@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/errors/error-codes.d.ts

@@ -31,6 +31,36 @@ export declare const OFFER_ERROR_CODES: {
     readonly CHECKOUT_EXPIRED: "OFFER_CHECKOUT_EXPIRED";
     readonly WRONG_STATE: "OFFER_WRONG_STATE";
 };
+/**
+ * Event prize-draw refusals — the spin wheel and the raffle draw.
+ *
+ * These exist because every refusal on those two surfaces used to render as the
+ * single string "Spin failed. Please try again.": the client threw a native
+ * `Error`, so `normalizeError` produced no code, so `toUserMessage` could only
+ * return its fallback. A closed window, an exhausted per-user cap and a
+ * misconfigured event were indistinguishable to the person spinning, and a
+ * 401 never opened the login modal.
+ *
+ * Statuses live beside the reasons in
+ * `_internal/server/jobs/core/event-draw-reasons.ts`; `audit-error-display-i18n`
+ * requires a matching `errors.codes.*` key in `messages/en.json` for every
+ * value below.
+ */
+export declare const EVENT_DRAW_ERROR_CODES: {
+    readonly IDENTITY_REQUIRED: "EVENT_IDENTITY_REQUIRED";
+    readonly LOGIN_REQUIRED: "EVENT_LOGIN_REQUIRED";
+    readonly EVENT_NOT_FOUND: "EVENT_NOT_FOUND";
+    readonly EVENT_NOT_ACTIVE: "EVENT_NOT_ACTIVE";
+    readonly SPIN_NO_PRIZES: "SPIN_NO_PRIZES";
+    readonly SPIN_OUTSIDE_WINDOW: "SPIN_OUTSIDE_WINDOW";
+    readonly SPIN_ALREADY_USED: "SPIN_ALREADY_USED";
+    readonly NOT_A_SPIN_WHEEL: "EVENT_NOT_A_SPIN_WHEEL";
+    readonly RAFFLE_NOT_A_RAFFLE: "RAFFLE_NOT_A_RAFFLE";
+    readonly RAFFLE_ALREADY_DRAWN: "RAFFLE_ALREADY_DRAWN";
+    readonly RAFFLE_NO_ELIGIBLE_ENTRIES: "RAFFLE_NO_ELIGIBLE_ENTRIES";
+    /** A reason the status map has never heard of — a bug in the core, mapped 500. */
+    readonly UNKNOWN_REASON: "EVENT_DRAW_UNKNOWN_REASON";
+};
 export declare const ERROR_CODES: {
     readonly AUTH_INVALID_CREDENTIALS: "AUTH_001";
     readonly AUTH_TOKEN_EXPIRED: "AUTH_002";

package/dist/errors/error-codes.js

@@ -31,6 +31,36 @@ export const OFFER_ERROR_CODES = {
     CHECKOUT_EXPIRED: "OFFER_CHECKOUT_EXPIRED",
     WRONG_STATE: "OFFER_WRONG_STATE",
 };
+/**
+ * Event prize-draw refusals — the spin wheel and the raffle draw.
+ *
+ * These exist because every refusal on those two surfaces used to render as the
+ * single string "Spin failed. Please try again.": the client threw a native
+ * `Error`, so `normalizeError` produced no code, so `toUserMessage` could only
+ * return its fallback. A closed window, an exhausted per-user cap and a
+ * misconfigured event were indistinguishable to the person spinning, and a
+ * 401 never opened the login modal.
+ *
+ * Statuses live beside the reasons in
+ * `_internal/server/jobs/core/event-draw-reasons.ts`; `audit-error-display-i18n`
+ * requires a matching `errors.codes.*` key in `messages/en.json` for every
+ * value below.
+ */
+export const EVENT_DRAW_ERROR_CODES = {
+    IDENTITY_REQUIRED: "EVENT_IDENTITY_REQUIRED",
+    LOGIN_REQUIRED: "EVENT_LOGIN_REQUIRED",
+    EVENT_NOT_FOUND: "EVENT_NOT_FOUND",
+    EVENT_NOT_ACTIVE: "EVENT_NOT_ACTIVE",
+    SPIN_NO_PRIZES: "SPIN_NO_PRIZES",
+    SPIN_OUTSIDE_WINDOW: "SPIN_OUTSIDE_WINDOW",
+    SPIN_ALREADY_USED: "SPIN_ALREADY_USED",
+    NOT_A_SPIN_WHEEL: "EVENT_NOT_A_SPIN_WHEEL",
+    RAFFLE_NOT_A_RAFFLE: "RAFFLE_NOT_A_RAFFLE",
+    RAFFLE_ALREADY_DRAWN: "RAFFLE_ALREADY_DRAWN",
+    RAFFLE_NO_ELIGIBLE_ENTRIES: "RAFFLE_NO_ELIGIBLE_ENTRIES",
+    /** A reason the status map has never heard of — a bug in the core, mapped 500. */
+    UNKNOWN_REASON: "EVENT_DRAW_UNKNOWN_REASON",
+};
 export const ERROR_CODES = {
     // Authentication
     AUTH_INVALID_CREDENTIALS: "AUTH_001",

package/dist/errors/error-display-map.js

@@ -1,5 +1,5 @@
 import { normalizeError } from "./normalize.js";
-import { ERROR_CODES, BID_ERROR_CODES, OFFER_ERROR_CODES } from "./error-codes.js";
+import { ERROR_CODES, BID_ERROR_CODES, OFFER_ERROR_CODES, EVENT_DRAW_ERROR_CODES, } from "./error-codes.js";
 import { HTTP_ERROR_CODES } from "./error-mapping.js";
 const k = (code) => `errors.codes.${code}`;
 export const ERROR_DISPLAY_MAP = {
@@ -172,6 +172,45 @@ export const ERROR_DISPLAY_MAP = {
     [OFFER_ERROR_CODES.WRONG_STATE]: {
         messageKey: k(OFFER_ERROR_CODES.WRONG_STATE),
     },
+    // ---------- Event prize draws (spin wheel + raffle) ----------
+    // No `field` on any of these: the spin wheel is a button, not a form, and the
+    // raffle draw is an admin action. There is no input to route an error onto.
+    [EVENT_DRAW_ERROR_CODES.IDENTITY_REQUIRED]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.IDENTITY_REQUIRED),
+    },
+    [EVENT_DRAW_ERROR_CODES.LOGIN_REQUIRED]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.LOGIN_REQUIRED),
+    },
+    [EVENT_DRAW_ERROR_CODES.EVENT_NOT_FOUND]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.EVENT_NOT_FOUND),
+    },
+    [EVENT_DRAW_ERROR_CODES.EVENT_NOT_ACTIVE]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.EVENT_NOT_ACTIVE),
+    },
+    [EVENT_DRAW_ERROR_CODES.SPIN_NO_PRIZES]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.SPIN_NO_PRIZES),
+    },
+    [EVENT_DRAW_ERROR_CODES.SPIN_OUTSIDE_WINDOW]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.SPIN_OUTSIDE_WINDOW),
+    },
+    [EVENT_DRAW_ERROR_CODES.SPIN_ALREADY_USED]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.SPIN_ALREADY_USED),
+    },
+    [EVENT_DRAW_ERROR_CODES.NOT_A_SPIN_WHEEL]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.NOT_A_SPIN_WHEEL),
+    },
+    [EVENT_DRAW_ERROR_CODES.RAFFLE_NOT_A_RAFFLE]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.RAFFLE_NOT_A_RAFFLE),
+    },
+    [EVENT_DRAW_ERROR_CODES.RAFFLE_ALREADY_DRAWN]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.RAFFLE_ALREADY_DRAWN),
+    },
+    [EVENT_DRAW_ERROR_CODES.RAFFLE_NO_ELIGIBLE_ENTRIES]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.RAFFLE_NO_ELIGIBLE_ENTRIES),
+    },
+    [EVENT_DRAW_ERROR_CODES.UNKNOWN_REASON]: {
+        messageKey: k(EVENT_DRAW_ERROR_CODES.UNKNOWN_REASON),
+    },
     // ---------- HTTP / mapped wire codes (from error-mapping.ts) ----------
     [HTTP_ERROR_CODES.VALIDATION_FAILED]: {
         messageKey: k(HTTP_ERROR_CODES.VALIDATION_FAILED),

package/dist/features/about/components/PolicyPageView.d.ts

@@ -1,6 +1,26 @@
-export type PolicyKey = "privacy" | "terms" | "cookies" | "refund" | "ethics" | "conduct";
+export type PolicyKey = "privacy" | "terms" | "cookies" | "refund" | "ethics" | "conduct" | "cancellation" | "grievance";
 export interface PolicyPageViewProps {
     /** Which policy to render */
     policy: PolicyKey;
+    /**
+     * Rendered after the policy sections and before the related links.
+     *
+     * The slot exists for /grievance, whose officer block (name, designation,
+     * email, phone) comes from `appkit.config.js` → `business.grievance` rather
+     * than from i18n — those values are deployment-specific and some are still
+     * undecided, so they render through `<PendingValue>` as a visible
+     * `[to be confirmed]` marker.
+     *
+     * 🛑 Deliberately a `children` ReactNode and not a render prop: this is an
+     * async Server Component, and a function prop would have to cross the
+     * server/client boundary at the call site to be useful. The caller builds
+     * the node and passes it down, which needs nothing serialisable.
+     *
+     * Note it renders under the i18n sections but is SKIPPED when an admin HTML
+     * override is present — an override replaces the page's body, and silently
+     * appending a block the admin cannot see or edit would make the override a
+     * half-truth.
+     */
+    children?: React.ReactNode;
 }
-export declare function PolicyPageView({ policy, }: PolicyPageViewProps): Promise<import("react").JSX.Element>;
+export declare function PolicyPageView({ policy, children, }: PolicyPageViewProps): Promise<import("react").JSX.Element>;

package/dist/features/about/components/PolicyPageView.js

@@ -58,9 +58,21 @@ const POLICY_META = {
         firestoreField: "codeOfConduct",
         relatedLabelKey: "relatedConduct",
     },
+    cancellation: {
+        path: String(ROUTES.PUBLIC.CANCELLATION_POLICY),
+        namespace: "cancellationPolicy",
+        firestoreField: "cancellation",
+        relatedLabelKey: "relatedCancellation",
+    },
+    grievance: {
+        path: String(ROUTES.PUBLIC.GRIEVANCE),
+        namespace: "grievance",
+        firestoreField: "grievance",
+        relatedLabelKey: "relatedGrievance",
+    },
 };
 const POLICY_KEYS = Object.keys(POLICY_META);
-export async function PolicyPageView({ policy, }) {
+export async function PolicyPageView({ policy, children, }) {
     const page = { container: PAGE_CONTAINER };
     const meta = POLICY_META[policy];
     const { getTranslations } = await import("next-intl/server");
@@ -93,5 +105,5 @@ export async function PolicyPageView({ policy, }) {
     }));
     return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(Section, { color: "inverse", tone: "accent-banner", padding: "banner", children: _jsxs(Div, { className: `${page.container.sm}`, children: [_jsx(Heading, { color: "inverse", level: 1, variant: "none", className: "mb-3", children: t("title") }), _jsx(Text, { color: "inverse", variant: "none", className: "/80", size: "sm", children: t("lastUpdated") })] }) }), _jsxs(Div, { className: `${page.container.sm}`, padding: "content-banner", children: [adminHtml ? (
                     /* Admin-set HTML takes priority */
-                    _jsx(Div, { className: "prose max-w-none", dangerouslySetInnerHTML: { __html: adminHtml } })) : (_jsxs(_Fragment, { children: [t.has("intro") && (_jsx(Text, { variant: "secondary", className: "mb-10 leading-relaxed", size: "base", children: t("intro") })), _jsx(Stack, { gap: "xl", children: sections.map((section, i) => (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-3", children: section.heading }), _jsx(Text, { variant: "secondary", className: "leading-relaxed whitespace-pre-line", children: section.body })] }, i))) })] })), relatedLinks.length > 0 && (_jsxs(Div, { className: `mt-14 border-t`, border: "default", padding: "t-xl", children: [_jsx(Heading, { level: 3, className: "mb-3 uppercase tracking-wide", color: "muted", size: "sm", weight: "semibold", children: t("relatedTitle") }), _jsx(Row, { wrap: true, gap: "md", children: relatedLinks.map((l) => (_jsx(TextLink, { href: l.href, variant: "muted", size: "sm", children: l.label }, l.href))) })] }))] })] }));
+                    _jsx(Div, { className: "prose max-w-none", dangerouslySetInnerHTML: { __html: adminHtml } })) : (_jsxs(_Fragment, { children: [t.has("intro") && (_jsx(Text, { variant: "secondary", className: "mb-10 leading-relaxed", size: "base", children: t("intro") })), _jsx(Stack, { gap: "xl", children: sections.map((section, i) => (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-3", children: section.heading }), _jsx(Text, { variant: "secondary", className: "leading-relaxed whitespace-pre-line", children: section.body })] }, i))) }), children] })), relatedLinks.length > 0 && (_jsxs(Div, { className: `mt-14 border-t`, border: "default", padding: "t-xl", children: [_jsx(Heading, { level: 3, className: "mb-3 uppercase tracking-wide", color: "muted", size: "sm", weight: "semibold", children: t("relatedTitle") }), _jsx(Row, { wrap: true, gap: "md", children: relatedLinks.map((l) => (_jsx(TextLink, { href: l.href, variant: "muted", size: "sm", children: l.label }, l.href))) })] }))] })] }));
 }

package/dist/features/about/components/PublicProfileView.js

@@ -1,5 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import Link from "next/link.js";
+import { productImageUrls } from "../../products/schemas/firestore.js";
 import { getPublicUserProfile, getProfileStoreProducts, getReviewsAuthoredBy, getReviewsReceivedBy } from "../../auth/actions/profile-actions.js";
 import { storeRepository } from "../../stores/repository/store.repository.js";
 import { safeRead } from "../../../errors/safe-read.js";
@@ -37,7 +38,7 @@ function toProductItem(p) {
         originalPrice: p.originalPrice,
         currency: p.currency,
         mainImage: p.mainImage,
-        images: p.images,
+        images: productImageUrls(p.images),
         status: p.status,
         condition: p.condition,
         listingType: p.listingType,

package/dist/features/about/components/ShippingPolicyView.js

@@ -1,4 +1,7 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { normalizeError } from "../../../errors/normalize.js";
+import { serverLogger } from "../../../monitoring/server-logger.js";
+import { siteSettingsRepository } from "../../../repositories/index.js";
 import { ROUTES } from "../../../constants/index.js";
 import { PAGE_CONTAINER } from "../../../_internal/shared/styles/page.js";
 import { Div, Heading, Text, Section, Stack, FlowDiagram } from "../../../ui/index.js";
@@ -8,6 +11,35 @@ export async function ShippingPolicyView({} = {}) {
     const page = { container: PAGE_CONTAINER };
     const { getTranslations } = await import("next-intl/server");
     const t = await getTranslations("shippingPolicy");
+    /*
+     * 🛑 `siteSettings.legalPages.shipping` was WRITTEN by the admin form and
+     * read by nothing.
+     *
+     * Every other legal page renders through `PolicyPageView`, which checks that
+     * group for an admin HTML override. This page does not — it has a bespoke
+     * layout with a five-step delivery diagram that a flat `sections[]` cannot
+     * express — so the override had no reader and an admin who rewrote the
+     * shipping policy saw their text saved successfully and never appear.
+     *
+     * Reading it here rather than converting the page is the deliberate choice:
+     * converting would mean flattening 38 i18n keys into `sections[]` and losing
+     * the diagram, which is a regression dressed up as consolidation.
+     */
+    let adminHtml = "";
+    try {
+        const settings = await siteSettingsRepository.getSingleton();
+        adminHtml = settings.legalPages?.shipping ?? "";
+    }
+    catch (_err) {
+        void normalizeError(_err);
+        // The i18n copy below is a complete policy in its own right, so a failed
+        // read degrades to it — but an admin who HAS overridden this page would
+        // silently see the old text, so the operator needs to know.
+        serverLogger.warn("about.shippingPolicyView: siteSettings.legalPages read failed", {
+            field: "shipping",
+            error: normalizeError(_err).message,
+        });
+    }
     const SECTIONS = [
         { title: t("orderProcessTitle"), text: t("orderProcessText") },
         { title: t("standardTitle"), text: t("standardText") },
@@ -55,5 +87,13 @@ export async function ShippingPolicyView({} = {}) {
             desc: t("diagramStatus5Desc"),
         },
     ];
-    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(Section, { color: "inverse", tone: "accent-banner", padding: "banner", children: _jsxs(Div, { className: `${page.container.sm}`, children: [_jsx(Heading, { color: "inverse", level: 1, variant: "none", className: "mb-3", children: t("title") }), _jsx(Text, { color: "inverse", variant: "none", className: "/80", children: t("lastUpdated") })] }) }), _jsxs(Div, { className: `${page.container.sm}`, padding: "content-banner", children: [_jsx(Text, { size: "lg", variant: "secondary", className: "mb-8", children: t("subtitle") }), _jsx(FlowDiagram, { title: `🚚 ${t("diagramTitle")}`, titleClass: "text-sky-700 dark:text-sky-300", connectorClass: "bg-sky-200 dark:bg-sky-800", steps: DIAGRAM_STEPS, className: "mb-10", note: `📌 ${t("diagramNote")}` }), _jsxs(Stack, { gap: "xl", children: [SECTIONS.map(({ title, text }) => (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-3", children: title }), _jsx(Text, { variant: "secondary", className: "leading-relaxed", children: text })] }, title))), _jsxs(Section, { rounded: "xl", padding: "lg", border: "default", surface: "subtle", children: [_jsx(Heading, { level: 2, className: "mb-2", children: t("contactTitle") }), _jsx(Text, { variant: "secondary", children: t("contactText") })] })] }), _jsxs(Div, { layout: "flex", gap: "6", textSize: "sm", className: `mt-12 border-t`, border: "default", padding: "t-xl", children: [_jsx(TextLink, { href: String(ROUTES.PUBLIC.TRACK_ORDER), className: CLS_FOOTER_LINK, children: t("trackOrder") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.HELP), className: CLS_FOOTER_LINK, children: t("helpCenter") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.CONTACT), className: CLS_FOOTER_LINK, children: t("contactUs") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.REFUND_POLICY), className: CLS_FOOTER_LINK, children: "Refund Policy" })] })] })] }));
+    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(Section, { color: "inverse", tone: "accent-banner", padding: "banner", children: _jsxs(Div, { className: `${page.container.sm}`, children: [_jsx(Heading, { color: "inverse", level: 1, variant: "none", className: "mb-3", children: t("title") }), _jsx(Text, { color: "inverse", variant: "none", className: "/80", children: t("lastUpdated") })] }) }), _jsxs(Div, { className: `${page.container.sm}`, padding: "content-banner", children: [adminHtml ? (
+                    /*
+                      Admin-set HTML replaces the WHOLE body — subtitle, sections,
+                      diagram and contact block — matching PolicyPageView's behaviour
+                      exactly. Rendering the override above the bundled copy would show
+                      two shipping policies on one page, and the reader has no way to
+                      know which one binds.
+                    */
+                    _jsx(Div, { className: "prose max-w-none", dangerouslySetInnerHTML: { __html: adminHtml } })) : (_jsxs(_Fragment, { children: [_jsx(Text, { size: "lg", variant: "secondary", className: "mb-8", children: t("subtitle") }), _jsx(FlowDiagram, { title: `🚚 ${t("diagramTitle")}`, titleClass: "text-sky-700 dark:text-sky-300", connectorClass: "bg-sky-200 dark:bg-sky-800", steps: DIAGRAM_STEPS, className: "mb-10", note: `📌 ${t("diagramNote")}` }), _jsxs(Stack, { gap: "xl", children: [SECTIONS.map(({ title, text }) => (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-3", children: title }), _jsx(Text, { variant: "secondary", className: "leading-relaxed", children: text })] }, title))), _jsxs(Section, { rounded: "xl", padding: "lg", border: "default", surface: "subtle", children: [_jsx(Heading, { level: 2, className: "mb-2", children: t("contactTitle") }), _jsx(Text, { variant: "secondary", children: t("contactText") })] })] })] })), _jsxs(Div, { layout: "flex", gap: "6", textSize: "sm", className: `mt-12 border-t`, border: "default", padding: "t-xl", children: [_jsx(TextLink, { href: String(ROUTES.PUBLIC.TRACK_ORDER), className: CLS_FOOTER_LINK, children: t("trackOrder") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.HELP), className: CLS_FOOTER_LINK, children: t("helpCenter") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.CONTACT), className: CLS_FOOTER_LINK, children: t("contactUs") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.REFUND_POLICY), className: CLS_FOOTER_LINK, children: "Refund Policy" })] })] })] }));
 }

package/dist/features/account/api/[userId]/addresses/route.js

@@ -40,7 +40,7 @@ export async function GET(request, { params }) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/account/components/NotificationBell.js

@@ -109,5 +109,5 @@ function renderNotificationListContent(props) {
         return _jsx(Row, { align: "center", justify: "center", padding: "y-2xl", children: _jsx(Spinner, { size: "md" }) });
     if (notifications.length === 0)
         return (_jsxs(Stack, { justify: "center", className: "text-left", paddingY: "y-2xl", paddingX: "x-md", align: "start", children: [_jsx("svg", { className: "w-12 h-12 text-[var(--appkit-color-text-faint)] mb-3", fill: "none", stroke: "currentColor", viewBox: "0 0 24 24", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", strokeWidth: 1.5, d: "M15 17h5l-1.405-1.405A2.032 2.032 0 0118 14.158V11a6.002 6.002 0 00-4-5.659V5a2 2 0 10-4 0v.341C7.67 6.165 6 8.388 6 11v3.159c0 .538-.214 1.055-.595 1.436L4 17h5m6 0v1a3 3 0 11-6 0v-1m6 0H9" }) }), _jsx(Text, { weight: "medium", color: "primary", children: labels.empty }), _jsx(Text, { size: "sm", className: "mt-1", color: "muted", children: labels.emptyDesc })] }));
-    return (_jsx(Ul, { children: notifications.map((notification) => (_jsxs(Li, { layout: "flex-start", gap: "3", padding: "inline", className: `group border-b border-[var(--appkit-color-border)] last:border-0 transition-colors hover:bg-[var(--appkit-color-bg)] dark:hover:bg-[var(--appkit-color-surface-elevated)] ${!notification.isRead ? "bg-primary/5 dark:bg-primary/10" : ""}`, children: [_jsx(Span, { size: "xl", className: "flex-shrink-0 mt-0.5", children: notificationIcons[notification.type] ?? "🔔" }), _jsxs(Div, { className: "flex-1 min-w-0", children: [_jsxs(Row, { align: "start", justify: "between", gap: "xs", children: [_jsxs(Text, { size: "sm", className: "leading-tight", color: "primary", weight: "medium", children: [notification.title, !notification.isRead && _jsx(Span, { className: "ml-1.5 inline-block w-2 h-2 bg-primary flex-shrink-0 align-middle", rounded: "full" })] }), _jsx(Span, { size: "xs", className: "flex-shrink-0", color: "muted", children: formatRelativeTime(notification.createdAt) })] }), _jsx(Text, { size: "sm", className: `mt-0.5`, truncate: 2, color: "muted", children: notification.message }), _jsxs(Row, { gap: "3", className: "mt-1.5", children: [notification.actionUrl && renderActionLink({ href: notification.actionUrl, onClick: () => { void handleMarkReadAndClose(notification); }, className: "text-[length:var(--appkit-text-xs)] text-primary hover:underline font-medium", children: notification.actionLabel ?? labels.viewAction }), !notification.isRead && _jsx(Button, { variant: "ghost", onClick: () => void handleMarkRead(notification.id), className: "text-[length:var(--appkit-text-xs)] text-[var(--appkit-color-text-muted)] hover:text-zinc-700 hover:text-[var(--appkit-color-text-muted)] hover:underline p-[var(--appkit-space-0)] h-auto", children: labels.markRead })] })] })] }, notification.id))) }));
+    return (_jsx(Ul, { children: notifications.map((notification) => (_jsxs(Li, { layout: "flex-start", gap: "3", padding: "inline", className: `group border-b border-[var(--appkit-color-border)] last:border-0 transition-colors hover:bg-[var(--appkit-color-bg)] dark:hover:bg-[var(--appkit-color-surface-elevated)] ${!notification.isRead ? "bg-primary/5 dark:bg-primary/10" : ""}`, children: [_jsx(Span, { size: "xl", className: "flex-shrink-0 mt-0.5", children: notificationIcons[notification.type] ?? "🔔" }), _jsxs(Div, { className: "flex-1 min-w-0", children: [_jsxs(Row, { align: "start", justify: "between", gap: "xs", children: [_jsxs(Text, { size: "sm", className: "leading-tight", color: "primary", weight: "medium", children: [notification.title, !notification.isRead && _jsx(Span, { className: "ml-1.5 inline-block w-2 h-2 bg-primary flex-shrink-0 align-middle", rounded: "full" })] }), _jsx(Span, { size: "xs", className: "flex-shrink-0", color: "muted", children: formatRelativeTime(notification.createdAt) })] }), _jsx(Text, { size: "sm", className: `mt-0.5`, truncate: 2, color: "muted", children: notification.message }), _jsxs(Row, { gap: "3", className: "mt-1.5", children: [notification.actionUrl && renderActionLink({ href: notification.actionUrl, onClick: () => { void handleMarkReadAndClose(notification); }, className: "text-[length:var(--appkit-text-xs)] text-primary hover:underline font-medium", children: notification.actionLabel ?? labels.viewAction }), !notification.isRead && _jsx(Button, { variant: "ghost", onClick: () => void handleMarkRead(notification.id), className: "text-[length:var(--appkit-text-xs)] text-[var(--appkit-color-text-muted)] hover:text-[var(--appkit-color-text)] hover:underline p-[var(--appkit-space-0)] h-auto", children: labels.markRead })] })] })] }, notification.id))) }));
 }

package/dist/features/account/components/UserBidsView.js

@@ -44,7 +44,7 @@ export function UserBidsView() {
         endpoint: ACCOUNT_ENDPOINTS.BIDS,
         sortOptions: SORT_OPTIONS,
         hideTableView: true,
-        mapRows: (response) => response.bids ?? [],
+        mapRows: (response) => response.items ?? [],
         getTotal: (response, rows) => response.total ?? rows.length,
         buildFilters: (state) => (state.status ? sieveFilter("status", SIEVE_OP.EQ, state.status) : undefined),
         renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsx(FieldSelect, { name: "status", label: "Bid status", value: pendingFilters.status || "", onChange: (v) => setPendingFilters((p) => ({ ...p, status: v })), options: STATUS_OPTIONS })),

package/dist/features/account/components/index.d.ts

@@ -14,17 +14,11 @@ export { UserAccountHubView } from "./UserAccountHubView";
 export type { UserAccountHubViewProps, UserAccountHubViewLabels, } from "./UserAccountHubView";
 export { ProfileView } from "./ProfileView";
 export type { ProfileViewProps, ProfileViewLabels } from "./ProfileView";
-export { UserSettingsView } from "./UserSettingsView";
-export type { UserSettingsViewProps, UserSettingsViewLabels, } from "./UserSettingsView";
 export { UserOrdersView } from "./UserOrdersView";
 export type { UserOrdersViewProps } from "./UserOrdersView";
 export { UserBidsView } from "./UserBidsView";
 export { OrderDetailView } from "./OrderDetailView";
 export type { OrderDetailViewProps, OrderDetailViewLabels, } from "./OrderDetailView";
-export { UserAddressesView } from "./UserAddressesView";
-export type { UserAddressesViewProps, UserAddressesViewLabels, } from "./UserAddressesView";
-export { UserNotificationsView } from "./UserNotificationsView";
-export type { UserNotificationsViewProps, UserNotificationsViewLabels, } from "./UserNotificationsView";
 export { UserOffersPanel } from "./UserOffersPanel";
 export type { UserOffersPanelProps } from "./UserOffersPanel";
 export { BecomeSellerView } from "./BecomeSellerView";
@@ -33,7 +27,5 @@ export { UserOrderTrackView } from "./UserOrderTrackView";
 export type { UserOrderTrackViewProps, UserOrderTrackViewLabels, } from "./UserOrderTrackView";
 export { UserReturnsView } from "./UserReturnsView";
 export type { UserReturnsViewProps } from "./UserReturnsView";
-export { UserSupportView } from "./UserSupportView";
-export type { UserSupportViewProps } from "./UserSupportView";
 export { NotificationPreferencesPanel } from "./NotificationPreferencesPanel";
 export type { NotificationPreferencesPanelProps } from "./NotificationPreferencesPanel";

package/dist/features/account/components/index.js

@@ -6,15 +6,11 @@ export { NotificationBell } from "./NotificationBell.js";
 export { AddressInlineSelect } from "./AddressInlineSelect.js";
 export { UserAccountHubView } from "./UserAccountHubView.js";
 export { ProfileView } from "./ProfileView.js";
-export { UserSettingsView } from "./UserSettingsView.js";
 export { UserOrdersView } from "./UserOrdersView.js";
 export { UserBidsView } from "./UserBidsView.js";
 export { OrderDetailView } from "./OrderDetailView.js";
-export { UserAddressesView } from "./UserAddressesView.js";
-export { UserNotificationsView } from "./UserNotificationsView.js";
 export { UserOffersPanel } from "./UserOffersPanel.js";
 export { BecomeSellerView } from "./BecomeSellerView.js";
 export { UserOrderTrackView } from "./UserOrderTrackView.js";
 export { UserReturnsView } from "./UserReturnsView.js";
-export { UserSupportView } from "./UserSupportView.js";
 export { NotificationPreferencesPanel } from "./NotificationPreferencesPanel.js";

package/dist/features/account/hooks/useProfileStats.js

@@ -4,7 +4,11 @@ import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints.js";
 export function useProfileStats(enabled) {
     const { data: ordersData, isLoading: ordersLoading } = useQuery({
         queryKey: ["user-orders-count"],
-        queryFn: () => apiClient.get(ACCOUNT_ENDPOINTS.ORDERS),
+        queryFn: () => 
+        // `items`, not `orders` — GET /api/user/orders emits the shared list
+        // envelope. Only `total` is read below, so the wrong key never threw
+        // here; it was a false declaration waiting for someone to read it.
+        apiClient.get(ACCOUNT_ENDPOINTS.ORDERS),
         enabled,
     });
     const { data: addressesData, isLoading: addressesLoading } = useQuery({

package/dist/features/addresses/repository/addresses.repository.d.ts

@@ -1,8 +1,8 @@
-import { BaseRepository, type DocumentSnapshot } from "../../../providers/db-firebase";
-import { type AddressBanStatus, type AddressCreateInput, type AddressDocument, type AddressOwnerType, type AddressUpdateInput } from "../schemas";
+import type { JsonValue } from "../../../schemas/types";
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type AddressBanStatus, type AddressCreateInput, type AddressDocument, type AddressPlain, type AddressOwnerType, type AddressUpdateInput } from "../schemas";
 export declare class AddressesRepository extends BaseRepository<AddressDocument> {
     constructor();
-    private decryptAddress;
     /**
      * Declared, not hand-rolled.
      *
@@ -15,9 +15,36 @@ export declare class AddressesRepository extends BaseRepository<AddressDocument>
      * call.
      */
     protected piiFields: readonly ["fullName", "phone", "addressLine1", "addressLine2"];
-    protected mapDoc<D = AddressDocument>(snap: DocumentSnapshot): D;
-    createWithId(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;
-    update(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;
+    /**
+     * Admin search by name, without decryption. ONLY `fullName` — never
+     * `addressLine1`: "find everyone on Brigade Road" is not a capability
+     * admin needs and is the single most re-identifying field on the
+     * document. See `security/blind-index-tokens.ts` for why this is
+     * whole-word rather than a prefix-expanded index.
+     *
+     * Runs through `applyWriteHooks`, so it reaches every write path
+     * including a seed load — which is what makes it survive the tester
+     * harness's cascade on `addresses` (it references `ownerId`, a
+     * PRESERVE-tier user, so the row itself is never actually wiped — but
+     * the field regenerating on every write is what makes that true by
+     * construction rather than by luck).
+     */
+    protected buildTokensIndexFor(data: Record<string, JsonValue>): Record<string, string[]> | null;
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealAddress(doc: AddressDocument): AddressPlain;
+    /** As `revealAddress`, for a list read. */
+    revealAddresss(docs: readonly AddressDocument[]): AddressPlain[];
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedAddress(doc: AddressDocument): AddressPlain;
+    /** As `maskedAddress`, for a list read. */
+    maskedAddresss(docs: readonly AddressDocument[]): AddressPlain[];
+    createWithId(id: string, data: Partial<AddressPlain>): Promise<AddressDocument>;
+    update(id: string, data: Partial<AddressPlain>): Promise<AddressDocument>;
     listByOwner(ownerType: AddressOwnerType, ownerId: string): Promise<AddressDocument[]>;
     /**
      * 🛑 Requires the composite index `(ownerType ASC, createdAt DESC)`.

package/dist/features/addresses/repository/addresses.repository.js

@@ -13,7 +13,8 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { serverLogger } from "../../../monitoring/index.js";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, } from "../../../providers/db-firebase/index.js";
-import { ADDRESS_PII_FIELDS, decryptPiiFields, } from "../../../security/index.js";
+import { maskPii, revealPii, ADDRESS_PII_FIELDS, } from "../../../security/index.js";
+import { buildTokensIndex } from "../../../security/blind-index-tokens.js";
 import { ADDRESS_FIELDS, ADDRESSES_COLLECTION, } from "../schemas/index.js";
 export class AddressesRepository extends BaseRepository {
     constructor() {
@@ -31,17 +32,73 @@ export class AddressesRepository extends BaseRepository {
          */
         this.piiFields = ADDRESS_PII_FIELDS;
     }
-    decryptAddress(doc) {
-        return decryptPiiFields(doc, [...ADDRESS_PII_FIELDS]);
+    /**
+     * Admin search by name, without decryption. ONLY `fullName` — never
+     * `addressLine1`: "find everyone on Brigade Road" is not a capability
+     * admin needs and is the single most re-identifying field on the
+     * document. See `security/blind-index-tokens.ts` for why this is
+     * whole-word rather than a prefix-expanded index.
+     *
+     * Runs through `applyWriteHooks`, so it reaches every write path
+     * including a seed load — which is what makes it survive the tester
+     * harness's cascade on `addresses` (it references `ownerId`, a
+     * PRESERVE-tier user, so the row itself is never actually wiped — but
+     * the field regenerating on every write is what makes that true by
+     * construction rather than by luck).
+     */
+    buildTokensIndexFor(data) {
+        const fullName = typeof data.fullName === "string" ? data.fullName : undefined;
+        if (!fullName)
+            return null;
+        return { nameTokensIndex: buildTokensIndex(fullName) };
+    }
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `AddressDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealAddress(doc) {
+        return revealPii(doc, ADDRESS_PII_FIELDS);
+    }
+    /** As `revealAddress`, for a list read. */
+    revealAddresss(docs) {
+        return docs.map((d) => this.revealAddress(d));
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return this.decryptAddress(raw);
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedAddress(doc) {
+        return maskPii(doc, ADDRESS_PII_FIELDS);
     }
+    /** As `maskedAddress`, for a list read. */
+    maskedAddresss(docs) {
+        return docs.map((d) => this.maskedAddress(d));
+    }
+    /*
+     * Takes PLAINTEXT, like the base it overrides — this method is what
+     * encrypts (`applyWriteHooks`), so demanding ciphertext from callers
+     * inverted its own contract.
+     */
     async createWithId(id, data) {
         const encrypted = this.applyWriteHooks(data);
         return super.createWithId(id, encrypted);
     }
+    /*
+     * Takes PLAINTEXT, like the base it overrides — this method is the thing
+     * that encrypts (`applyWriteHooks`), so demanding ciphertext from callers
+     * inverted its own contract.
+     */
     async update(id, data) {
         const encrypted = this.applyWriteHooks(data);
         return super.update(id, encrypted);
@@ -105,6 +162,7 @@ export class AddressesRepository extends BaseRepository {
             }
             const now = new Date();
             const docRef = this.getCollection().doc();
+            // Plain in, ciphertext out — the write hook encrypts below.
             const addressData = {
                 ...input,
                 ownerType,
@@ -166,9 +224,27 @@ export class AddressesRepository extends BaseRepository {
         }
         const updateData = { ...input };
         if (input.postalCode || input.addressLine1 || input.addressLine2 !== undefined) {
-            const postalCode = input.postalCode ?? existing.postalCode;
-            const line1 = input.addressLine1 ?? existing.addressLine1;
-            const line2 = input.addressLine2 ?? existing.addressLine2;
+            /*
+             * 🛑 Revealed, because the hash is a BLIND INDEX over plaintext.
+             *
+             * `existing` comes from a find, which no longer decrypts, and these three
+             * fall back to it when the caller did not supply them. Hashing ciphertext
+             * would compute a hash nothing else can reproduce — so every address
+             * edited after this change would stop matching its own duplicates, with
+             * no error and nothing to notice. The brand is what made the fallback
+             * visible; `.postalCode` is not PII and needs no reveal.
+             */
+            const current = this.revealAddress(existing);
+            const postalCode = input.postalCode ?? current.postalCode;
+            const line1 = input.addressLine1 ?? current.addressLine1;
+            const line2 = input.addressLine2 ?? current.addressLine2;
+            /*
+             * The hash is computed from PLAINTEXT, which is the whole point of a
+             * blind index — and `existing` now holds ciphertext, so the three values
+             * feeding it come from the revealed copy above. Casting to the document
+             * shape here would have hashed ciphertext and silently broken
+             * duplicate-detection for every address edited after this change.
+             */
             updateData.addressHash = this.computeAddressHash(postalCode, line1, line2);
         }
         return this.update(addressId, updateData);
@@ -298,6 +374,7 @@ export class AddressesRepository extends BaseRepository {
         }
     }
     async banById(id, banData) {
+        // Plain write payload — see `update`'s own note.
         return this.update(id, {
             banStatus: "banned",
             banReason: banData.banReason,

package/dist/features/addresses/schemas/firestore.d.ts

@@ -8,16 +8,27 @@
  * repository overrides `createWithId` and `create` to inject encryption.
  */
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export type AddressOwnerType = "user" | "store";
 export type AddressBanStatus = "banned" | "unban_requested" | "suspicious";
+/**
+ * `AddressDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type AddressPlain = Plaintext<AddressDocument>;
 export interface AddressDocument extends BaseDocument {
     ownerType: AddressOwnerType;
     ownerId: string;
     label: string;
-    fullName: string;
-    phone: string;
-    addressLine1: string;
-    addressLine2?: string;
+    fullName: Encrypted<string>;
+    phone: Encrypted<string>;
+    addressLine1: Encrypted<string>;
+    addressLine2?: Encrypted<string>;
     landmark?: string;
     city: string;
     state: string;
@@ -40,8 +51,8 @@ export declare const ADDRESS_INDEXED_FIELDS: readonly ["ownerType", "ownerId", "
 export declare const DEFAULT_ADDRESS_DATA: Partial<AddressDocument>;
 export declare const ADDRESS_PUBLIC_FIELDS: readonly ["id", "ownerType", "ownerId", "label", "fullName", "phone", "addressLine1", "addressLine2", "landmark", "city", "state", "postalCode", "country", "isDefault", "addressHash", "banStatus", "banReason", "bannedAt", "autoBanned", "unbanRequestNote", "unbanRequestedAt", "createdAt", "updatedAt"];
 export declare const ADDRESS_UPDATABLE_FIELDS: readonly ["label", "fullName", "phone", "addressLine1", "addressLine2", "landmark", "city", "state", "postalCode", "country", "isDefault", "banStatus", "banReason", "bannedBy", "bannedAt", "autoBanned", "unbanRequestNote", "unbanRequestedAt"];
-export type AddressCreateInput = Omit<AddressDocument, "id" | "ownerType" | "ownerId" | "createdAt" | "updatedAt">;
-export type AddressUpdateInput = Partial<Pick<AddressDocument, (typeof ADDRESS_UPDATABLE_FIELDS)[number]>>;
+export type AddressCreateInput = Omit<AddressPlain, "id" | "ownerType" | "ownerId" | "createdAt" | "updatedAt">;
+export type AddressUpdateInput = Partial<Pick<AddressPlain, (typeof ADDRESS_UPDATABLE_FIELDS)[number]>>;
 export declare const ADDRESS_FIELDS: {
     readonly ID: "id";
     readonly OWNER_TYPE: "ownerType";

package/dist/features/admin/actions/admin-actions.js

@@ -238,7 +238,22 @@ export async function adminUpdateProduct(adminId, id, input) {
         finalized.mainImage = await finalizeStagedMediaUrl(finalized.mainImage);
     }
     if (Array.isArray(finalized.images) && finalized.images.length > 0) {
-        finalized.images = await finalizeStagedMediaArray(finalized.images);
+        /*
+         * 🛑 Finalise the URL and KEEP THE REST OF THE OBJECT (A6).
+         *
+         * `finalizeStagedMediaArray` takes and returns `string[]` — it moves
+         * staged uploads to their permanent path. Handing it
+         * `images.map(i => i.url)` and assigning the result back would have
+         * silently dropped `alt`, `width`, `height` and `thumbnailUrl` on every
+         * admin save: the exact lossy-write failure `toProductImages` carries its
+         * own warning about, on the one code path where a human has just typed
+         * the alt text.
+         */
+        const finalisedUrls = await finalizeStagedMediaArray(finalized.images.map((img) => img.url));
+        finalized.images = finalized.images.map((img, i) => ({
+            ...img,
+            url: finalisedUrls[i] ?? img.url,
+        }));
     }
     if (finalized.video?.url) {
         finalized.video = {