@mohasinac/appkit 4.27.0 → 4.28.0

package/dist/react/ErrorBoundary.js

@@ -51,7 +51,15 @@ export class ErrorBoundary extends Component {
             componentStack: errorInfo.componentStack,
             timestamp: new Date().toISOString(),
         });
-        trackError(error, ErrorCategory.UI, ErrorSeverity.HIGH);
+        // Forward componentStack — `serverErrors` declares the field and, until the
+        // error tracker was wired to the client-error beacon, nothing ever produced
+        // it. It is the fastest way to identify which subtree actually blew up.
+        trackError(error, ErrorCategory.UI, ErrorSeverity.HIGH, {
+            metadata: {
+                componentStack: errorInfo.componentStack ?? null,
+                digest: error.digest ?? null,
+            },
+        });
         this.props.onError?.(error, errorInfo);
     }
     render() {

package/dist/react/contexts/SessionContext.js

@@ -256,8 +256,12 @@ export function SessionProvider({ children, initialUser, endpoints: endpointOver
         }
         // Server revocation and Firebase sign-out fire-and-forget (non-blocking)
         Promise.all([
-            apiClient.post(ep.logout, {}).catch((err) => logger.error("Server logout failed", { err })),
-            adapter.signOut().catch((err) => logger.error("Firebase sign-out failed", { err })),
+            apiClient
+                .post(ep.logout, {})
+                .catch((err) => logger.error("Server logout failed", { error: normalizeError(err).message })),
+            adapter
+                .signOut()
+                .catch((err) => logger.error("Firebase sign-out failed", { error: normalizeError(err).message })),
         ]);
     }, [ep.logout, onSignOutInvalidate, signOutInvalidationKeys]);
     useEffect(() => {

package/dist/react/hooks/useAuthGate.d.ts

@@ -1,8 +1,30 @@
 import type { ActionId } from "../../features/products/constants/action-defs";
 export interface UseAuthGateReturn {
     requireAuth: (actionId: ActionId, fn: () => void | Promise<void>) => void;
+    /**
+     * True while the session is still resolving, or while a click is parked
+     * waiting on it. Drive a spinner / disabled state from this — do NOT use it
+     * to hide the control, or the user loses the affordance mid-page-load.
+     */
+    isAuthResolving: boolean;
     modalOpen: boolean;
     modalMessage: string;
     closeModal: () => void;
 }
+/**
+ * The single auth/permission gate behind every CTA in the app.
+ *
+ * 🛑 `loading` is load-bearing and must never be dropped again.
+ *
+ * This hook used to read only `user` from the session. `SessionProvider` is
+ * mounted with `initialUser={null}` (the root locale layout is static and must
+ * stay that way), so on every hard load `user` is `null` and `loading` is
+ * `true` until Firebase persistence + a profile fetch resolve. Reading `user`
+ * alone made that window indistinguishable from "signed out": a signed-in user
+ * clicking a wishlist heart in the first ~800ms got "You need to be signed in".
+ *
+ * A click that arrives during that window is PARKED and replayed once the
+ * session settles — not dropped. Dropping it is indistinguishable from a dead
+ * button, which is the failure mode this hook is supposed to prevent.
+ */
 export declare function useAuthGate(): UseAuthGateReturn;

package/dist/react/hooks/useAuthGate.js

@@ -1,19 +1,57 @@
 "use client";
-import { useState, useCallback } from "react";
+import { useState, useCallback, useRef, useEffect } from "react";
 import { useAuth } from "../contexts/SessionContext";
 import { useSiteSettings } from "../../core/hooks/useSiteSettings";
 import { ACTION_META } from "../../features/products/constants/action-defs";
 const DEFAULT_MSG = "You need to be signed in to continue.";
 const DISABLED_MSG = "This action is currently unavailable.";
 const PERMISSION_MSG = "You don't have permission to perform this action.";
+/**
+ * Ceiling on how long a click may sit parked waiting for the session to resolve.
+ *
+ * `SessionContext` settles after Firebase persistence resolves AND one
+ * `/api/user/profile` round-trip returns. If that never happens (offline, a
+ * dead adapter) we fall back to the signed-out answer rather than eating the
+ * click forever — a button that never responds is worse than a wrong modal.
+ */
+const AUTH_RESOLVE_TIMEOUT_MS = 8000;
+/**
+ * The single auth/permission gate behind every CTA in the app.
+ *
+ * 🛑 `loading` is load-bearing and must never be dropped again.
+ *
+ * This hook used to read only `user` from the session. `SessionProvider` is
+ * mounted with `initialUser={null}` (the root locale layout is static and must
+ * stay that way), so on every hard load `user` is `null` and `loading` is
+ * `true` until Firebase persistence + a profile fetch resolve. Reading `user`
+ * alone made that window indistinguishable from "signed out": a signed-in user
+ * clicking a wishlist heart in the first ~800ms got "You need to be signed in".
+ *
+ * A click that arrives during that window is PARKED and replayed once the
+ * session settles — not dropped. Dropping it is indistinguishable from a dead
+ * button, which is the failure mode this hook is supposed to prevent.
+ */
 export function useAuthGate() {
-    const { user } = useAuth();
+    const { user, loading } = useAuth();
     const { data: settings } = useSiteSettings();
     const [state, setState] = useState({ open: false, message: "" });
-    const requireAuth = useCallback((actionId, fn) => {
+    const [parked, setParked] = useState(false);
+    const parkedRef = useRef(null);
+    const timerRef = useRef(null);
+    const clearTimer = useCallback(() => {
+        if (timerRef.current) {
+            clearTimeout(timerRef.current);
+            timerRef.current = null;
+        }
+    }, []);
+    /**
+     * The gate decision itself. Only ever called once the session has resolved,
+     * and re-created whenever `user`/`settings` change — which is what keeps a
+     * replayed click from being judged against a stale session.
+     */
+    const evaluate = useCallback((actionId, fn) => {
         const meta = ACTION_META[actionId];
-        const enabled = settings
-            ?.actionConfig?.[actionId]?.enabled ??
+        const enabled = settings?.actionConfig?.[actionId]?.enabled ??
             meta?.defaultEnabled ??
             true;
         if (!enabled) {
@@ -24,12 +62,53 @@ export function useAuthGate() {
             setState({ open: true, message: meta.authMessage ?? DEFAULT_MSG });
             return;
         }
-        if (meta?.requiredPermission && !user?.permissions?.includes(meta.requiredPermission)) {
+        if (meta?.requiredPermission &&
+            !user?.permissions?.includes(meta.requiredPermission)) {
             setState({ open: true, message: PERMISSION_MSG });
             return;
         }
         void fn();
     }, [user, settings]);
+    const requireAuth = useCallback((actionId, fn) => {
+        if (loading) {
+            // Park only {actionId, fn} — the caller's click closure is preserved
+            // verbatim, while the gate's own view of the session is re-read at
+            // drain time via `evaluate`.
+            parkedRef.current = { actionId, fn };
+            setParked(true);
+            clearTimer();
+            timerRef.current = setTimeout(() => {
+                parkedRef.current = null;
+                setParked(false);
+                setState({
+                    open: true,
+                    message: ACTION_META[actionId]?.authMessage ?? DEFAULT_MSG,
+                });
+            }, AUTH_RESOLVE_TIMEOUT_MS);
+            return;
+        }
+        evaluate(actionId, fn);
+    }, [loading, evaluate, clearTimer]);
+    // Drain the parked click with a FRESH user/settings closure. The ref is
+    // nulled before `evaluate` runs, so an extra effect pass is a no-op.
+    useEffect(() => {
+        if (loading)
+            return;
+        const request = parkedRef.current;
+        if (!request)
+            return;
+        parkedRef.current = null;
+        clearTimer();
+        setParked(false);
+        evaluate(request.actionId, request.fn);
+    }, [loading, evaluate, clearTimer]);
+    useEffect(() => () => clearTimer(), [clearTimer]);
     const closeModal = useCallback(() => setState((s) => ({ ...s, open: false })), []);
-    return { requireAuth, modalOpen: state.open, modalMessage: state.message, closeModal };
+    return {
+        requireAuth,
+        isAuthResolving: loading || parked,
+        modalOpen: state.open,
+        modalMessage: state.message,
+        closeModal,
+    };
 }

package/dist/schemas/registry.d.ts

@@ -2017,7 +2017,7 @@ export declare const SCHEMAS: {
             order: import("zod").ZodNumber;
             priority: import("zod").ZodNumber;
             tags: import("zod").ZodArray<import("zod").ZodString, "many">;
-            searchTokens: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
+            searchTxt: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
             relatedFAQs: import("zod").ZodArray<import("zod").ZodString, "many">;
             useSiteSettings: import("zod").ZodBoolean;
             variables: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>>;
@@ -2099,7 +2099,7 @@ export declare const SCHEMAS: {
                 metaTitle?: string | undefined;
                 metaDescription?: string | undefined;
             };
-            searchTokens?: string[] | undefined;
+            searchTxt?: string[] | undefined;
             variables?: Record<string, string> | undefined;
         }, {
             id: string;
@@ -2138,7 +2138,7 @@ export declare const SCHEMAS: {
                 metaTitle?: string | undefined;
                 metaDescription?: string | undefined;
             };
-            searchTokens?: string[] | undefined;
+            searchTxt?: string[] | undefined;
             variables?: Record<string, string> | undefined;
         }>;
         readonly groupedListings: import("zod").ZodObject<{

package/dist/security/index.d.ts

@@ -4,7 +4,7 @@ export type { RateLimitConfig, RateLimitResult } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";

package/dist/security/index.js

@@ -2,7 +2,7 @@ export { generateNonce, buildCSP } from "./csp";
 export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, getClientIP, hashGuestIdentity, } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 // Crypto-free display-masking helpers -- sourced from pii-mask.ts (not
 // pii-encrypt.ts) so this barrel stays safe to re-export from the
 // universal client+server index.ts. See pii-mask.ts's header comment.

package/dist/security/pii-encrypt.d.ts

@@ -21,11 +21,6 @@ export declare function decryptValue(ciphertext: string): string;
  * Used for equality lookups without decrypting (e.g. find-by-email).
  */
 export declare function hmacBlindIndex(value: string): string;
-/**
- * Encrypt specified PII fields in a Firestore document.
- * For each encrypted field, a `<field>Index` blind-index sibling is added.
- * Already-encrypted values (prefix `enc:v1:`) are left unchanged.
- */
 export declare function encryptPiiFields<T extends object>(doc: T, piiFields: string[]): T;
 /**
  * Decrypt specified PII fields in a Firestore document.
@@ -43,6 +38,19 @@ export declare function piiBlindIndex(plaintext: string): string;
  * For each mapping entry (e.g. { email: "emailIndex" }), if the source field
  * is a non-empty string, computes the HMAC and stores it as the index field.
  */
+/**
+ * Blind-index fields ONLY — derived from `source` (which must be plaintext),
+ * with none of `source`'s own keys carried along.
+ *
+ * Use this, never `addPiiIndices`, when merging indices onto an already-encrypted
+ * object. `addPiiIndices` returns `{...source, ...indices}`, so spreading its
+ * result over ciphertext silently restores the plaintext — which is exactly how
+ * `payouts.sellerEmail`, `payouts.upiId` and `reviews.userName` ended up stored
+ * in cleartext beside a valid index.
+ *
+ * @param source plaintext document — hashing ciphertext produces a useless index
+ */
+export declare function piiIndicesFor(source: object, mapping: Record<string, string>): Record<string, string>;
 export declare function addPiiIndices<T extends object>(obj: T, mapping: Record<string, string>): T;
 /**
  * Encrypt PII inside a shipping address stored in an order.

package/dist/security/pii-encrypt.js

@@ -99,17 +99,92 @@ export function hmacBlindIndex(value) {
  * For each encrypted field, a `<field>Index` blind-index sibling is added.
  * Already-encrypted values (prefix `enc:v1:`) are left unchanged.
  */
+/** Read `a.b.c`, returning undefined if any hop is missing or not an object. */
+function getPath(obj, path) {
+    return path.split(".").reduce((acc, key) => {
+        if (acc === null || typeof acc !== "object")
+            return undefined;
+        return acc[key];
+    }, obj);
+}
+/** Set `a.b.c`, cloning each object along the path so the input is untouched. */
+function setPath(obj, path, value) {
+    const keys = path.split(".");
+    const last = keys.pop();
+    let cursor = obj;
+    for (const key of keys) {
+        const next = cursor[key];
+        if (next === null || typeof next !== "object")
+            return;
+        cursor[key] = { ...next };
+        cursor = cursor[key];
+    }
+    cursor[last] = value;
+}
+/**
+ * Encrypt the named fields, adding a blind index alongside each top-level one.
+ *
+ * Supports dotted paths (`deviceInfo.ip`, `whatsappConfig.accessToken`). This
+ * was a flat top-level loop that skipped anything non-string, which is why
+ * nested PII stayed in plaintext — and why the exported
+ * `STORE_SECRET_FIELDS = ["whatsappConfig.accessToken"]` was unusable by the
+ * very function it was written for.
+ *
+ * Idempotent: a value already carrying `enc:v1:` is left alone, so re-running
+ * over a partially-migrated document is safe.
+ */
+/**
+ * Encrypt `itemPath` on every element of the array at `arrayPath`.
+ *
+ * Spelled `messages[].body` in a PII field list. Without this, array-of-object
+ * PII — conversation message bodies, status-history notes — is written in
+ * plaintext and `mapDoc`'s decrypt never touches it on the way back out: a leak
+ * with no error and no visible symptom.
+ */
+function encryptInArray(root, arrayPath, itemPath) {
+    const arr = getPath(root, arrayPath);
+    if (!Array.isArray(arr))
+        return;
+    const next = arr.map((el) => {
+        if (el === null || typeof el !== "object")
+            return el;
+        const clone = { ...el };
+        const value = itemPath ? getPath(clone, itemPath) : undefined;
+        if (typeof value !== "string" || !value || value.startsWith(ENC_PREFIX)) {
+            return clone;
+        }
+        setPath(clone, itemPath, encryptValue(value));
+        return clone;
+    });
+    setPath(root, arrayPath, next);
+}
 export function encryptPiiFields(doc, piiFields) {
     const result = { ...doc };
-    const source = doc;
     for (const field of piiFields) {
-        const value = source[field];
+        // `messages[].body` — encrypt one property on every element of an array.
+        if (field.includes("[]")) {
+            const [arrayPath, rest] = field.split("[]");
+            encryptInArray(result, arrayPath, rest.replace(/^\./, ""));
+            continue;
+        }
+        const nested = field.includes(".");
+        const value = nested
+            ? getPath(result, field)
+            : result[field];
         if (typeof value !== "string" || !value)
             continue;
         if (value.startsWith(ENC_PREFIX))
             continue; // already encrypted
-        result[field] = encryptValue(value);
-        result[`${field}Index`] = hmacBlindIndex(value);
+        if (nested) {
+            // Blind index deliberately omitted for nested paths: `deviceInfo.ipIndex`
+            // would be a nested sibling nothing queries, and an index only earns its
+            // storage when some lookup actually uses it.
+            setPath(result, field, encryptValue(value));
+        }
+        else {
+            result[field] = encryptValue(value);
+            result[`${field}Index`] = hmacBlindIndex(value);
+        }
     }
     return result;
 }
@@ -119,9 +194,37 @@ export function encryptPiiFields(doc, piiFields) {
  */
 export function decryptPiiFields(doc, piiFields) {
     const result = { ...doc };
-    const source = doc;
     for (const field of piiFields) {
-        const value = source[field];
+        // MUST mirror encryptPiiFields' path handling. This was a flat top-level
+        // loop while encrypt understood dotted and array paths — so a nested field
+        // would be encrypted on write and never decrypted on read, surfacing
+        // ciphertext to callers. Any path form added to one must be added to both.
+        if (field.includes("[]")) {
+            const [arrayPath, rest] = field.split("[]");
+            const itemPath = rest.replace(/^\./, "");
+            const arr = getPath(result, arrayPath);
+            if (!Array.isArray(arr))
+                continue;
+            setPath(result, arrayPath, arr.map((el) => {
+                if (el === null || typeof el !== "object")
+                    return el;
+                const clone = { ...el };
+                const value = itemPath ? getPath(clone, itemPath) : undefined;
+                if (typeof value === "string" && value.startsWith(ENC_PREFIX)) {
+                    setPath(clone, itemPath, decryptValue(value));
+                }
+                return clone;
+            }));
+            continue;
+        }
+        if (field.includes(".")) {
+            const value = getPath(result, field);
+            if (typeof value === "string" && value.startsWith(ENC_PREFIX)) {
+                setPath(result, field, decryptValue(value));
+            }
+            continue;
+        }
+        const value = result[field];
         if (typeof value === "string" && value.startsWith(ENC_PREFIX)) {
             result[field] = decryptValue(value);
         }
@@ -152,6 +255,29 @@ export function piiBlindIndex(plaintext) {
  * For each mapping entry (e.g. { email: "emailIndex" }), if the source field
  * is a non-empty string, computes the HMAC and stores it as the index field.
  */
+/**
+ * Blind-index fields ONLY — derived from `source` (which must be plaintext),
+ * with none of `source`'s own keys carried along.
+ *
+ * Use this, never `addPiiIndices`, when merging indices onto an already-encrypted
+ * object. `addPiiIndices` returns `{...source, ...indices}`, so spreading its
+ * result over ciphertext silently restores the plaintext — which is exactly how
+ * `payouts.sellerEmail`, `payouts.upiId` and `reviews.userName` ended up stored
+ * in cleartext beside a valid index.
+ *
+ * @param source plaintext document — hashing ciphertext produces a useless index
+ */
+export function piiIndicesFor(source, mapping) {
+    const access = source;
+    const indices = {};
+    for (const [sourceField, indexField] of Object.entries(mapping)) {
+        const val = access[sourceField];
+        if (typeof val === "string" && val) {
+            indices[indexField] = piiBlindIndex(val);
+        }
+    }
+    return indices;
+}
 export function addPiiIndices(obj, mapping) {
     const result = { ...obj };
     const access = result;

package/dist/security/pii-schemas.d.ts

@@ -16,14 +16,30 @@ export declare const ORDER_PII_FIELDS: readonly ["userName", "userEmail", "selle
 export declare const PAYOUT_PII_FIELDS: readonly ["sellerEmail", "upiId"];
 /** Blind-index mapping for queryable payout PII */
 export declare const PAYOUT_PII_INDEX_MAP: Record<string, string>;
-/** PII fields in bids */
-export declare const BID_PII_FIELDS: readonly [];
+/**
+ * PII fields in bids.
+ *
+ * `userEmail` only. `userName` is deliberately NOT encrypted: the seller bid
+ * search (`/api/store/bids`) does a prefix match on it, and encryption and
+ * partial-match search are mutually exclusive over the same field — ciphertext
+ * has no usable prefix. Encrypting it would silently break that search.
+ * Bidder names are already masked on the public side by `maskPublicBid`.
+ */
+export declare const BID_PII_FIELDS: readonly ["userEmail"];
 /** PII fields in newsletter subscribers */
 export declare const NEWSLETTER_PII_FIELDS: readonly [];
 /** Blind-index mapping for newsletter subscribers */
 export declare const NEWSLETTER_PII_INDEX_MAP: Record<string, string>;
-/** PII fields in tokens (email verification / password reset) */
-export declare const TOKEN_PII_FIELDS: readonly [];
+/**
+ * PII fields in tokens (email verification / password reset).
+ *
+ * Was an empty array, so the encrypt/decrypt machinery wrapped around these
+ * repositories was a no-op and every verification/reset email sat in cleartext.
+ * Safe to enable because `findByEmail` already queries the blind index first
+ * and falls back to plaintext equality, so legacy rows keep resolving while new
+ * ones are encrypted.
+ */
+export declare const TOKEN_PII_FIELDS: readonly ["email"];
 /** Blind-index mapping for token email queries */
 export declare const TOKEN_PII_INDEX_MAP: Record<string, string>;
 /** PII fields in reviews */

package/dist/security/pii-schemas.js

@@ -30,16 +30,34 @@ export const PAYOUT_PII_FIELDS = ["sellerEmail", "upiId"];
 export const PAYOUT_PII_INDEX_MAP = {
     sellerEmail: "sellerEmailIndex",
 };
-/** PII fields in bids */
-export const BID_PII_FIELDS = [];
+/**
+ * PII fields in bids.
+ *
+ * `userEmail` only. `userName` is deliberately NOT encrypted: the seller bid
+ * search (`/api/store/bids`) does a prefix match on it, and encryption and
+ * partial-match search are mutually exclusive over the same field — ciphertext
+ * has no usable prefix. Encrypting it would silently break that search.
+ * Bidder names are already masked on the public side by `maskPublicBid`.
+ */
+export const BID_PII_FIELDS = ["userEmail"];
 /** PII fields in newsletter subscribers */
 export const NEWSLETTER_PII_FIELDS = [];
 /** Blind-index mapping for newsletter subscribers */
 export const NEWSLETTER_PII_INDEX_MAP = {};
-/** PII fields in tokens (email verification / password reset) */
-export const TOKEN_PII_FIELDS = [];
+/**
+ * PII fields in tokens (email verification / password reset).
+ *
+ * Was an empty array, so the encrypt/decrypt machinery wrapped around these
+ * repositories was a no-op and every verification/reset email sat in cleartext.
+ * Safe to enable because `findByEmail` already queries the blind index first
+ * and falls back to plaintext equality, so legacy rows keep resolving while new
+ * ones are encrypted.
+ */
+export const TOKEN_PII_FIELDS = ["email"];
 /** Blind-index mapping for token email queries */
-export const TOKEN_PII_INDEX_MAP = {};
+export const TOKEN_PII_INDEX_MAP = {
+    email: "emailIndex",
+};
 /** PII fields in reviews */
 export const REVIEW_PII_FIELDS = ["userName"];
 /** Blind-index mapping for queryable review PII */

package/dist/seed/_helpers/product-search-txt.d.ts

@@ -0,0 +1,18 @@
+import type { ProductDocument } from "../../features/products/schemas";
+/**
+ * Derive `searchTxt` for a seeded product from its own content.
+ *
+ * Applied to the WHOLE array at each file's export rather than written per
+ * record. Four of the product seed files built records as inline literals with
+ * an inline `searchTxt:`, and in every one of them the last record — the
+ * "sold"/"depleted" fixture appended at the bottom — had been added without it.
+ * Those are exactly the rows the "Sold & Ended" scope exists to exercise, so
+ * they were invisible to search in the one view built to show them.
+ *
+ * The `...p` spread comes FIRST so a record cannot override or omit the field:
+ * that ordering is the actual guarantee, not the convention around it.
+ *
+ * Pure function of the record's content — deterministic, so this does not
+ * reintroduce the `appkit-seed` idempotency problem of Root Cause #25.
+ */
+export declare function withProductSearchTxt(p: Partial<ProductDocument>): Partial<ProductDocument>;

package/dist/seed/_helpers/product-search-txt.js

@@ -0,0 +1,33 @@
+import { buildSearchTxt } from "../../utils/search-txt";
+/**
+ * Derive `searchTxt` for a seeded product from its own content.
+ *
+ * Applied to the WHOLE array at each file's export rather than written per
+ * record. Four of the product seed files built records as inline literals with
+ * an inline `searchTxt:`, and in every one of them the last record — the
+ * "sold"/"depleted" fixture appended at the bottom — had been added without it.
+ * Those are exactly the rows the "Sold & Ended" scope exists to exercise, so
+ * they were invisible to search in the one view built to show them.
+ *
+ * The `...p` spread comes FIRST so a record cannot override or omit the field:
+ * that ordering is the actual guarantee, not the convention around it.
+ *
+ * Pure function of the record's content — deterministic, so this does not
+ * reintroduce the `appkit-seed` idempotency problem of Root Cause #25.
+ */
+export function withProductSearchTxt(p) {
+    return {
+        ...p,
+        searchTxt: buildSearchTxt([
+            p.title,
+            p.description,
+            p.brand,
+            p.brandSlug,
+            p.categoryNames,
+            p.tags,
+            p.features,
+            p.condition,
+            p.specifications?.map((s) => `${s.name} ${s.value}`),
+        ]),
+    };
+}

package/dist/seed/faq-seed-data.d.ts

@@ -1,2 +1,18 @@
 import type { FAQDocument } from "../features/faq/schemas";
+/**
+ * Derive `searchTxt` for every record from its own content.
+ *
+ * This is why FAQ search returned nothing: the seed writes documents raw via
+ * `batch.set()` (both `seed/runner.ts` and `seed-cli.mjs`), bypassing
+ * `FirebaseFAQsRepository.create()` — the only thing that built tokens. So all
+ * 63 seeded FAQs had no `searchTokens` field at all and `array-contains`
+ * matched zero documents, for every query, forever.
+ *
+ * Derived here rather than hand-written per record so a new FAQ cannot be added
+ * without tokens, and computed with the SAME `buildFaqSearchTxt` the repository
+ * uses so seeded and admin-created FAQs are byte-identical.
+ *
+ * Pure function of the record's own content — deterministic, so this does not
+ * reintroduce the `appkit-seed` idempotency problem of Root Cause #25.
+ */
 export declare const faqSeedData: Partial<FAQDocument>[];

package/dist/seed/faq-seed-data.js

@@ -16,11 +16,12 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
+import { buildFaqSearchTxt } from "../features/faq/repository/faqs.repository";
 const NOW = new Date();
 const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
 const html = (text) => ({ text, format: "html" });
 const makeStats = (views = 0, helpful = 0) => ({ views, helpful, notHelpful: 0 });
-export const faqSeedData = [
+const faqSeedRecords = [
     // ── GENERAL (10) ────────────────────────────────────────────────────────────
     {
         id: "faq-what-is-letitrip",
@@ -1234,3 +1235,23 @@ export const faqSeedData = [
         updatedAt: daysAgo(1),
     },
 ];
+/**
+ * Derive `searchTxt` for every record from its own content.
+ *
+ * This is why FAQ search returned nothing: the seed writes documents raw via
+ * `batch.set()` (both `seed/runner.ts` and `seed-cli.mjs`), bypassing
+ * `FirebaseFAQsRepository.create()` — the only thing that built tokens. So all
+ * 63 seeded FAQs had no `searchTokens` field at all and `array-contains`
+ * matched zero documents, for every query, forever.
+ *
+ * Derived here rather than hand-written per record so a new FAQ cannot be added
+ * without tokens, and computed with the SAME `buildFaqSearchTxt` the repository
+ * uses so seeded and admin-created FAQs are byte-identical.
+ *
+ * Pure function of the record's own content — deterministic, so this does not
+ * reintroduce the `appkit-seed` idempotency problem of Root Cause #25.
+ */
+export const faqSeedData = faqSeedRecords.map((faq) => ({
+    ...faq,
+    searchTxt: buildFaqSearchTxt(faq),
+}));