@mohasinac/appkit 4.52.4 → 4.53.0

package/dist/features/admin/components/AdminProductEditorView.js

@@ -27,6 +27,8 @@ import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { ProductForm } from "../../products/components/ProductForm.js";
 import { normalizeListingType } from "../../products/utils/listing-type.js";
+import { ALL_LISTING_TYPES } from "../../../_internal/shared/listing-types/feature-flags.js";
+import { pluginFor } from "../../../_internal/shared/listing-types/_registry.js";
 import { GroupSettingsPanel } from "../../products/components/GroupSettingsPanel.js";
 import { GroupInlineSelect } from "../../seller/components/GroupInlineSelect.js";
 import { CategoryQuickCreateForm } from "./CategoryQuickCreateForm.js";
@@ -39,38 +41,12 @@ const __P = {
 const __O = {
     yAuto: "overflow-y-auto",
 };
-function modeFromProduct(product) {
-    const lt = normalizeListingType(product);
-    if (lt === "auction")
-        return "auction";
-    if (lt === "pre-order")
-        return "preorder";
-    if (lt === "prize-draw")
-        return "prize-draw";
-    if (lt === "classified")
-        return "classified";
-    if (lt === "digital-code")
-        return "digital-code";
-    if (lt === "live")
-        return "live";
-    return "standard";
-}
-/**
- * SB1-G Phase 4 — applies the selected mode by writing the canonical
- * `listingType` discriminator. Nothing else needs to be written for the mode flip.
- */
-function applyMode(product, mode) {
-    const map = {
-        standard: "standard",
-        auction: "auction",
-        preorder: "pre-order",
-        "prize-draw": "prize-draw",
-        classified: "classified",
-        "digital-code": "digital-code",
-        live: "live",
-    };
-    return { ...product, listingType: map[mode] };
-}
+const modeFromProduct = (product) => normalizeListingType(product);
+/** SB1-G Phase 4 — `listingType` is the only listing-kind field on the schema. */
+const applyMode = (product, mode) => ({
+    ...product,
+    listingType: mode,
+});
 async function loadStoreOptions(query, page) {
     const params = new URLSearchParams({ page: String(page), pageSize: "25" });
     if (query)
@@ -115,12 +91,24 @@ const EMPTY_PRODUCT = {
     // SB1-G Phase 4 — listingType is the only listing-kind field on the schema.
     listingType: "standard",
 };
-export function AdminProductEditorView({ productId, onSaved, onDeleted, embedded, enabledListingTypes, initialData, ...rest }) {
+export function AdminProductEditorView({ productId, onSaved, onDeleted, embedded, enabledListingTypes, initialData, initialListingType, ...rest }) {
     const isEdit = Boolean(productId);
-    const [product, setProduct] = React.useState(EMPTY_PRODUCT);
-    const [mode, setMode] = React.useState("standard");
+    const startType = initialListingType ?? "standard";
+    const [product, setProduct] = React.useState(() => applyMode(EMPTY_PRODUCT, startType));
+    const [mode, setMode] = React.useState(startType);
     const [deleteOpen, setDeleteOpen] = React.useState(false);
     const { showToast } = useToast();
+    /*
+     * One tab per listing type, in registry order, labelled by the plugin.
+     *
+     * `enabledListingTypes` narrows it when a caller passes one — but the type
+     * the editor is CURRENTLY on always survives the filter. Without that, an
+     * admin opening an existing listing of a disabled type gets a Tabs component
+     * whose `value` matches no trigger: no tab reads as selected, and the next
+     * save still writes that type back, so the control silently disagrees with
+     * the record it is editing.
+     */
+    const modeTabs = React.useMemo(() => ALL_LISTING_TYPES.filter((t) => !enabledListingTypes || enabledListingTypes.includes(t) || t === mode).map((t) => ({ value: t, label: pluginFor(t).typeLabel })), [enabledListingTypes, mode]);
     const productQuery = useQuery({
         queryKey: ["admin", "product", productId],
         queryFn: async () => {
@@ -198,7 +186,7 @@ export function AdminProductEditorView({ productId, onSaved, onDeleted, embedded
             label: "Listing type",
             required: true,
             fields: ["listingType"],
-            render: () => (_jsx(Stack, { gap: "md", children: _jsxs(Card, { variant: "outlined", padding: "lg", children: [_jsx(Text, { className: __P.sectionLabel, color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Listing Type" }), _jsxs(Tabs, { value: mode, onChange: handleModeChange, children: [_jsxs(TabsList, { children: [(!enabledListingTypes || enabledListingTypes.includes("standard")) && (_jsx(TabsTrigger, { value: "standard", children: "Standard" })), (!enabledListingTypes || enabledListingTypes.includes("auction")) && (_jsx(TabsTrigger, { value: "auction", children: "Auction" })), (!enabledListingTypes || enabledListingTypes.includes("pre-order")) && (_jsx(TabsTrigger, { value: "preorder", children: "Pre-order" })), (!enabledListingTypes || enabledListingTypes.includes("prize-draw")) && (_jsx(TabsTrigger, { value: "prize-draw", children: "Prize Draw" })), (!enabledListingTypes || enabledListingTypes.includes("classified")) && (_jsx(TabsTrigger, { value: "classified", children: "Classified" })), (!enabledListingTypes || enabledListingTypes.includes("digital-code")) && (_jsx(TabsTrigger, { value: "digital-code", children: "Digital Code" })), (!enabledListingTypes || enabledListingTypes.includes("live")) && (_jsx(TabsTrigger, { value: "live", children: "Live Item" }))] }), _jsx(TabsContent, { value: "standard" }), _jsx(TabsContent, { value: "auction" }), _jsx(TabsContent, { value: "preorder" }), _jsx(TabsContent, { value: "prize-draw" }), _jsx(TabsContent, { value: "classified" }), _jsx(TabsContent, { value: "digital-code" }), _jsx(TabsContent, { value: "live" })] })] }) })),
+            render: () => (_jsx(Stack, { gap: "md", children: _jsxs(Card, { variant: "outlined", padding: "lg", children: [_jsx(Text, { className: __P.sectionLabel, color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Listing Type" }), _jsxs(Tabs, { value: mode, onChange: handleModeChange, children: [_jsx(TabsList, { children: modeTabs.map((t) => (_jsx(TabsTrigger, { value: t.value, children: t.label }, t.value))) }), modeTabs.map((t) => (_jsx(TabsContent, { value: t.value }, t.value)))] })] }) })),
         },
         {
             id: "classification",
@@ -239,7 +227,6 @@ export function AdminProductEditorView({ productId, onSaved, onDeleted, embedded
     // Live validation — re-run on every product change, not just on submit.
     React.useEffect(() => {
         validate(product);
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [product, validate]);
     /*
      * ONE submit path. The sidebar button used `form="product-editor-form"` to

package/dist/features/admin/components/AdminProductsView.js

@@ -140,6 +140,16 @@ export function AdminProductsView({ children, ...props }) {
             throw err;
         }
     }, [showToast, overrides]);
+    /*
+     * 🛑 ABOVE the `children` short-circuit, for the same reason as its twin in
+     * `AdminOrdersView`: a hook below a conditional return does not run on every
+     * render, so the hook ORDER differs between the two paths and React reads one
+     * hook's state into another's slot.
+     *
+     * Spans every listing type unless the Type chips narrow it, which is what
+     * makes the middle tab read "Sold & Ended" here rather than one or the other.
+     */
+    const scope = useAvailabilityScope(ALL_LISTING_TYPES);
     if (React.Children.count(children) > 0) {
         return (_jsx(ListingLayout, { portal: "admin", ...props, children: children }));
     }
@@ -151,9 +161,6 @@ export function AdminProductsView({ children, ...props }) {
                     void handleToggle(row.id, key, v);
                 } }, key))) })),
     };
-    // Spans every listing type unless the Type chips narrow it, which is what
-    // makes the middle tab read "Sold & Ended" here rather than one or the other.
-    const scope = useAvailabilityScope(ALL_LISTING_TYPES);
     const config = {
         portal: "admin",
         title: "Products",

package/dist/features/admin/components/AdminScammersView.js

@@ -69,7 +69,7 @@ export function AdminScammersView({ children, ...props }) {
             { value: sortBy("incidentCount", "DESC"), label: "Most incidents" },
         ],
         columns: SCAMMER_COLUMNS,
-        mapRows: (response) => toRecordArray(response.scammers).map((item, index) => ({
+        mapRows: (response) => toRecordArray(response.items).map((item, index) => ({
             id: toStringValue(item.id, `scammer-${index}`),
             primary: Array.isArray(item.displayNames)
                 ? item.displayNames.join(", ")

package/dist/features/admin/components/AdminSectionsView.js

@@ -426,7 +426,6 @@ export function AdminSectionsView({ children }) {
                 setCollectionCardsBuilder(pick(DEFAULT_COLLECTION_CARDS_BUILDER));
                 break;
         }
-        // eslint-disable-next-line react-hooks/exhaustive-deps -- 25 stable setters
     }, []);
     /*
      * Reset to the type's defaults when the admin picks a different type while
@@ -974,10 +973,6 @@ export function AdminSectionsView({ children }) {
     const sectionOrderMap = React.useMemo(() => {
         return new Map(sections.map((section) => [section.id, section.order]));
     }, [sections]);
-    // If children exist, render passthrough mode (detail view)
-    if (hasChildren) {
-        return _jsx(_Fragment, { children: children });
-    }
     // Map sections data to listing rows
     const rows = sections.map((section) => ({
         id: section.id,
@@ -1067,6 +1062,27 @@ export function AdminSectionsView({ children }) {
         onGoToSection: nav.goToSection,
         fieldToSectionIndex: nav.fieldToSectionIndex,
     });
+    /*
+     * Passthrough mode (detail view).
+     *
+     * 🛑 The short-circuit sits HERE, after every hook, rather than ~170 lines
+     * up where it used to. Four hooks had accumulated below it — `modalSections`,
+     * `draft`, `nav`, `form` — so passing children skipped all four and the hook
+     * ORDER changed between the two render paths, which is how React ends up
+     * reading one hook's state out of another's slot. The comment on
+     * `sectionOrderMap` above is the record of this same bug being fixed once
+     * already, one hook at a time.
+     *
+     * Moving the RETURN rather than the hooks is deliberate and costs nothing:
+     * a hook must run on every render either way, so hoisting four declarations
+     * past 170 lines of dependent state would do identical work with far more
+     * room to reorder something by accident. `useFormShellState` claims no
+     * bottom bar — `useFormBottomActions` lives in `SectionForm` — so running it
+     * here has no side effect on the detail view below.
+     */
+    if (hasChildren) {
+        return _jsx(_Fragment, { children: children });
+    }
     return (_jsxs(_Fragment, { children: [_jsxs(Div, { paddingX: "x-sm-md", padding: "y-md", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "3", children: [_jsxs(Div, { children: [_jsx(Text, { size: "base", weight: "semibold", color: "primary", children: "Homepage Sections" }), _jsx(Text, { size: "sm", color: "muted", children: "Manage homepage sections and their display order" })] }), _jsx(Row, { align: "center", gap: "sm", children: _jsx(Button, { type: "button", variant: "primary", size: "sm", onClick: () => setIsModalOpen(true), children: "Manage Sections" }) })] }), errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), _jsx(DataTable, { rows: rows, isLoading: isLoading, emptyLabel: "No sections found" })] }), _jsxs(Stack, { className: `mt-4 ${__P.p4}`, gap: "3", rounded: "xl", surface: "default", border: "default", children: [_jsxs(Row, { align: "center", justify: "between", gap: "3", children: [_jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: "Reorder Sections" }), _jsxs(Row, { align: "center", gap: "sm", children: [_jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: reindexDraft, disabled: reorderSections.isPending || reorderDraft.length === 0, children: "Reindex 1..N" }), _jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: undoReorderChange, disabled: reorderSections.isPending || !canUndoReorderChanges, children: "Undo unsaved" }), _jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: resetToServerOrder, disabled: reorderSections.isPending || !hasReorderChanges, children: "Reset to server" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", onClick: () => reorderSections.mutate(), disabled: !hasReorderChanges || reorderSections.isPending, children: reorderSections.isPending ? "Saving order..." : "Save order" })] })] }), reorderDraft.length === 0 ? (_jsx(Text, { size: "sm", color: "muted", children: "No sections to reorder." })) : (_jsx(Stack, { gap: "sm", children: reorderDraft.map((item, index) => (_jsxs(Div, { layout: "grid", gap: "2", align: "center", className: "grid-cols-[auto_1fr_auto_auto_auto]", rounded: "md", padding: "xs", border: "default", draggable: true, onDragStart: () => setDragIndex(index), onDragOver: (event) => event.preventDefault(), onDrop: () => handleReorderDrop(index), onDragEnd: () => setDragIndex(null), children: [_jsx(Text, { size: "sm", weight: "semibold", color: "muted", children: "\u2261" }), _jsxs(Text, { size: "sm", color: "primary", children: [item.type, " #", item.order] }), _jsx(Input, { type: "number", min: 1, max: reorderDraft.length, value: String(item.order), onChange: (event) => updateReorderItemOrder(index, Number(event.target.value) || 1), className: "w-24" }), _jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: () => moveReorderItem(index, -1), disabled: index === 0, children: "Up" }), _jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: () => moveReorderItem(index, 1), disabled: index === reorderDraft.length - 1, children: "Down" })] }, `reorder-${item.id}`))) }))] }), _jsx(Modal, { isOpen: isModalOpen, onClose: () => setIsModalOpen(false), title: "Manage Homepage Section", size: "lg", children: _jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: modalSections, values: draft, 
                             /*
                              * Each control writes through its own setter — `setMode`,

package/dist/features/admin/components/AdminSessionsView.js

@@ -55,7 +55,7 @@ export function AdminSessionsView({ children, ...props }) {
         // Opening a row is what makes the destructive actions beside it
         // safe to offer at all.
         onRowClick: (row) => setDetail(row),
-        mapRows: (response) => toRecordArray(response.sessions).map((item, index) => {
+        mapRows: (response) => toRecordArray(response.items).map((item, index) => {
             const deviceInfo = (item.deviceInfo ?? {});
             const userLabel = toStringValue(item.user &&
                 item.user?.displayName, toStringValue(item.userId, `user-${index}`));

package/dist/features/admin/components/AdminSublistingCategoriesView.js

@@ -11,7 +11,19 @@ export function AdminSublistingCategoriesView({ onBulkDelete, }) {
     const config = {
         portal: "admin",
         title: "Sub-listing Categories",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        /*
+         * Restored 2026-10-17, same reasoning as `AdminBrandsView`. `itemCode` is
+         * named because it is genuinely in `buildCategorySearchTxt`'s source list —
+         * the store-side sibling route was reaching for exactly that lookup with an
+         * in-memory `.includes()` over one page, which could not find a code that
+         * sorted past the page boundary.
+         */
+        search: {
+            placeholder: "Search by name, item code or description…",
+            mode: "partial",
+            fields: ["name", "itemCode", "description"],
+            commit: "debounce",
+        },
         emptyLabel: "No sub-listing categories found",
         filterKeys: [],
         defaultSort: sortBy("name", "ASC"),
@@ -38,6 +50,15 @@ export function AdminSublistingCategoriesView({ onBulkDelete, }) {
         getTotal: (response, mappedRows) => typeof response.total === "number" ? response.total : mappedRows.length,
         buildFilters: () => undefined,
         rowHrefTemplate: String(ROUTES.ADMIN.SUBLISTING_CATEGORIES_EDIT("{id}")),
+        /*
+         * `/admin/sublisting-categories/new`, its ROUTES key and its POST route all
+         * already existed — the list simply never linked to them, so the page was
+         * reachable only by typing the URL (Root Cause #37's shape).
+         */
+        primaryAction: {
+            label: "Add Sub-listing Category",
+            href: String(ROUTES.ADMIN.SUBLISTING_CATEGORIES_NEW),
+        },
         buildBulkActions: onBulkDelete
             ? (selection) => [
                 buildBulkAction(ACTIONS.ADMIN["delete-sublisting-category"], async () => {

package/dist/features/admin/components/AdminTeamView.js

@@ -78,7 +78,7 @@ export function AdminTeamView({ children, onBulkRemove, ...props }) {
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
             { value: "displayName", label: "Name A–Z" },
         ],
-        mapRows: (response) => toRecordArray(response.users).map((item, index) => ({
+        mapRows: (response) => toRecordArray(response.items).map((item, index) => ({
             id: toStringValue(item.id ?? item.uid, `employee-${index}`),
             primary: toStringValue(item.displayName, "Unnamed employee"),
             secondary: [

package/dist/features/admin/components/AdminTesterChecklistItemEditorView.js

@@ -71,7 +71,6 @@ export function AdminTesterChecklistItemEditorView({ itemId, onSaved, onDeleted,
             isActive: item.isActive ?? true,
             adminOnly: item.adminOnly ?? false,
         });
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [itemQuery.data]);
     const saveMutation = useApiMutation({
         errorMessage: "Failed to save checklist item.",

package/dist/features/admin/components/AdminUsersView.js

@@ -120,7 +120,7 @@ export function AdminUsersView({ children, ...props }) {
             { value: sortBy("createdAt", "ASC"), label: "Oldest" },
             { value: "displayName", label: "Name A–Z" },
         ],
-        mapRows: (response) => toRecordArray(response.users).map((item, index) => {
+        mapRows: (response) => toRecordArray(response.items).map((item, index) => {
             const isDisabled = Boolean(item.isDisabled ?? item.disabled);
             const isHardBanned = isDisabled && Boolean(item.hardBanReason);
             const softBanCount = Array.isArray(item.softBans) ? item.softBans.length : 0;

package/dist/features/admin/components/DataListingView.d.ts

@@ -136,9 +136,10 @@ export interface ListingViewConfig<TResponse, TRow extends {
     renderCards?: (rows: TRow[], view: "grid" | "list", selection: ListingSelectionContext<TRow>, isLoading: boolean) => React.ReactNode;
     primaryAction?: {
         label: string;
-        onClick: (panel: {
+        onClick?: (panel: {
             openCreatePanel: () => void;
         }) => void;
+        href?: string;
         icon?: React.ReactNode;
     };
     /** Extra arbitrary content in the toolbar (e.g. export buttons). Rendered alongside primaryAction. */

package/dist/features/admin/components/DataListingView.js

@@ -1,7 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Plus } from "lucide-react";
-import { BulkActionBar, Button, Div, ListingFilterDrawer, ListingToolbar, Pagination, Row, SideDrawer, StickyToolbar } from "../../../ui/index.js";
+import { BulkActionBar, Button, Div, ListingFilterDrawer, ListingToolbar, Pagination, Row, SideDrawer, StickyToolbar, TextLink } from "../../../ui/index.js";
 import { useBottomActions } from "../../layout/index.js";
 import { useAdminListing } from "../hooks/useAdminListing.js";
 import { getResourceIcon } from "../../../ui/columns/column-renderers.js";
@@ -91,9 +91,14 @@ export function DataListingView({ config, }) {
                 // Passing this is what renders the box — ListingToolbar gates on it.
                 // Undefined when the config declares no search, so a view whose
                 // endpoint cannot search no longer shows an input that does nothing.
-                onSearchChange: searchEnabled ? setSearchInput : undefined, onSearchCommit: searchEnabled ? commitSearch : undefined, sortValue: table.get("sort") || config.defaultSort, sortOptions: config.sortOptions, onSortChange: (v) => table.set("sort", v), showTableView: !config.hideTableView, toggles: config.toggles, view: view, onViewChange: (v) => setView(v), onResetAll: resetAll, hasActiveState: hasActiveState, extra: config.primaryAction || config.toolbarExtra ? (_jsxs(Row, { align: "center", gap: "sm", children: [config.toolbarExtra, config.primaryAction && (_jsxs(Button, { gap: "sm", size: "sm", onClick: () => config.primaryAction.onClick({
-                                openCreatePanel: panel.openCreatePanel,
-                            }), children: [config.primaryAction.icon ?? _jsx(Plus, { className: "h-4 w-4" }), config.primaryAction.label] }))] })) : undefined }), config.renderAboveContent?.(), bulkActionItems && (_jsx(BulkActionBar, { selectedCount: selection.selectedCount, onClearSelection: selection.clearSelection, actions: bulkActionItems })), totalPages > 1 && (_jsx(StickyToolbar, { offset: "header+pagination", tone: "translucent", border: true, padding: "toolbar", children: _jsx(Row, { justify: "center", children: _jsx(Pagination, { currentPage: currentPage, totalPages: totalPages, onPageChange: (p) => table.setPage(p), pageSize: pageSize, onPageSizeChange: setPageSize, paginationConfig: { showPageSizeSelector: true, pageSizeOptions: [10, 25, 50, 100] } }) }) })), _jsxs(Div, { paddingX: "x-sm-md", padding: "y-md", children: [errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), view === "table" && !config.hideTableView && !isMobile ? (_jsx(DataTable, { columns: config.columns, rows: rows, resourceIcon: resourceIcon, isLoading: isLoading, emptyLabel: config.emptyLabel ?? `No ${config.title.toLowerCase()} found`, selectedIds: selection.selectedIdSet, onToggleSelect: selection.toggle, onToggleSelectAll: (next) => next
+                onSearchChange: searchEnabled ? setSearchInput : undefined, onSearchCommit: searchEnabled ? commitSearch : undefined, sortValue: table.get("sort") || config.defaultSort, sortOptions: config.sortOptions, onSortChange: (v) => table.set("sort", v), showTableView: !config.hideTableView, toggles: config.toggles, view: view, onViewChange: (v) => setView(v), onResetAll: resetAll, hasActiveState: hasActiveState, extra: config.primaryAction || config.toolbarExtra ? (_jsxs(Row, { align: "center", gap: "sm", children: [config.toolbarExtra, config.primaryAction &&
+                            (config.primaryAction.href ? (
+                            // `asChild` so the create PAGE is a real anchor — middle-click
+                            // and copy-link work, and it is not a button that happens to
+                            // navigate (a Known-TS-Pattern this repo bans outright).
+                            _jsx(Button, { gap: "sm", size: "sm", asChild: true, children: _jsxs(TextLink, { variant: "inherit", href: config.primaryAction.href, children: [config.primaryAction.icon ?? _jsx(Plus, { className: "h-4 w-4" }), config.primaryAction.label] }) })) : (_jsxs(Button, { gap: "sm", size: "sm", onClick: () => config.primaryAction.onClick?.({
+                                    openCreatePanel: panel.openCreatePanel,
+                                }), children: [config.primaryAction.icon ?? _jsx(Plus, { className: "h-4 w-4" }), config.primaryAction.label] })))] })) : undefined }), config.renderAboveContent?.(), bulkActionItems && (_jsx(BulkActionBar, { selectedCount: selection.selectedCount, onClearSelection: selection.clearSelection, actions: bulkActionItems })), totalPages > 1 && (_jsx(StickyToolbar, { offset: "header+pagination", tone: "translucent", border: true, padding: "toolbar", children: _jsx(Row, { justify: "center", children: _jsx(Pagination, { currentPage: currentPage, totalPages: totalPages, onPageChange: (p) => table.setPage(p), pageSize: pageSize, onPageSizeChange: setPageSize, paginationConfig: { showPageSizeSelector: true, pageSizeOptions: [10, 25, 50, 100] } }) }) })), _jsxs(Div, { paddingX: "x-sm-md", padding: "y-md", children: [errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), view === "table" && !config.hideTableView && !isMobile ? (_jsx(DataTable, { columns: config.columns, rows: rows, resourceIcon: resourceIcon, isLoading: isLoading, emptyLabel: config.emptyLabel ?? `No ${config.title.toLowerCase()} found`, selectedIds: selection.selectedIdSet, onToggleSelect: selection.toggle, onToggleSelectAll: (next) => next
                             ? selection.setSelectedIds(rows.map((r) => r.id))
                             : selection.clearSelection(), rowHrefTemplate: config.rowHrefTemplate, onRowClick: config.onRowClick
                             ? (row) => config.onRowClick(row, {

package/dist/features/admin/components/analytics/AdminPageViewsReportView.js

@@ -8,11 +8,9 @@ import { ADMIN_ENDPOINTS } from "../../../../constants/api-endpoints.js";
 import { PAGE_VIEW_ENTITY_TYPES } from "../../../analytics/types.js";
 const ENTITY_TYPE_OPTIONS = PAGE_VIEW_ENTITY_TYPES.map((t) => ({ value: t, label: t }));
 function today() {
-    // eslint-disable-next-line lir/no-raw-date
     return new Date().toISOString().slice(0, 10);
 }
 function daysAgo(n) {
-    // eslint-disable-next-line lir/no-raw-date
     const d = new Date();
     d.setDate(d.getDate() - n);
     return d.toISOString().slice(0, 10);

package/dist/features/admin/hooks/useAdminListing.d.ts

@@ -69,7 +69,7 @@ export declare function useAdminListing<TResponse, TRow extends {
     refetch: () => void;
     currentPage: number;
     totalPages: number;
-    selection: import("../../../client").UseBulkSelectionReturn;
+    selection: import("../../../react").UseBulkSelectionReturn;
     defaultSort: string;
     pageSize: number;
     setPageSize: (next: number) => void;

package/dist/features/admin/repository/site-settings.repository.js

@@ -6,7 +6,14 @@ import { serverLogger } from "../../../monitoring/server-logger.js";
  * Manages site-wide configuration settings (singleton document)
  */
 import { BaseRepository, prepareForFirestore, } from "../../../providers/db-firebase/index.js";
-import { cacheManager } from "../../../core/index.js";
+/*
+ * The DEFINING module, not the `core` barrel — Root Cause #18. `core/index.ts`
+ * re-exports `unitOfWork`, which imports this very repository, so reaching
+ * `cacheManager` through the barrel closed a six-module import cycle
+ * (`audit-import-cycles` component 2). `CacheManager.ts` imports nothing from
+ * here, so the deep path has one direction only.
+ */
+import { cacheManager } from "../../../core/CacheManager.js";
 import { SITE_SETTINGS_COLLECTION, DEFAULT_SITE_SETTINGS_DATA, } from "../schemas/index.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { decryptSecret, encryptSecret, maskSecret } from "../../../security/index.js";
@@ -73,13 +80,11 @@ export class SiteSettingsRepository extends BaseRepository {
         const encrypted = { ...existing };
         for (const [key, value] of Object.entries(updates)) {
             if (typeof value === "string" && value.trim()) {
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
                 encrypted[key] = encryptSecret(value.trim());
             }
             else if (value !== undefined && typeof value !== "string") {
                 // Non-string credential fields (e.g. whatsappTemplates: Record<string,string>)
                 // are stored as-is — they are not secret values to encrypt.
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
                 encrypted[key] = value;
             }
             // Empty / undefined → keep whatever was already stored

package/dist/features/admin/schemas/firestore.d.ts

@@ -14,7 +14,7 @@ export type NotificationType = (typeof NOTIFICATION_TYPE_VALUES)[number];
  * Runtime array for the same reason as the type union above — and
  * `catalogueItem` was being sent with an `as never` cast rather than added.
  */
-export declare const NOTIFICATION_RELATED_TYPE_VALUES: readonly ["order", "product", "bid", "review", "blog", "user", "offer", "support_ticket", "scammer", "catalogueItem", "payout", "store", "conversation"];
+export declare const NOTIFICATION_RELATED_TYPE_VALUES: readonly ["order", "product", "bid", "review", "blog", "user", "offer", "support_ticket", "scammer", "catalogueItem", "payout", "store", "conversation", "event"];
 export type NotificationRelatedType = (typeof NOTIFICATION_RELATED_TYPE_VALUES)[number];
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 export type NotificationPriority = "low" | "normal" | "high";
@@ -525,6 +525,46 @@ export interface SiteSettingsDocument extends BaseDocument {
     chat?: {
         enabled: boolean;
     };
+    /**
+     * The public search index — the browser-side artifact, not the per-listing
+     * search boxes, which this flag cannot reach.
+     *
+     * ## 🛑 Why a group of its own and not `featureFlags`
+     *
+     * The plan for this feature said "a kill switch in `siteSettings.featureFlags`".
+     * That group was DELETED on 2026-08-29 because 11 of its 14 keys had zero
+     * readers, and the two survivors moved into `payment` as real settings. Its
+     * deletion note draws the line this honours: *"A flag is a temporary switch
+     * around unfinished work."* This is exactly that — so it is a flag, and it
+     * earns the one thing the deleted keys could not show: a named reader
+     * (`useSearchIndex`).
+     *
+     * 🛑 It is NOT in `payment` or any other existing group, and that is
+     * defensive rather than tidy. `AdminSiteSettingsView.buildFullPayload`
+     * writes `payment: { phonepeEnabled, upiManualEnabled, codEnabled,
+     * otpCheckoutThreshold }` — the WHOLE group, from four pieces of form
+     * state — so any fifth key in there is silently erased the next time an
+     * admin saves anything on that page (Root Cause #76). A kill switch that a
+     * routine save turns back on is worse than none, because it fails in the
+     * direction of the thing it exists to stop.
+     *
+     * ## 🛑 Default ON — the opposite polarity to `chat.enabled`
+     *
+     * `chat` is an opt-in feature and its readers test `=== true`. This is a
+     * kill switch on the primary path, so its reader tests `!== false`: an
+     * absent field, an unseeded document and a failed settings fetch must all
+     * mean "search works". The only state that disables it is somebody
+     * deliberately writing `false`.
+     *
+     * Recovery exists because the index can be wrong in a way nothing errors
+     * on — a bad patch, a schema the client does not understand — and the
+     * alternative route back is a Vercel deploy. Flipping this sends every
+     * client to the server `SEARCH_SOURCES` path, which is why that path is
+     * kept rather than deleted.
+     */
+    search?: {
+        indexEnabled?: boolean;
+    };
     emailSettings: {
         fromName: string;
         fromEmail: string;
@@ -756,6 +796,27 @@ export declare const SITE_SETTINGS_INDEXED_FIELDS: readonly [];
  */
 export declare const DEFAULT_SITE_SETTINGS_THEME: SiteSettingsTheme;
 export declare const DEFAULT_SITE_SETTINGS_DATA: Partial<SiteSettingsDocument>;
+/**
+ * 🛑 DEAD, AND IT DISAGREES WITH THE REAL PROJECTION. Do not add to it.
+ *
+ * Measured 2026-10-19 while adding `search`: this constant has **zero
+ * consumers** — it is re-exported from the barrel and read by nothing. The
+ * list that actually decides what leaves the server is
+ * `PUBLIC_SITE_SETTINGS_FIELDS` in
+ * `_internal/server/features/site-settings/adapters.ts`, which is audited by
+ * `audit-public-projection-parity`.
+ *
+ * The two already disagree, in the dangerous direction: this one names
+ * `commissions` (the real projection marks it PRIVATE — "internal economics")
+ * and `featureFlags`, a settings group DELETED in 2026-08-29. So anyone who
+ * reached for it as authoritative would publish platform fee structure and
+ * key a feature off a group that no longer exists.
+ *
+ * Left in place rather than deleted here only because removing a barrel
+ * export is a breaking change that needs its own version bump; it belongs
+ * with the other search-subsystem deletions. Adding a field to it would make
+ * it look maintained, which is the one thing it must not look.
+ */
 export declare const SITE_SETTINGS_PUBLIC_FIELDS: readonly ["siteName", "motto", "logo", "background", "contact.email", "contact.phone", "payment", "commissions", "socialLinks", "seo", "features", "featureFlags", "faq.variables", "announcementBar"];
 export type SiteSettingsUpdateInput = Partial<Omit<SiteSettingsDocument, "id" | "createdAt" | "updatedAt">>;
 export declare const DEFAULT_TRUST_BAR_ITEMS: TrustBarItem[];

package/dist/features/admin/schemas/firestore.js

@@ -114,6 +114,17 @@ export const NOTIFICATION_RELATED_TYPE_VALUES = [
     "store",
     // D9 — the chat thread the message belongs to.
     "conversation",
+    /*
+     * The event a raffle win belongs to. Added 2026-10-19 with the raffle-winner
+     * notification: `runTriggerEventRaffle` recorded a winner and told nobody,
+     * so the only way to learn you had won was to revisit the event page.
+     *
+     * Declared here rather than sent behind an `as never` — see the note above
+     * this array about `catalogueItem`, and the exhaustiveness check in
+     * `resolveNotificationActionUrl` that makes the destination a compile-time
+     * question.
+     */
+    "event",
 ];
 export const NOTIFICATIONS_COLLECTION = "notifications";
 export const NOTIFICATIONS_INDEXED_FIELDS = [
@@ -337,6 +348,27 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
     navConfig: {},
     disabledRoutes: [],
 };
+/**
+ * 🛑 DEAD, AND IT DISAGREES WITH THE REAL PROJECTION. Do not add to it.
+ *
+ * Measured 2026-10-19 while adding `search`: this constant has **zero
+ * consumers** — it is re-exported from the barrel and read by nothing. The
+ * list that actually decides what leaves the server is
+ * `PUBLIC_SITE_SETTINGS_FIELDS` in
+ * `_internal/server/features/site-settings/adapters.ts`, which is audited by
+ * `audit-public-projection-parity`.
+ *
+ * The two already disagree, in the dangerous direction: this one names
+ * `commissions` (the real projection marks it PRIVATE — "internal economics")
+ * and `featureFlags`, a settings group DELETED in 2026-08-29. So anyone who
+ * reached for it as authoritative would publish platform fee structure and
+ * key a feature off a group that no longer exists.
+ *
+ * Left in place rather than deleted here only because removing a barrel
+ * export is a breaking change that needs its own version bump; it belongs
+ * with the other search-subsystem deletions. Adding a field to it would make
+ * it look maintained, which is the one thing it must not look.
+ */
 export const SITE_SETTINGS_PUBLIC_FIELDS = [
     "siteName",
     "motto",

package/dist/features/admin/types/index.d.ts

@@ -23,7 +23,7 @@ export interface DashboardStats {
 export interface AdminListParams {
     q?: string;
     page?: number;
-    perPage?: number;
+    pageSize?: number;
     sort?: string;
     filters?: string;
 }

package/dist/features/auctions/actions/bid-actions.d.ts

@@ -1,4 +1,4 @@
-import type { BidDocument } from "../schemas";
+import type { BidDocument, BidPlain } from "../schemas";
 import type { FirebaseSieveResult } from "../../../providers/db-firebase";
 export interface PlaceBidInput {
     productId: string;
@@ -6,7 +6,7 @@ export interface PlaceBidInput {
     autoMaxBid?: number;
 }
 export interface PlaceBidResult {
-    bid: BidDocument;
+    bid: BidPlain;
 }
 export declare function placeBid(userId: string, userEmail: string, input: PlaceBidInput): Promise<PlaceBidResult>;
 export interface BuyNowAuctionInput {

package/dist/features/auctions/actions/bid-actions.js

@@ -150,12 +150,18 @@ export async function placeBid(userId, userEmail, input) {
         visibleBid = newCap;
         bumpedPreviousVisible = Math.min(prevCap, target);
     }
-    const bid = await bidRepository.create({
+    const bid = await bidRepository.createBid({
         productId,
         productTitle: product.title,
         userId,
         userName: profile?.displayName ?? userEmail ?? "Anonymous",
-        userEmail: profile?.email ?? userEmail ?? "",
+        /*
+         * 🛑 Revealed, not passed through. `profile` comes from a user read, which
+         * is ciphertext-by-default now — and `createBid` ENCRYPTS what it is given,
+         * so the raw value would be encrypted a SECOND time and become
+         * undecryptable. The `userEmail` parameter is already plaintext.
+         */
+        userEmail: (profile ? userRepository.revealUser(profile).email : null) ?? userEmail ?? "",
         bidAmount: visibleBid,
         currency: product.currency || getDefaultCurrency(),
         bidDate: new Date(),
@@ -333,12 +339,18 @@ export async function buyNowAuction(userId, userName, userEmail, input) {
     // buyout price by the buyer" means. It starts `active`/`isWinning: false`
     // like any other bid (bidRepository.create forces both) and is promoted to
     // `won` by claimAuctionForCheckout when the order actually lands.
-    const bid = await bidRepository.create({
+    const bid = await bidRepository.createBid({
         productId,
         productTitle: product.title,
         userId,
         userName: profile?.displayName ?? userName ?? userEmail ?? "Anonymous",
-        userEmail: profile?.email ?? userEmail ?? "",
+        /*
+         * 🛑 Revealed, not passed through. `profile` comes from a user read, which
+         * is ciphertext-by-default now — and `createBid` ENCRYPTS what it is given,
+         * so the raw value would be encrypted a SECOND time and become
+         * undecryptable. The `userEmail` parameter is already plaintext.
+         */
+        userEmail: (profile ? userRepository.revealUser(profile).email : null) ?? userEmail ?? "",
         bidAmount: buyNowPrice,
         currency,
         bidDate: new Date(),

package/dist/features/auctions/api/route.js

@@ -50,7 +50,7 @@ export async function GET(request) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const body = {
             items: result.data,

package/dist/features/auctions/components/AuctionBottomActions.js

@@ -80,6 +80,10 @@ export function AuctionBottomActions(props) {
                 ? `${formatCurrency(currentBid, currency)} · ${bidCount} bid${bidCount !== 1 ? "s" : ""}`
                 : `Sign in to see the bid · ${bidCount} bid${bidCount !== 1 ? "s" : ""}`,
             desktop: "after-scroll",
+            // The inline bid panel on the detail page. The dock stays shut until
+            // a bidder has actually seen it and scrolled past — beside it, the
+            // dock would just be a second "Place bid" button.
+            ctaAnchorId: "auction-bid-form",
         });
     return (_jsx(Modal, { isOpen: open, onClose: () => setOpen(false), size: "md", title: "Place your bid", children: _jsx(PlaceBidFormClient, { ...props }) }));
 }