@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/ui/index.d.ts

@@ -16,6 +16,8 @@ export type { SectionProps, SectionBackgroundConfig, ArticleProps, MainProps, As
 export { Section, sectionBackgroundStyle, Article, Main, Aside, Nav, BlockHeader, BlockFooter, Ul, Ol, Li, Table, Thead, Tbody, Tr, Th, Td, Code, Pre, Blockquote, Figure, Figcaption, Dl, Dt, Dd, } from "./components/Semantic";
 export type { DivProps } from "./components/Div";
 export { Div } from "./components/Div";
+export type { SpecTableProps, SpecTableRow } from "./components/SpecTable";
+export { SpecTable } from "./components/SpecTable";
 export type { ColorVariant } from "./components/Typography";
 export { Heading, Text, Label, Caption, Span } from "./components/Typography";
 export { FilterChipGroup } from "./components/FilterChipGroup";
@@ -167,6 +169,8 @@ export type { TabsProps, TabsListProps, TabsTriggerProps, TabsContentProps, } fr
 export { Tabs, TabsList, TabsTrigger, TabsContent } from "./components/Tabs";
 export type { TabBarShellProps, TabBarButtonProps, TabsNavSelectProps, } from "./components/TabBarShell";
 export { TabBarShell, TabBarButton, TabsNavSelect } from "./components/TabBarShell";
+export type { OverflowRowProps, OverflowRowItem, OverflowRowDotTone, OverflowRowLinkProps, } from "./components/OverflowRow";
+export { OverflowRow } from "./components/OverflowRow";
 export type { FilterDrawerProps } from "./components/FilterDrawer";
 export { FilterDrawer } from "./components/FilterDrawer";
 export type { RowAction, RowActionMenuProps } from "./components/RowActionMenu";
@@ -241,6 +245,8 @@ export { Scrim } from "./components/Scrim";
 export type { ScrimProps, ScrimDirection, ScrimIntensity } from "./components/Scrim";
 export { Kbd } from "./components/Kbd";
 export type { KbdProps, KbdSize, KbdTone } from "./components/Kbd";
+export { PendingValue } from "./components/PendingValue";
+export type { PendingValueProps } from "./components/PendingValue";
 export { StickyToolbar } from "./components/StickyToolbar";
 export type { StickyToolbarProps, StickyToolbarOffset, StickyToolbarTone, StickyToolbarPadding, } from "./components/StickyToolbar";
 export { Show, Hide } from "./components/Responsive";

package/dist/ui/index.js

@@ -30,6 +30,7 @@ export { FormErrorSummary } from "./forms/index.js";
 export { buildColumns, createColumnBuilder, renderBoolean, renderCurrency, renderCurrencyCompact, renderCount, renderNullable, renderRating, getStatusTone, getResourceIcon, } from "./columns/index.js";
 export { Section, sectionBackgroundStyle, Article, Main, Aside, Nav, BlockHeader, BlockFooter, Ul, Ol, Li, Table, Thead, Tbody, Tr, Th, Td, Code, Pre, Blockquote, Figure, Figcaption, Dl, Dt, Dd, } from "./components/Semantic.js";
 export { Div } from "./components/Div.js";
+export { SpecTable } from "./components/SpecTable.js";
 export { Heading, Text, Label, Caption, Span } from "./components/Typography.js";
 // --- Filter chip group (SB10-C completion, S8 2026-05-13) --------------------
 export { FilterChipGroup } from "./components/FilterChipGroup.js";
@@ -115,6 +116,7 @@ export { SkipToMain } from "./components/SkipToMain.js";
 export { NavigationLoader } from "./components/NavigationLoader.js";
 export { Tabs, TabsList, TabsTrigger, TabsContent } from "./components/Tabs.js";
 export { TabBarShell, TabBarButton, TabsNavSelect } from "./components/TabBarShell.js";
+export { OverflowRow } from "./components/OverflowRow.js";
 export { FilterDrawer } from "./components/FilterDrawer.js";
 export { RowActionMenu } from "./components/RowActionMenu.js";
 export { PasswordStrengthIndicator } from "./components/PasswordStrengthIndicator.js";
@@ -155,6 +157,7 @@ export { HorizontalRule } from "./components/HorizontalRule.js";
 export { Anchor } from "./components/Anchor.js";
 export { Scrim } from "./components/Scrim.js";
 export { Kbd } from "./components/Kbd.js";
+export { PendingValue } from "./components/PendingValue.js";
 export { StickyToolbar } from "./components/StickyToolbar.js";
 export { Show, Hide } from "./components/Responsive.js";
 export { CollapsibleSection } from "./components/CollapsibleSection.js";

package/dist/utils/array.helper.d.ts

@@ -8,10 +8,10 @@ export declare function unique<T>(array: T[]): T[];
 export declare function uniqueBy<T>(array: T[], key: keyof T): T[];
 export declare function sortBy<T>(array: T[], key: keyof T, order?: "asc" | "desc"): T[];
 export declare function chunk<T>(array: T[], size: number): T[][];
-export declare function paginate<T>(array: T[], page: number, perPage: number): {
+export declare function paginate<T>(array: T[], page: number, pageSize: number): {
     data: T[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
 };

package/dist/utils/array.helper.js

@@ -44,10 +44,10 @@ export function chunk(array, size) {
     }
     return chunks;
 }
-export function paginate(array, page, perPage) {
+export function paginate(array, page, pageSize) {
     const total = array.length;
-    const totalPages = Math.ceil(total / perPage);
-    const start = (page - 1) * perPage;
-    const end = start + perPage;
-    return { data: array.slice(start, end), total, page, perPage, totalPages };
+    const totalPages = Math.ceil(total / pageSize);
+    const start = (page - 1) * pageSize;
+    const end = start + pageSize;
+    return { data: array.slice(start, end), total, page, pageSize, totalPages };
 }

package/dist/utils/id-generators.d.ts

@@ -103,6 +103,12 @@ export interface GenerateShipmentIdInput {
     customId?: string;
 }
 export declare function generateShipmentId(input: GenerateShipmentIdInput): string;
+export interface GenerateStickerSheetIdInput {
+    title: string;
+    date?: Date;
+    customId?: string;
+}
+export declare function generateStickerSheetId(input: GenerateStickerSheetIdInput): string;
 export interface GenerateCatalogueItemIdInput {
     ownerSlug: string;
     title: string;

package/dist/utils/id-generators.js

@@ -134,6 +134,16 @@ export function generateShipmentId(input) {
     const d = String(date.getDate()).padStart(2, "0");
     return `shipment-${supplierSlug}-${y}${m}${d}-${generateRandomString(6)}`;
 }
+export function generateStickerSheetId(input) {
+    if (input.customId?.trim())
+        return input.customId.trim();
+    const titleSlug = slugify(input.title).substring(0, 40).replace(/-+$/, "");
+    const date = input.date || new Date();
+    const y = date.getFullYear();
+    const m = String(date.getMonth() + 1).padStart(2, "0");
+    const d = String(date.getDate()).padStart(2, "0");
+    return `stickersheet-${titleSlug}-${y}${m}${d}-${generateRandomString(6)}`;
+}
 export function generateCatalogueItemId(input) {
     if (input.customId?.trim())
         return input.customId.trim();

package/dist/utils/media-url.js

@@ -203,7 +203,6 @@ export function isStoredMediaRef(value) {
      * is the obvious candidate) and that is a separate fix at the call site.
      */
     if (typeof value !== "string") {
-        // eslint-disable-next-line no-console -- client-side; the server path has its own recorder
         console.warn("[isStoredMediaRef] expected a string, received", Object.prototype.toString.call(value));
         return false;
     }
@@ -263,7 +262,6 @@ export function resolveMediaUrl(url, opts) {
      * crashing. The warn names the shape so the real caller stays findable.
      */
     if (typeof url !== "string") {
-        // eslint-disable-next-line no-console -- render path; a throw here kills the subtree
         console.warn("[resolveMediaUrl] expected a string, received", Object.prototype.toString.call(url));
         return undefined;
     }

package/dist/utils/search-txt-builders.d.ts

@@ -6,6 +6,7 @@ import type { EventDocument } from "../features/events/schemas/firestore";
 import type { BlogPostDocument } from "../features/blog/schemas/firestore";
 import type { ReviewDocument } from "../features/reviews/schemas/firestore";
 import type { OrderDocument } from "../features/orders/schemas/firestore";
+import type { BidDocument } from "../features/auctions/schemas/firestore";
 import type { CouponDocument } from "../features/promotions/schemas/firestore";
 import type { OfferDocument } from "../features/seller/schemas/firestore";
 /** products — title, description, brand, taxonomy, condition, card/grading, specs. */
@@ -43,8 +44,16 @@ export declare function buildEventSearchTxt(e: Partial<EventDocument>): string[]
  * error anywhere. The excerpt is the searchable summary.
  */
 export declare function buildBlogSearchTxt(b: Partial<BlogPostDocument>): string[];
-/** reviews — title, comment, productTitle. `userName` is PII and excluded. */
-export declare function buildReviewSearchTxt(r: Partial<ReviewDocument>): string[];
+/**
+ * reviews — title, comment, productTitle. `userName` is PII and excluded.
+ *
+ * Typed to the three fields it READS, like the offer builder. The exclusion of
+ * `userName` is the privacy property this depends on, and naming only the
+ * non-PII fields in the signature is what proves it — and what lets the
+ * function take the ciphertext document and the plaintext seed shape alike
+ * without a cast.
+ */
+export declare function buildReviewSearchTxt(r: Partial<Pick<ReviewDocument, "title" | "comment" | "productTitle">>): string[];
 /**
  * orders — what an admin or seller actually looks an order up BY: the product,
  * the store, the tracking number.
@@ -54,7 +63,7 @@ export declare function buildReviewSearchTxt(r: Partial<ReviewDocument>): string
  * is an address, and a searchTxt for an address IS that address re-encoded.
  * Indexing any of them would undo the encryption they are stored under (D1).
  */
-export declare function buildOrderSearchTxt(o: Partial<OrderDocument>): string[];
+export declare function buildOrderSearchTxt(o: Partial<Pick<OrderDocument, "productTitle" | "storeName" | "trackingNumber" | "items" | "physicalLocation">>): string[];
 /** coupons — code, name, description. Nothing here is PII. */
 export declare function buildCouponSearchTxt(c: Partial<CouponDocument>): string[];
 /**
@@ -65,7 +74,7 @@ export declare function buildCouponSearchTxt(c: Partial<CouponDocument>): string
  * the PII registry, but it is private correspondence and has no business being
  * findable by substring from an admin list.
  */
-export declare function buildOfferSearchTxt(o: Partial<OfferDocument>): string[];
+export declare function buildOfferSearchTxt(o: Partial<Pick<OfferDocument, "productTitle" | "productSlug" | "storeName">>): string[];
 /**
  * The scam registry's identity fields are stored PLAINTEXT on purpose — a
  * victim googles a UPI ID before paying, so SEO is the feature (see the field
@@ -78,3 +87,18 @@ export declare function buildOfferSearchTxt(o: Partial<OfferDocument>): string[]
  * long report crowd out every identity token in the same document.
  */
 export declare function buildScammerSearchTxt(s: Partial<ScammerDocument>): string[];
+/**
+ * bids — what a buyer or a seller actually looks a bid up BY.
+ *
+ * `productTitle` is what a buyer searching their own bids means ("which
+ * auction was that?"); `userName` is what a seller scanning bids on their
+ * listing means ("has Ravi bid?").
+ *
+ * 🛑 `userEmail` is ABSENT. It is the single entry in `BID_PII_FIELDS`, and a
+ * plaintext token index over an encrypted field IS that field in the clear
+ * (decision D1) — the same reason `buildOrderSearchTxt` omits `userName`,
+ * `userEmail` and `sellerEmail` there. `userName` differs here only because
+ * bids do not register it as PII and it already ships in `BID_PUBLIC_FIELDS`,
+ * so indexing it discloses nothing the public bid history does not.
+ */
+export declare function buildBidSearchTxt(b: Partial<BidDocument>): string[];

package/dist/utils/search-txt-builders.js

@@ -189,7 +189,15 @@ export function buildBlogSearchTxt(b) {
         b.tags ?? [],
     ]);
 }
-/** reviews — title, comment, productTitle. `userName` is PII and excluded. */
+/**
+ * reviews — title, comment, productTitle. `userName` is PII and excluded.
+ *
+ * Typed to the three fields it READS, like the offer builder. The exclusion of
+ * `userName` is the privacy property this depends on, and naming only the
+ * non-PII fields in the signature is what proves it — and what lets the
+ * function take the ciphertext document and the plaintext seed shape alike
+ * without a cast.
+ */
 export function buildReviewSearchTxt(r) {
     return buildSearchTxt([r.title, stripHtml(r.comment), r.productTitle]);
 }
@@ -202,6 +210,13 @@ export function buildReviewSearchTxt(r) {
  * is an address, and a searchTxt for an address IS that address re-encoded.
  * Indexing any of them would undo the encryption they are stored under (D1).
  */
+/*
+ * Typed to the five fields it READS, all non-PII — the same treatment as the
+ * offer and review builders. `userName`, `userEmail` and `sellerEmail` are
+ * deliberately absent (D1), and naming only the non-PII fields in the
+ * signature both proves that and lets this accept the ciphertext document and
+ * the plaintext seed shape without a cast.
+ */
 export function buildOrderSearchTxt(o) {
     return buildSearchTxt([
         o.productTitle,
@@ -231,6 +246,14 @@ export function buildCouponSearchTxt(c) {
  * the PII registry, but it is private correspondence and has no business being
  * findable by substring from an admin list.
  */
+/*
+ * Typed to the three fields it READS, not to the whole document.
+ *
+ * All three are non-PII, which is the privacy property this builder depends
+ * on — and stating it in the signature is what makes the function accept the
+ * ciphertext document and the plaintext seed shape alike without a cast.
+ * `buyerName`/`buyerEmail` are deliberately absent; see the note above.
+ */
 export function buildOfferSearchTxt(o) {
     return buildSearchTxt([o.productTitle, o.productSlug, o.storeName]);
 }
@@ -254,3 +277,20 @@ export function buildScammerSearchTxt(s) {
         s.scamType,
     ]);
 }
+/**
+ * bids — what a buyer or a seller actually looks a bid up BY.
+ *
+ * `productTitle` is what a buyer searching their own bids means ("which
+ * auction was that?"); `userName` is what a seller scanning bids on their
+ * listing means ("has Ravi bid?").
+ *
+ * 🛑 `userEmail` is ABSENT. It is the single entry in `BID_PII_FIELDS`, and a
+ * plaintext token index over an encrypted field IS that field in the clear
+ * (decision D1) — the same reason `buildOrderSearchTxt` omits `userName`,
+ * `userEmail` and `sellerEmail` there. `userName` differs here only because
+ * bids do not register it as PII and it already ships in `BID_PUBLIC_FIELDS`,
+ * so indexing it discloses nothing the public bid history does not.
+ */
+export function buildBidSearchTxt(b) {
+    return buildSearchTxt([b.productTitle, b.userName]);
+}

package/dist/utils/search-txt-query.d.ts

@@ -87,6 +87,18 @@ export interface SearchWindowModel {
  *
  * `refineSearchTxt` grew a real-pagination mode, and `products` was the only
  * caller converted — deliberately, so the other eleven stayed byte-identical.
+ *
+ * 🛑 That sentence is now HISTORY, not status. Measured 2026-10-19: ELEVEN
+ * repositories use `beginSearchWindow`, and `audit-listing-search-intact`
+ * (C6) enforces all three parts of the conversion on each of them — doing
+ * parts 1 and 3 without 2 "reads exactly like a working conversion and is
+ * the half that no-ops", which is why the audit checks the triple rather
+ * than the presence of the call.
+ *
+ * `faqs` is the deliberate holdout: it hand-rolls the refine and returns the
+ * legacy page-only shape, which this file's own docstring describes as
+ * "preserved verbatim for unconverted callers". That is a known limitation,
+ * not a defect — do not "fix" it as a bug (Rule #4).
  * The conversion is mechanical and has THREE parts that must all happen:
  *
  *   1. fetch a bounded WINDOW instead of the requested page;

package/dist/utils/search-txt-query.js

@@ -56,6 +56,18 @@ export const SEARCH_REFINE_WINDOW = 250;
  *
  * `refineSearchTxt` grew a real-pagination mode, and `products` was the only
  * caller converted — deliberately, so the other eleven stayed byte-identical.
+ *
+ * 🛑 That sentence is now HISTORY, not status. Measured 2026-10-19: ELEVEN
+ * repositories use `beginSearchWindow`, and `audit-listing-search-intact`
+ * (C6) enforces all three parts of the conversion on each of them — doing
+ * parts 1 and 3 without 2 "reads exactly like a working conversion and is
+ * the half that no-ops", which is why the audit checks the triple rather
+ * than the presence of the call.
+ *
+ * `faqs` is the deliberate holdout: it hand-rolls the refine and returns the
+ * legacy page-only shape, which this file's own docstring describes as
+ * "preserved verbatim for unconverted callers". That is a known limitation,
+ * not a defect — do not "fix" it as a bug (Rule #4).
  * The conversion is mechanical and has THREE parts that must all happen:
  *
  *   1. fetch a bounded WINDOW instead of the requested page;

package/dist/validation/schemas.d.ts

@@ -142,8 +142,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }, {
@@ -155,8 +155,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }>, {
@@ -168,8 +168,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }, {
@@ -181,8 +181,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }>, {
@@ -194,8 +194,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }, {
@@ -207,8 +207,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }>, {
@@ -220,8 +220,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }, {
@@ -233,8 +233,8 @@ export declare const cropDataSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.Zo
     aspectRatio?: string | undefined;
     minHeight?: number | undefined;
     minWidth?: number | undefined;
-    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     rotation?: number | undefined;
+    outputFormat?: "webp" | "png" | "jpeg" | undefined;
     quality?: number | undefined;
     outputFolder?: string | undefined;
 }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.52.5",
+  "version": "4.53.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
@@ -189,6 +189,10 @@
     "./hooks/*": {
       "types": "./dist/hooks/*.d.ts",
       "import": "./dist/hooks/*.js"
+    },
+    "./features/sticker-trace/server": {
+      "types": "./dist/features/sticker-trace/server.d.ts",
+      "import": "./dist/features/sticker-trace/server.js"
     }
   },
   "files": [
@@ -242,7 +246,7 @@
     "audit:paginated-select": "node scripts/audit-paginated-select.mjs",
     "audit:sieve-views": "node scripts/audit-sieve-constants-views.mjs",
     "check:types": "tsc -p tsconfig.build.json --noEmit",
-    "check:audits": "node scripts/audit-violations.mjs && node scripts/verify-entries.mjs && node scripts/verify-css-build.mjs && node scripts/audit-css-shipped.mjs && node scripts/audit-use-client.mjs && node scripts/audit-double-navigation.mjs && node scripts/audit-repository-fields.mjs && node scripts/audit-query-provider.mjs && node scripts/audit-export-paths.mjs && node scripts/audit-listing-indices.mjs && node scripts/audit-listing-type-reads.mjs && node scripts/audit-create-with-id.mjs && node scripts/audit-css-imports.mjs && node scripts/audit-appkit-reexports.mjs && node scripts/audit-action-confirmation.mjs && node scripts/audit-route-strings.mjs && node scripts/audit-paginated-select.mjs && node scripts/audit-sieve-constants-views.mjs && node scripts/audit-schema-registry-completeness.mjs && node scripts/audit-firestore-schema-coverage.mjs && node scripts/audit-catch-normalize.mjs && node scripts/audit-route-schema-registry.mjs && node scripts/audit-z-any-z-unknown.mjs && node scripts/audit-dynamic-tailwind-arbitrary.mjs && node scripts/audit-surface-props-completeness.mjs && node scripts/audit-touch-handler-completeness.mjs && node scripts/audit-field-primitive-contract.mjs && node scripts/audit-innerhtml-sanitization.mjs",
+    "check:audits": "node scripts/audit-violations.mjs && node scripts/verify-entries.mjs && node scripts/verify-css-build.mjs && node scripts/audit-css-shipped.mjs && node scripts/audit-use-client.mjs && node scripts/audit-double-navigation.mjs && node scripts/audit-repository-fields.mjs && node scripts/audit-query-provider.mjs && node scripts/audit-export-paths.mjs && node scripts/audit-listing-indices.mjs && node scripts/audit-listing-type-reads.mjs && node scripts/audit-create-with-id.mjs && node scripts/audit-css-imports.mjs && node scripts/audit-appkit-reexports.mjs && node scripts/audit-action-confirmation.mjs && node scripts/audit-route-strings.mjs && node scripts/audit-paginated-select.mjs && node scripts/audit-sieve-constants-views.mjs && node scripts/audit-schema-registry-completeness.mjs && node scripts/audit-firestore-schema-coverage.mjs && node scripts/audit-catch-normalize.mjs && node scripts/audit-z-any-z-unknown.mjs && node scripts/audit-dynamic-tailwind-arbitrary.mjs && node scripts/audit-surface-props-completeness.mjs && node scripts/audit-touch-handler-completeness.mjs && node scripts/audit-field-primitive-contract.mjs && node scripts/audit-innerhtml-sanitization.mjs",
     "check": "npm run check:types && npm run check:audits"
   },
   "dependencies": {

package/scripts/dedupe-peer-deps.mjs

@@ -44,6 +44,24 @@ const TRANSITIVE_RUNTIME_DUPS = [
   // query-core and a parallel QueryClientContext instance ships in the SSR
   // bundle, producing the "No QueryClient set" crash on every page (2026-06-11).
   "@tanstack/query-core",
+  /*
+   * firebase-admin (peer) bundles @google-cloud/storage, which does NOT own a
+   * React context — so the 2026-06-11 runtime crash class does not apply here.
+   * It still has to be pruned, for a different reason: TYPE IDENTITY.
+   *
+   * `Bucket` carries a private member, so TypeScript compares the two copies
+   * nominally and refuses to pass a root-resolved Bucket into a function typed
+   * against appkit's copy. Any appkit module that accepts a Bucket from a
+   * caller is then uncompilable from the consumer, which includes appkit/src
+   * under the file: pin.
+   *
+   * MEASURED rather than assumed: removing the directory fixes it and
+   * restoring it brings the error straight back, with the tsbuildinfo cleared
+   * both times — the first attempt cleared a stale cache in the same step and
+   * could not tell which change was responsible.
+   */
+  "@google-cloud/storage",
+  "@google-cloud/firestore",
 ];
 
 // Peer deps that have NO React context / module-scope singleton and that the