
     };
+    readonly STICKER_SHEETS: {
+        /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+        readonly SHEETS: "/api/admin/sticker-sheets";
+        readonly SHEET_BY_ID: (id: string) => string;
+        /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+        readonly UPLOAD: (id: string) => string;
+        /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+        readonly RUNS: (id: string) => string;
+        /** POST a retry as a NEW named run. The response carries the resume clamp. */
+        readonly RUN_RETRY: (id: string, runId: string) => string;
+        /**
+         * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+         * the path itself — accepting a path would be a signed-URL mint for any
+         * object in the bucket.
+         */
+        readonly ASSET: (id: string, kind: string, runId?: string) => string;
+        /** The storage meter — bytes AND object count, biggest sheet first. */
+        readonly USAGE: "/api/admin/sticker-sheets/usage";
+    };
 };

package/dist/constants/api-endpoints.js

@@ -334,6 +334,37 @@ export const TOOL_ENDPOINTS = {
      */
     PRICE_INDEX_SEARCH: (q) => `/api/tools/price-index?q=${encodeURIComponent(q)}`,
 };
+/**
+ * The sticker-sheet kiss-cut tracer. Admin-only, every route behind
+ * `admin:products:write`.
+ *
+ * 🛑 EVERY ONE OF THESE RETURNS JSON. Not one returns bytes — a binary is
+ * always a 5-minute signed GCS URL fetched by the browser directly, which is
+ * why `ASSET` takes a KIND and hands back `{ url, expiresAt }`. Vercel Hobby's
+ * Fast Origin Transfer allowance is 10 GB and exceeding a cap PAUSES THE
+ * PROJECT, which happened here at 52.52 GB (Root Cause #104).
+ * `audit-sticker-trace-egress` is strict-zero on it with no suppression marker.
+ */
+export const STICKER_SHEET_ENDPOINTS = {
+    /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+    SHEETS: "/api/admin/sticker-sheets",
+    SHEET_BY_ID: (id) => `/api/admin/sticker-sheets/${id}`,
+    /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+    UPLOAD: (id) => `/api/admin/sticker-sheets/${id}/upload`,
+    /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+    RUNS: (id) => `/api/admin/sticker-sheets/${id}/runs`,
+    /** POST a retry as a NEW named run. The response carries the resume clamp. */
+    RUN_RETRY: (id, runId) => `/api/admin/sticker-sheets/${id}/runs/${runId}/retry`,
+    /**
+     * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+     * the path itself — accepting a path would be a signed-URL mint for any
+     * object in the bucket.
+     */
+    ASSET: (id, kind, runId) => `/api/admin/sticker-sheets/${id}/asset?kind=${encodeURIComponent(kind)}` +
+        (runId ? `&runId=${encodeURIComponent(runId)}` : ""),
+    /** The storage meter — bytes AND object count, biggest sheet first. */
+    USAGE: "/api/admin/sticker-sheets/usage",
+};
 // ---------------------------------------------------------------------------
 // Checkout
 // ---------------------------------------------------------------------------
@@ -734,6 +765,7 @@ export const API_ENDPOINTS = {
     SUPPORT: SUPPORT_ENDPOINTS,
     SCAMMERS: SCAMMER_ENDPOINTS,
     REPORTS: REPORT_ENDPOINTS,
+    STICKER_SHEETS: STICKER_SHEET_ENDPOINTS,
 };
 /** Canonical alias — prefer API_ROUTES over API_ENDPOINTS in new code. */
 export const API_ROUTES = API_ENDPOINTS;

package/dist/constants/field-names.d.ts

@@ -427,7 +427,6 @@ export declare const EVENT_ENTRY_FIELDS: {
     readonly USER_ID: "userId";
     readonly USER_DISPLAY_NAME: "userDisplayName";
     readonly USER_EMAIL: "userEmail";
-    readonly STATUS: "status";
     readonly RAFFLE_ELIGIBLE: "raffleEligible";
     readonly SPIN_USED: "spinUsed";
     readonly SPIN_COUNT: "spinCount";
@@ -436,11 +435,18 @@ export declare const EVENT_ENTRY_FIELDS: {
     readonly SPIN_WON_AT: "spinWonAt";
     readonly GUEST_IP_HASH: "guestIpHash";
     readonly CREATED_AT: "createdAt";
+    readonly STATUS: "status";
     readonly STATUS_VALUES: {
         readonly CONFIRMED: "CONFIRMED";
         readonly WAITLISTED: "WAITLISTED";
         readonly CANCELLED: "CANCELLED";
     };
+    readonly REVIEW_STATUS: "reviewStatus";
+    readonly REVIEW_STATUS_VALUES: {
+        readonly PENDING: "pending";
+        readonly APPROVED: "approved";
+        readonly FLAGGED: "flagged";
+    };
 };
 export declare const PAYOUT_FIELDS: {
     readonly ID: "id";

package/dist/constants/field-names.js

@@ -487,7 +487,6 @@ export const EVENT_ENTRY_FIELDS = {
     USER_ID: "userId",
     USER_DISPLAY_NAME: "userDisplayName",
     USER_EMAIL: "userEmail",
-    STATUS: "status",
     RAFFLE_ELIGIBLE: "raffleEligible",
     SPIN_USED: "spinUsed",
     SPIN_COUNT: "spinCount",
@@ -496,11 +495,47 @@ export const EVENT_ENTRY_FIELDS = {
     SPIN_WON_AT: "spinWonAt",
     GUEST_IP_HASH: "guestIpHash",
     CREATED_AT: "createdAt",
+    /*
+     * 🛑 TWO status fields, different meanings, and conflating them cost the
+     * raffle feature its entire working life.
+     *
+     *   `status`       — RSVP / attendance. CONFIRMED | WAITLISTED | CANCELLED.
+     *                    Written ONLY by an admin clicking Confirm / Waitlist /
+     *                    Cancel in `AdminAllEventEntriesView`, which also filters
+     *                    on it. Never set when an entry is created.
+     *   `reviewStatus` — moderation of what the entrant SUBMITTED.
+     *                    pending | approved | flagged. Written on every entry
+     *                    path, and indexed `(eventId, reviewStatus, submittedAt)`.
+     *
+     * `EventEntryDocument.status`'s own doc comment claims it "drives raffle
+     * eligibility", and `runTriggerEventRaffle` duly queried
+     * `status == "CONFIRMED"`. But nothing writes `status` at creation time, so
+     * the pool was empty unless an admin had hand-confirmed every entry one row
+     * at a time — on a raffle seeded with 1,892 entries. Every draw returned
+     * `no_eligible_entries`; the raffle had never once been drawable.
+     *
+     * Eligibility moved to `reviewStatus == "approved"` on 2026-10-19 (and
+     * `enterEvent` now auto-approves raffle entries, since a raffle entry is a
+     * name plus an optional message and there is nothing to moderate). `status`
+     * stays because its admin workflow is real — it just is not the gate.
+     *
+     * Both mirror `EVENT_ENTRY_FIELDS` in
+     * `features/events/schemas/firestore.ts`, which is the source of truth for
+     * the document shape — verify there before adding a value here (Root Cause
+     * #34).
+     */
+    STATUS: "status",
     STATUS_VALUES: {
         CONFIRMED: "CONFIRMED",
         WAITLISTED: "WAITLISTED",
         CANCELLED: "CANCELLED",
     },
+    REVIEW_STATUS: "reviewStatus",
+    REVIEW_STATUS_VALUES: {
+        PENDING: "pending",
+        APPROVED: "approved",
+        FLAGGED: "flagged",
+    },
 };
 // ============================================================================
 // PAYOUT FIELDS

package/dist/contracts/repository.d.ts

@@ -1,3 +1,4 @@
+import type { Plaintext } from "../security/encrypted";
 /** Field comparison operators supported by Sieve-style query strings. */
 export type WhereOp = "==" | "!=" | "<" | "<=" | ">" | ">=" | "array-contains" | "in" | "not-in" | "array-contains-any";
 /**
@@ -15,14 +16,14 @@ export interface SieveQuery {
     /** 1-based page number (default: 1) */
     page?: number;
     /** Items per page (default: 20) */
-    perPage?: number;
+    pageSize?: number;
 }
 /** Paginated result envelope returned by IReadRepository.findAll() */
 export interface PagedResult<T> {
     data: T[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
 }
 export interface IReadRepository<T> {
@@ -36,10 +37,10 @@ export interface IReadRepository<T> {
     findWhere<K extends keyof T>(field: K, op: WhereOp, value: T[K] | readonly T[K][]): Promise<T[]>;
 }
 export interface IWriteRepository<T> {
-    create(data: Omit<T, "id" | "createdAt" | "updatedAt">): Promise<T>;
-    update(id: string, data: Partial<T>): Promise<T>;
+    create(data: Omit<Plaintext<T>, "id" | "createdAt" | "updatedAt">): Promise<T>;
+    update(id: string, data: Partial<Plaintext<T>>): Promise<T>;
     delete(id: string): Promise<void>;
-    batchCreate(items: Array<Omit<T, "id" | "createdAt" | "updatedAt">>): Promise<T[]>;
+    batchCreate(items: Array<Omit<Plaintext<T>, "id" | "createdAt" | "updatedAt">>): Promise<T[]>;
     batchDelete(ids: string[]): Promise<void>;
 }
 /** Full CRUD repository — combines read + write. */
@@ -95,7 +96,7 @@ export interface RepositoryLifecycleHooks<T> {
      * Called before `create`. Return the (possibly mutated) data to be persisted.
      * If not returned, the original data is used unchanged.
      */
-    beforeCreate?: (data: Omit<T, "id" | "createdAt" | "updatedAt">) => Omit<T, "id" | "createdAt" | "updatedAt"> | Promise<Omit<T, "id" | "createdAt" | "updatedAt">>;
+    beforeCreate?: (data: Omit<Plaintext<T>, "id" | "createdAt" | "updatedAt">) => Omit<T, "id" | "createdAt" | "updatedAt"> | Promise<Omit<T, "id" | "createdAt" | "updatedAt">>;
     /**
      * Called after a successful `create`. Receives the persisted document.
      */
@@ -103,7 +104,7 @@ export interface RepositoryLifecycleHooks<T> {
     /**
      * Called before `update`. Return the (possibly mutated) partial to be applied.
      */
-    beforeUpdate?: (id: string, data: Partial<T>) => Partial<T> | Promise<Partial<T>>;
+    beforeUpdate?: (id: string, data: Partial<Plaintext<T>>) => Partial<T> | Promise<Partial<T>>;
     /**
      * Called after a successful `update`. Receives the updated document.
      */

package/dist/contracts/search.d.ts

@@ -1,6 +1,6 @@
 export interface SearchOptions {
     page?: number;
-    perPage?: number;
+    pageSize?: number;
     filters?: string;
     facets?: string[];
     sortBy?: string;
@@ -19,7 +19,7 @@ export interface SearchResult<T> {
     hits: SearchHit<T>[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
     processingTimeMs?: number;
     facets?: Record<string, Record<string, number>>;

package/dist/contracts/table.d.ts

@@ -16,7 +16,7 @@
  *
  * export const myPaginationConfig: PaginationConfig = {
  *   ...DEFAULT_PAGINATION_CONFIG,
- *   perPage: 10,
+ *   pageSize: 10,
  *   showPageSizeSelector: true,
  *   pageSizeOptions: [10, 25, 50],
  * };
@@ -33,8 +33,8 @@
  */
 export interface PaginationConfig {
     /** Items per page sent to the API. Default: 20 */
-    perPage?: number;
-    /** Hard cap on perPage (for page-size selector). Default: 100 */
+    pageSize?: number;
+    /** Hard cap on pageSize (for page-size selector). Default: 100 */
     maxPerPage?: number;
     /** Show a page-size selector UI element. Default: false */
     showPageSizeSelector?: boolean;

package/dist/contracts/table.js

@@ -16,7 +16,7 @@
  *
  * export const myPaginationConfig: PaginationConfig = {
  *   ...DEFAULT_PAGINATION_CONFIG,
- *   perPage: 10,
+ *   pageSize: 10,
  *   showPageSizeSelector: true,
  *   pageSizeOptions: [10, 25, 50],
  * };
@@ -28,7 +28,7 @@
  * const { products } = useProducts(params, { paginationConfig: myPaginationConfig });
  */
 export const DEFAULT_PAGINATION_CONFIG = {
-    perPage: 20,
+    pageSize: 20,
     maxPerPage: 100,
     showPageSizeSelector: false,
     pageSizeOptions: [10, 20, 50, 100],
@@ -44,7 +44,7 @@ export const DEFAULT_STICKY_CONFIG = {
     zIndex: 10,
 };
 export const DEFAULT_TABLE_CONFIG = {
-    pageSize: DEFAULT_PAGINATION_CONFIG.perPage,
+    pageSize: DEFAULT_PAGINATION_CONFIG.pageSize,
     sticky: DEFAULT_STICKY_CONFIG,
     striped: false,
     selectable: false,

package/dist/core/contact-submissions.repository.js

@@ -19,12 +19,12 @@ export class ContactSubmissionsRepository {
     }
     async list(model) {
         const page = Number(model.page || "1");
-        const perPage = Number(model.pageSize || "50");
+        const pageSize = Number(model.pageSize || "50");
         return this.repo.findAll({
             filters: model.filters,
             sort: model.sorts || "-createdAt",
             page: Number.isFinite(page) ? page : 1,
-            perPage: Number.isFinite(perPage) ? perPage : 50,
+            pageSize: Number.isFinite(pageSize) ? pageSize : 50,
         });
     }
     async findById(id) {

package/dist/core/integration-keys.js

@@ -13,7 +13,13 @@
  *   const keys = await resolveKeys();
  *   const client = StandardCheckoutClient.getInstance(keys.phonepeClientId, keys.phonepeClientSecret, Number(keys.phonepeClientVersion), env);
  */
-import { siteSettingsRepository } from "../repositories/index.js";
+/*
+ * The DEFINING module, not the `repositories` barrel. That barrel re-exports
+ * `unitOfWork` from `../core`, so coming back through it put this file inside
+ * the same cycle (`audit-import-cycles` component 2) — and Root Cause #18 asks
+ * for the defining module regardless.
+ */
+import { siteSettingsRepository } from "../features/admin/repository/site-settings.repository.js";
 import { normalizeError } from "../errors/normalize.js";
 const EMPTY_KEYS = {
     phonepeClientId: "",

package/dist/core/newsletter.repository.js

@@ -52,12 +52,12 @@ export class NewsletterRepository {
     }
     async list(model) {
         const page = Number(model.page || "1");
-        const perPage = Number(model.pageSize || "50");
+        const pageSize = Number(model.pageSize || "50");
         const result = await this.repo.findAll({
             filters: model.filters,
             sort: model.sorts || "-createdAt",
             page: Number.isFinite(page) ? page : 1,
-            perPage: Number.isFinite(perPage) ? perPage : 50,
+            pageSize: Number.isFinite(pageSize) ? pageSize : 50,
         });
         return {
             ...result,

package/dist/core/site-config.js

@@ -15,7 +15,7 @@ export const SITE_CONFIG = {
         sellers: ROUTES.PUBLIC.SELLERS,
         stores: ROUTES.PUBLIC.STORES,
         events: ROUTES.PUBLIC.EVENTS,
-        blog: ROUTES.PUBLIC.BLOG,
+        blog: ROUTES.BLOG.LIST,
         categories: ROUTES.PUBLIC.CATEGORIES,
         promotions: ROUTES.PUBLIC.PROMOTIONS,
         reviews: ROUTES.PUBLIC.REVIEWS,

package/dist/errors/error-codes.d.ts

@@ -31,6 +31,36 @@ export declare const OFFER_ERROR_CODES: {
     readonly CHECKOUT_EXPIRED: "OFFER_CHECKOUT_EXPIRED";
     readonly WRONG_STATE: "OFFER_WRONG_STATE";
 };
+/**
+ * Event prize-draw refusals — the spin wheel and the raffle draw.
+ *
+ * These exist because every refusal on those two surfaces used to render as the
+ * single string "Spin failed. Please try again.": the client threw a native
+ * `Error`, so `normalizeError` produced no code, so `toUserMessage` could only
+ * return its fallback. A closed window, an exhausted per-user cap and a
+ * misconfigured event were indistinguishable to the person spinning, and a
+ * 401 never opened the login modal.
+ *
+ * Statuses live beside the reasons in
+ * `_internal/server/jobs/core/event-draw-reasons.ts`; `audit-error-display-i18n`
+ * requires a matching `errors.codes.*` key in `messages/en.json` for every
+ * value below.
+ */
+export declare const EVENT_DRAW_ERROR_CODES: {
+    readonly IDENTITY_REQUIRED: "EVENT_IDENTITY_REQUIRED";
+    readonly LOGIN_REQUIRED: "EVENT_LOGIN_REQUIRED";
+    readonly EVENT_NOT_FOUND: "EVENT_NOT_FOUND";
+    readonly EVENT_NOT_ACTIVE: "EVENT_NOT_ACTIVE";
+    readonly SPIN_NO_PRIZES: "SPIN_NO_PRIZES";
+    readonly SPIN_OUTSIDE_WINDOW: "SPIN_OUTSIDE_WINDOW";
+    readonly SPIN_ALREADY_USED: "SPIN_ALREADY_USED";
+    readonly NOT_A_SPIN_WHEEL: "EVENT_NOT_A_SPIN_WHEEL";
+    readonly RAFFLE_NOT_A_RAFFLE: "RAFFLE_NOT_A_RAFFLE";
+    readonly RAFFLE_ALREADY_DRAWN: "RAFFLE_ALREADY_DRAWN";
+    readonly RAFFLE_NO_ELIGIBLE_ENTRIES: "RAFFLE_NO_ELIGIBLE_ENTRIES";
+    /** A reason the status map has never heard of — a bug in the core, mapped 500. */
+    readonly UNKNOWN_REASON: "EVENT_DRAW_UNKNOWN_REASON";
+};
 export declare const ERROR_CODES: {
     readonly AUTH_INVALID_CREDENTIALS: "AUTH_001";
     readonly AUTH_TOKEN_EXPIRED: "AUTH_002";

package/dist/errors/error-codes.js

@@ -31,6 +31,36 @@ export const OFFER_ERROR_CODES = {
     CHECKOUT_EXPIRED: "OFFER_CHECKOUT_EXPIRED",
     WRONG_STATE: "OFFER_WRONG_STATE",
 };
+/**
+ * Event prize-draw refusals — the spin wheel and the raffle draw.
+ *
+ * These exist because every refusal on those two surfaces used to render as the
+ * single string "Spin failed. Please try again.": the client threw a native
+ * `Error`, so `normalizeError` produced no code, so `toUserMessage` could only
+ * return its fallback. A closed window, an exhausted per-user cap and a
+ * misconfigured event were indistinguishable to the person spinning, and a
+ * 401 never opened the login modal.
+ *
+ * Statuses live beside the reasons in
+ * `_internal/server/jobs/core/event-draw-reasons.ts`; `audit-error-display-i18n`
+ * requires a matching `errors.codes.*` key in `messages/en.json` for every
+ * value below.
+ */
+export const EVENT_DRAW_ERROR_CODES = {
+    IDENTITY_REQUIRED: "EVENT_IDENTITY_REQUIRED",
+    LOGIN_REQUIRED: "EVENT_LOGIN_REQUIRED",
+    EVENT_NOT_FOUND: "EVENT_NOT_FOUND",
+    EVENT_NOT_ACTIVE: "EVENT_NOT_ACTIVE",
+    SPIN_NO_PRIZES: "SPIN_NO_PRIZES",
+    SPIN_OUTSIDE_WINDOW: "SPIN_OUTSIDE_WINDOW",
+    SPIN_ALREADY_USED: "SPIN_ALREADY_USED",
+    NOT_A_SPIN_WHEEL: "EVENT_NOT_A_SPIN_WHEEL",
+    RAFFLE_NOT_A_RAFFLE: "RAFFLE_NOT_A_RAFFLE",
+    RAFFLE_ALREADY_DRAWN: "RAFFLE_ALREADY_DRAWN",
+    RAFFLE_NO_ELIGIBLE_ENTRIES: "RAFFLE_NO_ELIGIBLE_ENTRIES",
+    /** A reason the status map has never heard of — a bug in the core, mapped 500. */
+    UNKNOWN_REASON: "EVENT_DRAW_UNKNOWN_REASON",
+};
 export const ERROR_CODES = {
     // Authentication
     AUTH_INVALID_CREDENTIALS: "AUTH_001",

package/dist/errors/error-display-map.js

@@ -1,5 +1,5 @@
 import { normalizeError } from "./normalize.js";
-import { ERROR_CODES, BID_ERROR_CODES, OFFER_ERROR_CODES } from "./error-codes.js";
+import { ERROR_CODES, BID_ERROR_CODES, OFFER_ERROR_CODES, EVENT_DRAW_ERROR_CODES, } from "./error-codes.js";
 import { HTTP_ERROR_CODES } from "./error-mapping.js";
 const k = (code) => `errors.codes.${code}`;
 export const ERROR_DISPLAY_MAP = {
@@ -172,6 +172,45 @@ export const ERROR_DISPLAY_MAP = {
     [OFFER_ERROR_CODES.WRONG_STATE]: {
         messageKey: k(OFFER_ERROR_CODES.WRONG_STATE),
     },
+    // ---------- Event prize draws (spin wheel + raffle) ----------
+    // No `field` on any of these: the spin wheel is a button, not a form, and the
+    // raffle draw is an admin action. There is no input to route an error onto.
+    [EVENT_DRAW_ERROR_CODES.IDENTITY_REQUIRED]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.IDENTITY_REQUIRED),
+    },
+    [EVENT_DRAW_ERROR_CODES.LOGIN_REQUIRED]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.LOGIN_REQUIRED),
+    },
+    [EVENT_DRAW_ERROR_CODES.EVENT_NOT_FOUND]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.EVENT_NOT_FOUND),
+    },
+    [EVENT_DRAW_ERROR_CODES.EVENT_NOT_ACTIVE]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.EVENT_NOT_ACTIVE),
+    },
+    [EVENT_DRAW_ERROR_CODES.SPIN_NO_PRIZES]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.SPIN_NO_PRIZES),
+    },
+    [EVENT_DRAW_ERROR_CODES.SPIN_OUTSIDE_WINDOW]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.SPIN_OUTSIDE_WINDOW),
+    },
+    [EVENT_DRAW_ERROR_CODES.SPIN_ALREADY_USED]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.SPIN_ALREADY_USED),
+    },
+    [EVENT_DRAW_ERROR_CODES.NOT_A_SPIN_WHEEL]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.NOT_A_SPIN_WHEEL),
+    },
+    [EVENT_DRAW_ERROR_CODES.RAFFLE_NOT_A_RAFFLE]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.RAFFLE_NOT_A_RAFFLE),
+    },
+    [EVENT_DRAW_ERROR_CODES.RAFFLE_ALREADY_DRAWN]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.RAFFLE_ALREADY_DRAWN),
+    },
+    [EVENT_DRAW_ERROR_CODES.RAFFLE_NO_ELIGIBLE_ENTRIES]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.RAFFLE_NO_ELIGIBLE_ENTRIES),
+    },
+    [EVENT_DRAW_ERROR_CODES.UNKNOWN_REASON]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.UNKNOWN_REASON),
+    },
     // ---------- HTTP / mapped wire codes (from error-mapping.ts) ----------
     [HTTP_ERROR_CODES.VALIDATION_FAILED]: {
         messageKey: k(HTTP_ERROR_CODES.VALIDATION_FAILED),

package/dist/features/account/api/[userId]/addresses/route.js

@@ -40,7 +40,7 @@ export async function GET(request, { params }) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/account/components/UserBidsView.js

@@ -44,7 +44,7 @@ export function UserBidsView() {
         endpoint: ACCOUNT_ENDPOINTS.BIDS,
         sortOptions: SORT_OPTIONS,
         hideTableView: true,
-        mapRows: (response) => response.bids ?? [],
+        mapRows: (response) => response.items ?? [],
         getTotal: (response, rows) => response.total ?? rows.length,
         buildFilters: (state) => (state.status ? sieveFilter("status", SIEVE_OP.EQ, state.status) : undefined),
         renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsx(FieldSelect, { name: "status", label: "Bid status", value: pendingFilters.status || "", onChange: (v) => setPendingFilters((p) => ({ ...p, status: v })), options: STATUS_OPTIONS })),