@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/constants/api-endpoints.d.ts

@@ -273,6 +273,15 @@ export declare const CATEGORY_ENDPOINTS: {
      * category change in the form costs zero function invocations on a hit.
      */
     readonly DESCRIPTION_TEMPLATE: (id: string, variant?: string) => string;
+    /**
+     * The inherited `priceGuidance` band, restated on the calling seller's own
+     * tax basis — seller/admin/moderator only. Deliberately a SEPARATE
+     * endpoint from `DESCRIPTION_TEMPLATE`: that one is public and edge-cached
+     * so anyone can fetch it, and `priceGuidance` is withheld from that
+     * response for the same reason a listing's own price is hidden from guests
+     * (CLAUDE.md § "Guest price gating").
+     */
+    readonly PRICE_GUIDANCE: (id: string) => string;
 };
 export declare const TOOL_ENDPOINTS: {
     /**
@@ -286,6 +295,42 @@ export declare const TOOL_ENDPOINTS: {
      * its invocation allowance.
      */
     readonly PRICE_INDEX_SEARCH: (q: string) => string;
+    /**
+     * Tier 1 adoption — the client resolved these ids LOCALLY, from the
+     * public search artifact, at zero Firestore reads. This route's only job
+     * is the multi-get `searchPriceIndex` otherwise pays for every lookup.
+     */
+    readonly PRICE_INDEX_BANDS: (ids: readonly string[]) => string;
+};
+/**
+ * The sticker-sheet kiss-cut tracer. Admin-only, every route behind
+ * `admin:products:write`.
+ *
+ * 🛑 EVERY ONE OF THESE RETURNS JSON. Not one returns bytes — a binary is
+ * always a 5-minute signed GCS URL fetched by the browser directly, which is
+ * why `ASSET` takes a KIND and hands back `{ url, expiresAt }`. Vercel Hobby's
+ * Fast Origin Transfer allowance is 10 GB and exceeding a cap PAUSES THE
+ * PROJECT, which happened here at 52.52 GB (Root Cause #104).
+ * `audit-sticker-trace-egress` is strict-zero on it with no suppression marker.
+ */
+export declare const STICKER_SHEET_ENDPOINTS: {
+    /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+    readonly SHEETS: "/api/admin/sticker-sheets";
+    readonly SHEET_BY_ID: (id: string) => string;
+    /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+    readonly UPLOAD: (id: string) => string;
+    /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+    readonly RUNS: (id: string) => string;
+    /** POST a retry as a NEW named run. The response carries the resume clamp. */
+    readonly RUN_RETRY: (id: string, runId: string) => string;
+    /**
+     * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+     * the path itself — accepting a path would be a signed-URL mint for any
+     * object in the bucket.
+     */
+    readonly ASSET: (id: string, kind: string, runId?: string) => string;
+    /** The storage meter — bytes AND object count, biggest sheet first. */
+    readonly USAGE: "/api/admin/sticker-sheets/usage";
 };
 export declare const CHECKOUT_ENDPOINTS: {
     readonly PREFLIGHT: "/api/checkout/preflight";
@@ -347,8 +392,6 @@ export declare const FAQ_ENDPOINTS: {
     readonly VOTE: "/api/faqs/vote";
 };
 export declare const HOMEPAGE_ENDPOINTS: {
-    readonly GET: "/api/homepage";
-    readonly SECTIONS: "/api/homepage-sections";
     readonly CAROUSEL: "/api/carousel";
     readonly NEWSLETTER_SUBSCRIBE: "/api/newsletter/subscribe";
 };
@@ -404,10 +447,9 @@ export declare const REVIEW_ENDPOINTS: {
     readonly FEATURED: "/api/reviews?featured=true";
 };
 export declare const SEARCH_ENDPOINTS: {
-    readonly QUERY: (q: string, extra?: string) => string;
     readonly SUGGESTIONS: "/api/search/suggestions";
-    /** @param params — pre-built querystring (no leading `?`) from a caller-owned URLSearchParams */
-    readonly RAW: (params: string) => string;
+    /** Tier 2 — the viewer's own orders/offers/drafts/addresses. `private, no-store`. */
+    readonly SCOPED: (q: string) => string;
 };
 export declare const SELLER_ENDPOINTS: {
     readonly BECOME: "/api/seller/become";
@@ -786,6 +828,15 @@ export declare const API_ENDPOINTS: {
          * category change in the form costs zero function invocations on a hit.
          */
         readonly DESCRIPTION_TEMPLATE: (id: string, variant?: string) => string;
+        /**
+         * The inherited `priceGuidance` band, restated on the calling seller's own
+         * tax basis — seller/admin/moderator only. Deliberately a SEPARATE
+         * endpoint from `DESCRIPTION_TEMPLATE`: that one is public and edge-cached
+         * so anyone can fetch it, and `priceGuidance` is withheld from that
+         * response for the same reason a listing's own price is hidden from guests
+         * (CLAUDE.md § "Guest price gating").
+         */
+        readonly PRICE_GUIDANCE: (id: string) => string;
     };
     readonly BEFORE_AFTER: {
         readonly LIST: "/api/before-after";
@@ -850,8 +901,6 @@ export declare const API_ENDPOINTS: {
         readonly VOTE: "/api/faqs/vote";
     };
     readonly HOMEPAGE: {
-        readonly GET: "/api/homepage";
-        readonly SECTIONS: "/api/homepage-sections";
         readonly CAROUSEL: "/api/carousel";
         readonly NEWSLETTER_SUBSCRIBE: "/api/newsletter/subscribe";
     };
@@ -904,10 +953,9 @@ export declare const API_ENDPOINTS: {
         readonly FEATURED: "/api/reviews?featured=true";
     };
     readonly SEARCH: {
-        readonly QUERY: (q: string, extra?: string) => string;
         readonly SUGGESTIONS: "/api/search/suggestions";
-        /** @param params — pre-built querystring (no leading `?`) from a caller-owned URLSearchParams */
-        readonly RAW: (params: string) => string;
+        /** Tier 2 — the viewer's own orders/offers/drafts/addresses. `private, no-store`. */
+        readonly SCOPED: (q: string) => string;
     };
     readonly SELLER: {
         readonly BECOME: "/api/seller/become";
@@ -1018,6 +1066,25 @@ export declare const API_ENDPOINTS: {
     readonly REPORTS: {
         readonly SUBMIT: "/api/reports";
     };
+    readonly STICKER_SHEETS: {
+        /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+        readonly SHEETS: "/api/admin/sticker-sheets";
+        readonly SHEET_BY_ID: (id: string) => string;
+        /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+        readonly UPLOAD: (id: string) => string;
+        /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+        readonly RUNS: (id: string) => string;
+        /** POST a retry as a NEW named run. The response carries the resume clamp. */
+        readonly RUN_RETRY: (id: string, runId: string) => string;
+        /**
+         * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+         * the path itself — accepting a path would be a signed-URL mint for any
+         * object in the bucket.
+         */
+        readonly ASSET: (id: string, kind: string, runId?: string) => string;
+        /** The storage meter — bytes AND object count, biggest sheet first. */
+        readonly USAGE: "/api/admin/sticker-sheets/usage";
+    };
 };
 /** Canonical alias — prefer API_ROUTES over API_ENDPOINTS in new code. */
 export declare const API_ROUTES: {
@@ -1288,6 +1355,15 @@ export declare const API_ROUTES: {
          * category change in the form costs zero function invocations on a hit.
          */
         readonly DESCRIPTION_TEMPLATE: (id: string, variant?: string) => string;
+        /**
+         * The inherited `priceGuidance` band, restated on the calling seller's own
+         * tax basis — seller/admin/moderator only. Deliberately a SEPARATE
+         * endpoint from `DESCRIPTION_TEMPLATE`: that one is public and edge-cached
+         * so anyone can fetch it, and `priceGuidance` is withheld from that
+         * response for the same reason a listing's own price is hidden from guests
+         * (CLAUDE.md § "Guest price gating").
+         */
+        readonly PRICE_GUIDANCE: (id: string) => string;
     };
     readonly BEFORE_AFTER: {
         readonly LIST: "/api/before-after";
@@ -1352,8 +1428,6 @@ export declare const API_ROUTES: {
         readonly VOTE: "/api/faqs/vote";
     };
     readonly HOMEPAGE: {
-        readonly GET: "/api/homepage";
-        readonly SECTIONS: "/api/homepage-sections";
         readonly CAROUSEL: "/api/carousel";
         readonly NEWSLETTER_SUBSCRIBE: "/api/newsletter/subscribe";
     };
@@ -1406,10 +1480,9 @@ export declare const API_ROUTES: {
         readonly FEATURED: "/api/reviews?featured=true";
     };
     readonly SEARCH: {
-        readonly QUERY: (q: string, extra?: string) => string;
         readonly SUGGESTIONS: "/api/search/suggestions";
-        /** @param params — pre-built querystring (no leading `?`) from a caller-owned URLSearchParams */
-        readonly RAW: (params: string) => string;
+        /** Tier 2 — the viewer's own orders/offers/drafts/addresses. `private, no-store`. */
+        readonly SCOPED: (q: string) => string;
     };
     readonly SELLER: {
         readonly BECOME: "/api/seller/become";
@@ -1520,4 +1593,23 @@ export declare const API_ROUTES: {
     readonly REPORTS: {
         readonly SUBMIT: "/api/reports";
     };
+    readonly STICKER_SHEETS: {
+        /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+        readonly SHEETS: "/api/admin/sticker-sheets";
+        readonly SHEET_BY_ID: (id: string) => string;
+        /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+        readonly UPLOAD: (id: string) => string;
+        /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+        readonly RUNS: (id: string) => string;
+        /** POST a retry as a NEW named run. The response carries the resume clamp. */
+        readonly RUN_RETRY: (id: string, runId: string) => string;
+        /**
+         * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+         * the path itself — accepting a path would be a signed-URL mint for any
+         * object in the bucket.
+         */
+        readonly ASSET: (id: string, kind: string, runId?: string) => string;
+        /** The storage meter — bytes AND object count, biggest sheet first. */
+        readonly USAGE: "/api/admin/sticker-sheets/usage";
+    };
 };

package/dist/constants/api-endpoints.js

@@ -317,6 +317,15 @@ export const CATEGORY_ENDPOINTS = {
      * category change in the form costs zero function invocations on a hit.
      */
     DESCRIPTION_TEMPLATE: (id, variant) => `/api/categories/${id}/description-template${variant ? `?variant=${variant}` : ""}`,
+    /**
+     * The inherited `priceGuidance` band, restated on the calling seller's own
+     * tax basis — seller/admin/moderator only. Deliberately a SEPARATE
+     * endpoint from `DESCRIPTION_TEMPLATE`: that one is public and edge-cached
+     * so anyone can fetch it, and `priceGuidance` is withheld from that
+     * response for the same reason a listing's own price is hidden from guests
+     * (CLAUDE.md § "Guest price gating").
+     */
+    PRICE_GUIDANCE: (id) => `/api/categories/${id}/price-guidance`,
 };
 // ---------------------------------------------------------------------------
 // Tools — public surfaces that answer a question rather than sell something
@@ -333,6 +342,43 @@ export const TOOL_ENDPOINTS = {
      * its invocation allowance.
      */
     PRICE_INDEX_SEARCH: (q) => `/api/tools/price-index?q=${encodeURIComponent(q)}`,
+    /**
+     * Tier 1 adoption — the client resolved these ids LOCALLY, from the
+     * public search artifact, at zero Firestore reads. This route's only job
+     * is the multi-get `searchPriceIndex` otherwise pays for every lookup.
+     */
+    PRICE_INDEX_BANDS: (ids) => `/api/tools/price-index/bands?ids=${ids.map(encodeURIComponent).join(",")}`,
+};
+/**
+ * The sticker-sheet kiss-cut tracer. Admin-only, every route behind
+ * `admin:products:write`.
+ *
+ * 🛑 EVERY ONE OF THESE RETURNS JSON. Not one returns bytes — a binary is
+ * always a 5-minute signed GCS URL fetched by the browser directly, which is
+ * why `ASSET` takes a KIND and hands back `{ url, expiresAt }`. Vercel Hobby's
+ * Fast Origin Transfer allowance is 10 GB and exceeding a cap PAUSES THE
+ * PROJECT, which happened here at 52.52 GB (Root Cause #104).
+ * `audit-sticker-trace-egress` is strict-zero on it with no suppression marker.
+ */
+export const STICKER_SHEET_ENDPOINTS = {
+    /** GET the sheet list · POST creates a sheet AND signs its scan upload. */
+    SHEETS: "/api/admin/sticker-sheets",
+    SHEET_BY_ID: (id) => `/api/admin/sticker-sheets/${id}`,
+    /** POST finalizes an upload: magic-byte verified, then recorded on the sheet. */
+    UPLOAD: (id) => `/api/admin/sticker-sheets/${id}/upload`,
+    /** GET the attempt history · POST starts a run. 🛑 `name` is REQUIRED. */
+    RUNS: (id) => `/api/admin/sticker-sheets/${id}/runs`,
+    /** POST a retry as a NEW named run. The response carries the resume clamp. */
+    RUN_RETRY: (id, runId) => `/api/admin/sticker-sheets/${id}/runs/${runId}/retry`,
+    /**
+     * Mint a signed read URL. `kind` names WHAT is wanted and the server resolves
+     * the path itself — accepting a path would be a signed-URL mint for any
+     * object in the bucket.
+     */
+    ASSET: (id, kind, runId) => `/api/admin/sticker-sheets/${id}/asset?kind=${encodeURIComponent(kind)}` +
+        (runId ? `&runId=${encodeURIComponent(runId)}` : ""),
+    /** The storage meter — bytes AND object count, biggest sheet first. */
+    USAGE: "/api/admin/sticker-sheets/usage",
 };
 // ---------------------------------------------------------------------------
 // Checkout
@@ -442,8 +488,17 @@ export const FAQ_ENDPOINTS = {
 // Homepage
 // ---------------------------------------------------------------------------
 export const HOMEPAGE_ENDPOINTS = {
-    GET: "/api/homepage",
-    SECTIONS: "/api/homepage-sections",
+    /*
+     * 🛑 `GET` and `SECTIONS` were both removed 2026-10-19 — `/api/homepage` was
+     * NEVER mounted (only a dead hook referenced it), and `/api/homepage-sections`
+     * was a mounted generic-starter-kit stub writing/reading the real
+     * `homepageSections` collection through an incompatible schema. See the
+     * deletion note in `features/homepage/types/index.ts` for the full writeup.
+     * The real, single section API is `/api/admin/sections` (admin CRUD);
+     * public rendering reads `homepageSectionsRepository` directly, server-side,
+     * in `MarketplaceHomepageView` — no public GET endpoint for sections exists
+     * or is needed.
+     */
     CAROUSEL: "/api/carousel",
     NEWSLETTER_SUBSCRIBE: "/api/newsletter/subscribe",
 };
@@ -535,10 +590,9 @@ export const REVIEW_ENDPOINTS = {
 // Search
 // ---------------------------------------------------------------------------
 export const SEARCH_ENDPOINTS = {
-    QUERY: (q, extra) => `/api/search?q=${encodeURIComponent(q)}${extra ? `&${extra}` : ""}`,
     SUGGESTIONS: "/api/search/suggestions",
-    /** @param params — pre-built querystring (no leading `?`) from a caller-owned URLSearchParams */
-    RAW: (params) => `/api/search?${params}`,
+    /** Tier 2 — the viewer's own orders/offers/drafts/addresses. `private, no-store`. */
+    SCOPED: (q) => `/api/search/scoped?q=${encodeURIComponent(q)}`,
 };
 // ---------------------------------------------------------------------------
 // Seller
@@ -734,6 +788,7 @@ export const API_ENDPOINTS = {
     SUPPORT: SUPPORT_ENDPOINTS,
     SCAMMERS: SCAMMER_ENDPOINTS,
     REPORTS: REPORT_ENDPOINTS,
+    STICKER_SHEETS: STICKER_SHEET_ENDPOINTS,
 };
 /** Canonical alias — prefer API_ROUTES over API_ENDPOINTS in new code. */
 export const API_ROUTES = API_ENDPOINTS;

package/dist/constants/cache-invalidation.js

@@ -20,7 +20,9 @@ export const COLLECTION_CACHE_PATHS = {
     categories: [CATEGORY_ENDPOINTS.LIST],
     products: [PRODUCT_ENDPOINTS.LIST],
     carouselSlides: [HOMEPAGE_ENDPOINTS.CAROUSEL],
-    homepageSections: [HOMEPAGE_ENDPOINTS.SECTIONS],
+    // No public GET endpoint exists for homepageSections (removed 2026-10-19 —
+    // see HOMEPAGE_ENDPOINTS' own comment). Real-time freshness comes from
+    // `revalidatePath("/")`, which /api/admin/sections already calls on write.
     siteSettings: [SITE_SETTINGS_ENDPOINTS.GET],
     faqs: [FAQ_ENDPOINTS.LIST],
     reviews: [REVIEW_ENDPOINTS.LIST],

package/dist/constants/field-names.d.ts

@@ -49,6 +49,9 @@ export declare const PRODUCT_FIELDS: {
     readonly STOCK_QUANTITY: "stockQuantity";
     readonly AVAILABLE_QUANTITY: "availableQuantity";
     readonly IS_SOLD: "isSold";
+    readonly MADE_TO_ORDER: "madeToOrder";
+    readonly PART_GLOSSARY_ID: "partGlossaryId";
+    readonly COLOURWAY: "colourway";
     readonly MAIN_IMAGE: "mainImage";
     readonly IMAGES: "images";
     readonly VIDEO: "video";
@@ -181,6 +184,7 @@ export declare const PRODUCT_FIELDS: {
         readonly LIVE: "live";
         readonly ART: "art";
         readonly STICKERS: "stickers";
+        readonly SPARES: "spares";
     };
 };
 export declare const PRODUCT_STATUS_TRANSITIONS: Record<string, readonly string[]>;
@@ -427,7 +431,6 @@ export declare const EVENT_ENTRY_FIELDS: {
     readonly USER_ID: "userId";
     readonly USER_DISPLAY_NAME: "userDisplayName";
     readonly USER_EMAIL: "userEmail";
-    readonly STATUS: "status";
     readonly RAFFLE_ELIGIBLE: "raffleEligible";
     readonly SPIN_USED: "spinUsed";
     readonly SPIN_COUNT: "spinCount";
@@ -436,11 +439,18 @@ export declare const EVENT_ENTRY_FIELDS: {
     readonly SPIN_WON_AT: "spinWonAt";
     readonly GUEST_IP_HASH: "guestIpHash";
     readonly CREATED_AT: "createdAt";
+    readonly STATUS: "status";
     readonly STATUS_VALUES: {
         readonly CONFIRMED: "CONFIRMED";
         readonly WAITLISTED: "WAITLISTED";
         readonly CANCELLED: "CANCELLED";
     };
+    readonly REVIEW_STATUS: "reviewStatus";
+    readonly REVIEW_STATUS_VALUES: {
+        readonly PENDING: "pending";
+        readonly APPROVED: "approved";
+        readonly FLAGGED: "flagged";
+    };
 };
 export declare const PAYOUT_FIELDS: {
     readonly ID: "id";
@@ -847,6 +857,8 @@ export declare const HOMEPAGE_SECTION_FIELDS: {
     readonly ORDER: "order";
     readonly ENABLED: "enabled";
     readonly CONFIG: "config";
+    /** Which page the row belongs to. Absent on a row means "homepage". */
+    readonly SURFACE: "surface";
     readonly CREATED_AT: "createdAt";
     readonly UPDATED_AT: "updatedAt";
     readonly TYPE_VALUES: {

package/dist/constants/field-names.js

@@ -58,6 +58,9 @@ export const PRODUCT_FIELDS = {
     STOCK_QUANTITY: "stockQuantity",
     AVAILABLE_QUANTITY: "availableQuantity",
     IS_SOLD: "isSold",
+    MADE_TO_ORDER: "madeToOrder",
+    PART_GLOSSARY_ID: "partGlossaryId",
+    COLOURWAY: "colourway",
     MAIN_IMAGE: "mainImage",
     IMAGES: "images",
     VIDEO: "video",
@@ -201,6 +204,7 @@ export const PRODUCT_FIELDS = {
         LIVE: "live",
         ART: "art",
         STICKERS: "stickers",
+        SPARES: "spares",
     },
 };
 export const PRODUCT_STATUS_TRANSITIONS = {
@@ -487,7 +491,6 @@ export const EVENT_ENTRY_FIELDS = {
     USER_ID: "userId",
     USER_DISPLAY_NAME: "userDisplayName",
     USER_EMAIL: "userEmail",
-    STATUS: "status",
     RAFFLE_ELIGIBLE: "raffleEligible",
     SPIN_USED: "spinUsed",
     SPIN_COUNT: "spinCount",
@@ -496,11 +499,47 @@ export const EVENT_ENTRY_FIELDS = {
     SPIN_WON_AT: "spinWonAt",
     GUEST_IP_HASH: "guestIpHash",
     CREATED_AT: "createdAt",
+    /*
+     * 🛑 TWO status fields, different meanings, and conflating them cost the
+     * raffle feature its entire working life.
+     *
+     *   `status`       — RSVP / attendance. CONFIRMED | WAITLISTED | CANCELLED.
+     *                    Written ONLY by an admin clicking Confirm / Waitlist /
+     *                    Cancel in `AdminAllEventEntriesView`, which also filters
+     *                    on it. Never set when an entry is created.
+     *   `reviewStatus` — moderation of what the entrant SUBMITTED.
+     *                    pending | approved | flagged. Written on every entry
+     *                    path, and indexed `(eventId, reviewStatus, submittedAt)`.
+     *
+     * `EventEntryDocument.status`'s own doc comment claims it "drives raffle
+     * eligibility", and `runTriggerEventRaffle` duly queried
+     * `status == "CONFIRMED"`. But nothing writes `status` at creation time, so
+     * the pool was empty unless an admin had hand-confirmed every entry one row
+     * at a time — on a raffle seeded with 1,892 entries. Every draw returned
+     * `no_eligible_entries`; the raffle had never once been drawable.
+     *
+     * Eligibility moved to `reviewStatus == "approved"` on 2026-10-19 (and
+     * `enterEvent` now auto-approves raffle entries, since a raffle entry is a
+     * name plus an optional message and there is nothing to moderate). `status`
+     * stays because its admin workflow is real — it just is not the gate.
+     *
+     * Both mirror `EVENT_ENTRY_FIELDS` in
+     * `features/events/schemas/firestore.ts`, which is the source of truth for
+     * the document shape — verify there before adding a value here (Root Cause
+     * #34).
+     */
+    STATUS: "status",
     STATUS_VALUES: {
         CONFIRMED: "CONFIRMED",
         WAITLISTED: "WAITLISTED",
         CANCELLED: "CANCELLED",
     },
+    REVIEW_STATUS: "reviewStatus",
+    REVIEW_STATUS_VALUES: {
+        PENDING: "pending",
+        APPROVED: "approved",
+        FLAGGED: "flagged",
+    },
 };
 // ============================================================================
 // PAYOUT FIELDS
@@ -1000,6 +1039,8 @@ export const HOMEPAGE_SECTION_FIELDS = {
     ORDER: "order",
     ENABLED: "enabled",
     CONFIG: "config",
+    /** Which page the row belongs to. Absent on a row means "homepage". */
+    SURFACE: "surface",
     CREATED_AT: "createdAt",
     UPDATED_AT: "updatedAt",
     TYPE_VALUES: {

package/dist/contracts/repository.d.ts

@@ -1,3 +1,4 @@
+import type { Plaintext } from "../security/encrypted";
 /** Field comparison operators supported by Sieve-style query strings. */
 export type WhereOp = "==" | "!=" | "<" | "<=" | ">" | ">=" | "array-contains" | "in" | "not-in" | "array-contains-any";
 /**
@@ -15,14 +16,14 @@ export interface SieveQuery {
     /** 1-based page number (default: 1) */
     page?: number;
     /** Items per page (default: 20) */
-    perPage?: number;
+    pageSize?: number;
 }
 /** Paginated result envelope returned by IReadRepository.findAll() */
 export interface PagedResult<T> {
     data: T[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
 }
 export interface IReadRepository<T> {
@@ -36,10 +37,10 @@ export interface IReadRepository<T> {
     findWhere<K extends keyof T>(field: K, op: WhereOp, value: T[K] | readonly T[K][]): Promise<T[]>;
 }
 export interface IWriteRepository<T> {
-    create(data: Omit<T, "id" | "createdAt" | "updatedAt">): Promise<T>;
-    update(id: string, data: Partial<T>): Promise<T>;
+    create(data: Omit<Plaintext<T>, "id" | "createdAt" | "updatedAt">): Promise<T>;
+    update(id: string, data: Partial<Plaintext<T>>): Promise<T>;
     delete(id: string): Promise<void>;
-    batchCreate(items: Array<Omit<T, "id" | "createdAt" | "updatedAt">>): Promise<T[]>;
+    batchCreate(items: Array<Omit<Plaintext<T>, "id" | "createdAt" | "updatedAt">>): Promise<T[]>;
     batchDelete(ids: string[]): Promise<void>;
 }
 /** Full CRUD repository — combines read + write. */
@@ -95,7 +96,7 @@ export interface RepositoryLifecycleHooks<T> {
      * Called before `create`. Return the (possibly mutated) data to be persisted.
      * If not returned, the original data is used unchanged.
      */
-    beforeCreate?: (data: Omit<T, "id" | "createdAt" | "updatedAt">) => Omit<T, "id" | "createdAt" | "updatedAt"> | Promise<Omit<T, "id" | "createdAt" | "updatedAt">>;
+    beforeCreate?: (data: Omit<Plaintext<T>, "id" | "createdAt" | "updatedAt">) => Omit<T, "id" | "createdAt" | "updatedAt"> | Promise<Omit<T, "id" | "createdAt" | "updatedAt">>;
     /**
      * Called after a successful `create`. Receives the persisted document.
      */
@@ -103,7 +104,7 @@ export interface RepositoryLifecycleHooks<T> {
     /**
      * Called before `update`. Return the (possibly mutated) partial to be applied.
      */
-    beforeUpdate?: (id: string, data: Partial<T>) => Partial<T> | Promise<Partial<T>>;
+    beforeUpdate?: (id: string, data: Partial<Plaintext<T>>) => Partial<T> | Promise<Partial<T>>;
     /**
      * Called after a successful `update`. Receives the updated document.
      */

package/dist/contracts/search.d.ts

@@ -1,6 +1,6 @@
 export interface SearchOptions {
     page?: number;
-    perPage?: number;
+    pageSize?: number;
     filters?: string;
     facets?: string[];
     sortBy?: string;
@@ -19,7 +19,7 @@ export interface SearchResult<T> {
     hits: SearchHit<T>[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
     processingTimeMs?: number;
     facets?: Record<string, Record<string, number>>;

package/dist/contracts/table.d.ts

@@ -16,7 +16,7 @@
  *
  * export const myPaginationConfig: PaginationConfig = {
  *   ...DEFAULT_PAGINATION_CONFIG,
- *   perPage: 10,
+ *   pageSize: 10,
  *   showPageSizeSelector: true,
  *   pageSizeOptions: [10, 25, 50],
  * };
@@ -33,8 +33,8 @@
  */
 export interface PaginationConfig {
     /** Items per page sent to the API. Default: 20 */
-    perPage?: number;
-    /** Hard cap on perPage (for page-size selector). Default: 100 */
+    pageSize?: number;
+    /** Hard cap on pageSize (for page-size selector). Default: 100 */
     maxPerPage?: number;
     /** Show a page-size selector UI element. Default: false */
     showPageSizeSelector?: boolean;

package/dist/contracts/table.js

@@ -16,7 +16,7 @@
  *
  * export const myPaginationConfig: PaginationConfig = {
  *   ...DEFAULT_PAGINATION_CONFIG,
- *   perPage: 10,
+ *   pageSize: 10,
  *   showPageSizeSelector: true,
  *   pageSizeOptions: [10, 25, 50],
  * };
@@ -28,7 +28,7 @@
  * const { products } = useProducts(params, { paginationConfig: myPaginationConfig });
  */
 export const DEFAULT_PAGINATION_CONFIG = {
-    perPage: 20,
+    pageSize: 20,
     maxPerPage: 100,
     showPageSizeSelector: false,
     pageSizeOptions: [10, 20, 50, 100],
@@ -44,7 +44,7 @@ export const DEFAULT_STICKY_CONFIG = {
     zIndex: 10,
 };
 export const DEFAULT_TABLE_CONFIG = {
-    pageSize: DEFAULT_PAGINATION_CONFIG.perPage,
+    pageSize: DEFAULT_PAGINATION_CONFIG.pageSize,
     sticky: DEFAULT_STICKY_CONFIG,
     striped: false,
     selectable: false,

package/dist/core/contact-submissions.repository.js

@@ -19,12 +19,12 @@ export class ContactSubmissionsRepository {
     }
     async list(model) {
         const page = Number(model.page || "1");
-        const perPage = Number(model.pageSize || "50");
+        const pageSize = Number(model.pageSize || "50");
         return this.repo.findAll({
             filters: model.filters,
             sort: model.sorts || "-createdAt",
             page: Number.isFinite(page) ? page : 1,
-            perPage: Number.isFinite(perPage) ? perPage : 50,
+            pageSize: Number.isFinite(pageSize) ? pageSize : 50,
         });
     }
     async findById(id) {

package/dist/core/integration-keys.js

@@ -13,7 +13,13 @@
  *   const keys = await resolveKeys();
  *   const client = StandardCheckoutClient.getInstance(keys.phonepeClientId, keys.phonepeClientSecret, Number(keys.phonepeClientVersion), env);
  */
-import { siteSettingsRepository } from "../repositories/index.js";
+/*
+ * The DEFINING module, not the `repositories` barrel. That barrel re-exports
+ * `unitOfWork` from `../core`, so coming back through it put this file inside
+ * the same cycle (`audit-import-cycles` component 2) — and Root Cause #18 asks
+ * for the defining module regardless.
+ */
+import { siteSettingsRepository } from "../features/admin/repository/site-settings.repository.js";
 import { normalizeError } from "../errors/normalize.js";
 const EMPTY_KEYS = {
     phonepeClientId: "",

package/dist/core/newsletter.repository.js

@@ -52,12 +52,12 @@ export class NewsletterRepository {
     }
     async list(model) {
         const page = Number(model.page || "1");
-        const perPage = Number(model.pageSize || "50");
+        const pageSize = Number(model.pageSize || "50");
         const result = await this.repo.findAll({
             filters: model.filters,
             sort: model.sorts || "-createdAt",
             page: Number.isFinite(page) ? page : 1,
-            perPage: Number.isFinite(perPage) ? perPage : 50,
+            pageSize: Number.isFinite(pageSize) ? pageSize : 50,
         });
         return {
             ...result,

package/dist/core/site-config.js

@@ -15,7 +15,7 @@ export const SITE_CONFIG = {
         sellers: ROUTES.PUBLIC.SELLERS,
         stores: ROUTES.PUBLIC.STORES,
         events: ROUTES.PUBLIC.EVENTS,
-        blog: ROUTES.PUBLIC.BLOG,
+        blog: ROUTES.BLOG.LIST,
         categories: ROUTES.PUBLIC.CATEGORIES,
         promotions: ROUTES.PUBLIC.PROMOTIONS,
         reviews: ROUTES.PUBLIC.REVIEWS,