@mohasinac/appkit 4.28.0 → 4.29.1

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -27,7 +27,7 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  */
 export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["searchTxt", "updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -26,6 +26,11 @@ export const PUBLIC_STORE_FIELDS = [
 ];
 /** Everything else, with the reason it stays server-side. */
 export const PRIVATE_STORE_FIELDS = [
+    // Internal search index, not content. It is a normalized re-encoding of
+    // storeName/description/category — publishing it would leak nothing new, but
+    // it has no client reader and would bloat every store payload with a few
+    // hundred tokens.
+    "searchTxt",
     "updatedAt", // bookkeeping; no public reader
     "whatsappConfig", // Meta access token + WABA/catalog ids — secret
     "adminNotes", // schema comment: never shown to the owner or the public

package/dist/_internal/server/jobs/handlers/_helpers.d.ts

@@ -10,5 +10,27 @@ export { getAdminRealtimeDb };
  * Query docs tagged isTestData:true in a collection. `cutoff: null` returns every
  * tester-sandbox doc regardless of expiry (manual force-purge); a real Date returns
  * only the ones past testDataExpiresAt (the scheduled 7-day sweep).
+ *
+ * ## 🛑 `isTestData` without `testDataExpiresAt` means PERMANENT, never purge
+ *
+ * The flag has two uses, and only one of them is a sandbox fixture:
+ *
+ *   · a fixture — `isTestData: true` PLUS `testDataExpiresAt`. Disposable,
+ *     swept on the 7-day cycle. Every doc in `features/tester/seed-data/` is
+ *     this shape; the invariant was checked across all six files.
+ *   · permanently hidden — `isTestData: true` and NO expiry. Real, permanent
+ *     content that simply must not reach the public or the sitemap.
+ *     `store-tester-qa-seller` is the case that forced this distinction.
+ *
+ * The scheduled path already separates them: `testDataExpiresAt <= cutoff`
+ * excludes docs lacking the field. The FORCE path did not — `cutoff: null`
+ * drops that clause and returned everything, so `tester:purge-sandbox --force`
+ * would have deleted a permanent seed store. Hence the filter below.
+ *
+ * Filtered in memory rather than as a query clause: a Firestore inequality on
+ * `testDataExpiresAt` would exclude every doc missing it, which is the trap
+ * documented in CLAUDE.md's anti-pattern table — correct here by luck, wrong
+ * the moment someone reuses the shape. In-memory keeps the intent legible, and
+ * the read is already bounded at 200.
  */
 export declare function getTestDataRefs(db: FirebaseFirestore.Firestore, collection: string, cutoff: Date | null): Promise<FirebaseFirestore.DocumentReference[]>;

package/dist/_internal/server/jobs/handlers/_helpers.js

@@ -22,6 +22,28 @@ export { getAdminRealtimeDb };
  * Query docs tagged isTestData:true in a collection. `cutoff: null` returns every
  * tester-sandbox doc regardless of expiry (manual force-purge); a real Date returns
  * only the ones past testDataExpiresAt (the scheduled 7-day sweep).
+ *
+ * ## 🛑 `isTestData` without `testDataExpiresAt` means PERMANENT, never purge
+ *
+ * The flag has two uses, and only one of them is a sandbox fixture:
+ *
+ *   · a fixture — `isTestData: true` PLUS `testDataExpiresAt`. Disposable,
+ *     swept on the 7-day cycle. Every doc in `features/tester/seed-data/` is
+ *     this shape; the invariant was checked across all six files.
+ *   · permanently hidden — `isTestData: true` and NO expiry. Real, permanent
+ *     content that simply must not reach the public or the sitemap.
+ *     `store-tester-qa-seller` is the case that forced this distinction.
+ *
+ * The scheduled path already separates them: `testDataExpiresAt <= cutoff`
+ * excludes docs lacking the field. The FORCE path did not — `cutoff: null`
+ * drops that clause and returned everything, so `tester:purge-sandbox --force`
+ * would have deleted a permanent seed store. Hence the filter below.
+ *
+ * Filtered in memory rather than as a query clause: a Firestore inequality on
+ * `testDataExpiresAt` would exclude every doc missing it, which is the trap
+ * documented in CLAUDE.md's anti-pattern table — correct here by luck, wrong
+ * the moment someone reuses the shape. In-memory keeps the intent legible, and
+ * the read is already bounded at 200.
  */
 export async function getTestDataRefs(db, collection, cutoff) {
     let q = db
@@ -30,5 +52,7 @@ export async function getTestDataRefs(db, collection, cutoff) {
     if (cutoff)
         q = q.where("testDataExpiresAt", "<=", cutoff);
     const snap = await q.limit(200).get();
-    return snap.docs.map((d) => d.ref);
+    return snap.docs
+        .filter((d) => cutoff !== null || d.get("testDataExpiresAt") != null)
+        .map((d) => d.ref);
 }

package/dist/features/admin/components/AdminContentGuideView.js

@@ -14,7 +14,7 @@ export function AdminContentGuideView() {
                 },
                 {
                     Icon: BookOpen, title: "FAQs",
-                    content: (_jsxs(Ul, { className: GC.listMuted, children: [_jsxs(Li, { children: [_jsx(Span, { weight: "bold", children: "Categories" }), " and where they appear: Shipping (help + footer), Returns (help), Payments (help), Auctions (help), Pre-orders (help). Set ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "showOnHomepage: true" }), " for up to 5 FAQs shown on the public home page."] }), _jsxs(Li, { children: [_jsx(Span, { weight: "bold", children: "searchTokens[]" }), ": Must be manually filled \u2014 drives the FAQ search feature. Include synonyms, misspellings, and related keywords."] }), _jsxs(Li, { children: [_jsx(Span, { weight: "bold", children: "priority + order" }), ": ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "priority" }), " sorts FAQs within their category; ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "order" }), " is the global absolute position. ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "isPinned: true" }), " floats the FAQ above non-pinned items in its category."] })] })),
+                    content: (_jsxs(Ul, { className: GC.listMuted, children: [_jsxs(Li, { children: [_jsx(Span, { weight: "bold", children: "Categories" }), " and where they appear: Shipping (help + footer), Returns (help), Payments (help), Auctions (help), Pre-orders (help). Set ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "showOnHomepage: true" }), " for up to 5 FAQs shown on the public home page."] }), _jsxs(Li, { children: [_jsx(Span, { weight: "bold", children: "Search" }), ": handled automatically \u2014 search terms are derived from the question, answer, category and tags when you save. There is nothing to fill in."] }), _jsxs(Li, { children: [_jsx(Span, { weight: "bold", children: "priority + order" }), ": ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "priority" }), " sorts FAQs within their category; ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "order" }), " is the global absolute position. ", _jsx(Code, { size: "xs", padding: "xs", rounded: "default", surface: "subtle", children: "isPinned: true" }), " floats the FAQ above non-pinned items in its category."] })] })),
                 },
                 {
                     Icon: Layout, title: "Carousel Slides",

package/dist/features/blog/repository/blog.repository.d.ts

@@ -18,6 +18,10 @@ declare class BlogRepository extends BaseRepository<BlogPostDocument> {
     /** Other published posts by the same author. */
     findByAuthor(authorId: string, excludeId: string, limit?: number): Promise<BlogPostDocument[]>;
     static readonly SIEVE_FIELDS: {
+        searchTxt: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
         id: {
             canFilter: boolean;
             canSort: boolean;

package/dist/features/blog/repository/blog.repository.js

@@ -161,6 +161,7 @@ class BlogRepository extends BaseRepository {
     }
 }
 BlogRepository.SIEVE_FIELDS = {
+    searchTxt: { canFilter: true, canSort: false },
     id: { canFilter: true, canSort: false },
     title: { canFilter: true, canSort: true },
     slug: { canFilter: true, canSort: false },

package/dist/features/blog/schemas/firestore.d.ts

@@ -11,6 +11,8 @@ export declare const BlogPostStatusValues: {
     readonly ARCHIVED: BlogPostStatus;
 };
 export interface BlogPostDocument extends BaseDocument {
+    /** Normalized edge-n-gram search field — see appkit/src/utils/search-txt.ts. */
+    searchTxt?: string[];
     title: string;
     slug: string;
     excerpt: string;
@@ -38,7 +40,7 @@ export interface BlogPostDocument extends BaseDocument {
     metaDescription?: string;
 }
 export declare const BLOG_POSTS_COLLECTION: "blogPosts";
-export declare const BLOG_POSTS_INDEXED_FIELDS: readonly ["status", "publishedAt", "isFeatured", "category", "slug"];
+export declare const BLOG_POSTS_INDEXED_FIELDS: readonly ["searchTxt", "status", "publishedAt", "isFeatured", "category", "slug"];
 export declare const BLOG_POST_FIELDS: {
     readonly ID: "id";
     readonly TITLE: "title";

package/dist/features/blog/schemas/firestore.js

@@ -10,6 +10,7 @@ export const BlogPostStatusValues = {
 };
 export const BLOG_POSTS_COLLECTION = "blogPosts";
 export const BLOG_POSTS_INDEXED_FIELDS = [
+    "searchTxt",
     "status",
     "publishedAt",
     "isFeatured",

package/dist/features/events/repository/events.repository.js

@@ -166,6 +166,7 @@ class EventRepository extends BaseRepository {
     }
 }
 EventRepository.SIEVE_FIELDS = {
+    searchTxt: { canFilter: true, canSort: false },
     type: { canFilter: true, canSort: false },
     status: { canFilter: true, canSort: true },
     title: { canFilter: true, canSort: true },

package/dist/features/events/schemas/firestore.d.ts

@@ -9,6 +9,8 @@ import type { LotteryConfig } from "../../lottery/types";
 export declare const EVENTS_COLLECTION: "events";
 export declare const EVENT_ENTRIES_COLLECTION: "eventEntries";
 export interface EventDocument extends BaseDocument {
+    /** Normalized edge-n-gram search field — see appkit/src/utils/search-txt.ts. */
+    searchTxt?: string[];
     slug?: string;
     type: EventType;
     title: string;
@@ -100,7 +102,7 @@ export type EventEntryDocument = {
     guestIpHash?: string;
     submittedAt: Date;
 };
-export declare const EVENT_INDEXED_FIELDS: readonly ["type", "status", "startsAt", "endsAt", "createdAt"];
+export declare const EVENT_INDEXED_FIELDS: readonly ["searchTxt", "type", "status", "startsAt", "endsAt", "createdAt"];
 export declare const EVENT_ENTRY_INDEXED_FIELDS: readonly ["eventId", "userId", "guestIpHash", "reviewStatus", "status", "submittedAt", "points", "spinWonAt"];
 export declare const EVENT_FIELDS: {
     readonly ID: "id";

package/dist/features/events/schemas/firestore.js

@@ -4,6 +4,7 @@
 export const EVENTS_COLLECTION = "events";
 export const EVENT_ENTRIES_COLLECTION = "eventEntries";
 export const EVENT_INDEXED_FIELDS = [
+    "searchTxt",
     "type",
     "status",
     "startsAt",

package/dist/features/messages/repository/conversations.repository.js

@@ -9,6 +9,8 @@
  * or unread counters.
  */
 import { getAdminDb } from "../../../providers/db-firebase";
+import { encryptPiiFields, decryptPiiFields } from "../../../security/pii-encrypt";
+import { CONVERSATION_PII_FIELDS } from "../../../security/pii-schemas";
 import { serverLogger } from "../../../monitoring";
 import { CONVERSATION_FIELDS } from "../../../constants/field-names";
 import { CONVERSATIONS_COLLECTION, } from "../schemas/firestore";
@@ -37,7 +39,11 @@ function normaliseMessage(raw) {
     };
 }
 function normaliseDoc(id, raw) {
-    const r = raw;
+    // Decrypt here rather than at the six call sites: this is the one function
+    // every read path already goes through, so a new reader cannot forget it.
+    // `markRead` deliberately does NOT decrypt — it reads raw messages, flips
+    // isRead and writes them straight back, so ciphertext round-trips untouched.
+    const r = decryptPiiFields(raw, [...CONVERSATION_PII_FIELDS]);
     return {
         id,
         buyerId: String(r.buyerId ?? ""),
@@ -102,8 +108,9 @@ export class ConversationsRepository {
                 createdAt: now,
                 updatedAt: now,
             };
-            tx.set(ref, newDoc);
-            return normaliseDoc(stableId, newDoc);
+            const encryptedDoc = encryptPiiFields(newDoc, [...CONVERSATION_PII_FIELDS]);
+            tx.set(ref, encryptedDoc);
+            return normaliseDoc(stableId, encryptedDoc);
         });
     }
     async findById(id) {
@@ -168,8 +175,11 @@ export class ConversationsRepository {
                     unreadSeller,
                     updatedAt: now,
                 };
-                tx.update(ref, patch);
-                return normaliseDoc(conversationId, { ...data, ...patch });
+                // Encrypt before the write; normaliseDoc decrypts on the way back out,
+                // so the caller still receives plaintext.
+                const encryptedPatch = encryptPiiFields(patch, [...CONVERSATION_PII_FIELDS]);
+                tx.update(ref, encryptedPatch);
+                return normaliseDoc(conversationId, { ...data, ...encryptedPatch });
             });
         }
         catch (error) {

package/dist/features/products/repository/products.repository.js

@@ -373,16 +373,24 @@ export class ProductRepository extends BaseRepository {
         if (opts?.storeId) {
             baseQuery = baseQuery.where(PRODUCT_FIELDS.STORE_ID, "==", opts.storeId);
         }
+        // Longest term first — only ONE may become the array-contains clause.
         const searchTxt = parseSearchTxtQuery(opts?.search ?? "");
-        if (searchTxt.length > 0 && opts?.categoriesIn && opts.categoriesIn.length > 0) {
-            // Firestore cannot combine two array operators in one query
-        }
-        else if (searchTxt.length === 1) {
+        if (searchTxt.length > 0) {
+            // Firestore permits a single array operator per query, so when a search
+            // and a category filter are both present the SEARCH takes the clause and
+            // the category is refined by the caller.
+            //
+            // Two shapes here have each been reverted once and are both guarded by
+            // scripts/audit-search-semantics.mjs:
+            //
+            //   1. This branch was an empty `if` body — it emitted NO clause, so a
+            //      search combined with `categoriesIn` dropped BOTH filters and
+            //      returned an unrelated superset, silently.
+            //   2. Multi-term used `array-contains-any`, which is OR — "red dranzer"
+            //      matched anything with either word. One `array-contains` on the most
+            //      selective term, remaining terms AND-refined against `searchTxt`.
             baseQuery = baseQuery.where(PRODUCT_FIELDS.SEARCH_TXT, "array-contains", searchTxt[0]);
         }
-        else if (searchTxt.length > 1) {
-            baseQuery = baseQuery.where(PRODUCT_FIELDS.SEARCH_TXT, "array-contains-any", searchTxt);
-        }
         if (searchTxt.length === 0 && opts?.categoriesIn && opts.categoriesIn.length > 0) {
             let categoriesIn = opts.categoriesIn;
             if (categoriesIn.length > ProductRepository.MAX_ARRAY_CONTAINS_ANY) {

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -88,6 +88,10 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
     /** Find reviews written by a user filtered by their role as reviewer. */
     findByUserAsRole(userId: string, role: "buyer" | "seller"): Promise<ReviewDocument[]>;
     static readonly SIEVE_FIELDS: {
+        searchTxt: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
         id: {
             canFilter: boolean;
             canSort: boolean;

package/dist/features/reviews/repository/reviews.repository.js

@@ -318,6 +318,7 @@ class ReviewRepository extends BaseRepository {
     }
 }
 ReviewRepository.SIEVE_FIELDS = {
+    searchTxt: { canFilter: true, canSort: false },
     id: { canFilter: true, canSort: false },
     productId: { canFilter: true, canSort: false },
     productTitle: { canFilter: true, canSort: true },

package/dist/features/reviews/schemas/firestore.d.ts

@@ -18,6 +18,8 @@ export interface ReviewVideoField {
     trimEnd?: number;
 }
 export interface ReviewDocument extends BaseDocument {
+    /** Normalized edge-n-gram search field — see appkit/src/utils/search-txt.ts. */
+    searchTxt?: string[];
     productId: string;
     productTitle: string;
     /** Denormalized from the product at review-creation time — drives the correct detail-page link (e.g. prize-draw items link to /prize-draws/[slug], not /products/[slug]). */
@@ -61,7 +63,7 @@ export interface ReviewDocument extends BaseDocument {
     reviewerRole?: "buyer" | "seller";
 }
 export declare const REVIEW_COLLECTION: "reviews";
-export declare const REVIEW_INDEXED_FIELDS: readonly ["productId", "storeId", "userId", "revieweeId", "reviewerRole", "status", "rating", "verified", "featured", "createdAt"];
+export declare const REVIEW_INDEXED_FIELDS: readonly ["searchTxt", "productId", "storeId", "userId", "revieweeId", "reviewerRole", "status", "rating", "verified", "featured", "createdAt"];
 export declare const DEFAULT_REVIEW_DATA: Partial<ReviewDocument>;
 export declare const REVIEW_PUBLIC_FIELDS: readonly ["id", "productId", "userName", "userAvatar", "rating", "title", "comment", "helpfulCount", "verified", "images", "createdAt"];
 export declare const REVIEW_UPDATABLE_FIELDS: readonly ["rating", "title", "comment", "images"];

package/dist/features/reviews/schemas/firestore.js

@@ -10,6 +10,7 @@ export const ReviewStatusValues = {
 };
 export const REVIEW_COLLECTION = "reviews";
 export const REVIEW_INDEXED_FIELDS = [
+    "searchTxt",
     "productId",
     "storeId",
     "userId",

package/dist/features/stores/repository/store.repository.js

@@ -154,6 +154,7 @@ export class StoreRepository extends BaseRepository {
     async listStores(model, activeOnly = true) {
         const sieveFields = {
             [STORE_FIELDS.STORE_NAME]: { canFilter: true, canSort: true },
+            searchTxt: { canFilter: true, canSort: false },
             [STORE_FIELDS.STORE_CATEGORY]: { canFilter: true, canSort: false },
             [STORE_FIELDS.STATUS]: { canFilter: true, canSort: false },
             [STORE_FIELDS.IS_PUBLIC]: { canFilter: true, canSort: false },

package/dist/features/stores/schemas/firestore.d.ts

@@ -49,6 +49,8 @@ export declare const StoreStatusValues: {
 };
 export type StoreStatus = (typeof StoreStatusValues)[keyof typeof StoreStatusValues];
 export interface StoreDocument extends BaseDocument {
+    /** Normalized edge-n-gram search field — see appkit/src/utils/search-txt.ts. */
+    searchTxt?: string[];
     storeSlug: string;
     ownerId: string;
     /** Tester sandbox flag — set on the shared admin-seeded test store; swept by testerSandboxCleanup. */

package/dist/features/tester/repository/tester-checklist-item.repository.d.ts

@@ -4,7 +4,6 @@ import { type TesterChecklistItemDocument, type TesterChecklistItemCreateInput,
 export declare class TesterChecklistItemRepository extends BaseRepository<TesterChecklistItemDocument> {
     static readonly SIEVE_FIELDS: FirebaseSieveFields;
     constructor();
-    private buildSearchTokens;
     createItem(input: TesterChecklistItemCreateInput): Promise<TesterChecklistItemDocument>;
     update(id: string, data: TesterChecklistItemUpdateInput): Promise<TesterChecklistItemDocument>;
     listActive(): Promise<TesterChecklistItemDocument[]>;

package/dist/features/tester/repository/tester-checklist-item.repository.js

@@ -1,24 +1,15 @@
 import { BaseRepository, parseSieveDateValue } from "../../../providers/db-firebase";
+import { buildSearchTxt } from "../../../utils/search-txt";
 import { DatabaseError } from "../../../errors";
 import { TESTER_CHECKLIST_ITEM_COLLECTION, TESTER_CHECKLIST_ITEM_FIELDS, createChecklistItemId, } from "../schemas/firestore";
 export class TesterChecklistItemRepository extends BaseRepository {
     constructor() {
         super(TESTER_CHECKLIST_ITEM_COLLECTION);
     }
-    buildSearchTokens(input) {
-        const rawText = [input.label, input.description, input.groupLabel, input.pageLabel]
-            .filter(Boolean)
-            .join(" ")
-            .toLowerCase();
-        return Array.from(new Set(rawText
-            .split(/[^a-z0-9]+/i)
-            .map((token) => token.trim())
-            .filter((token) => token.length >= 2))).slice(0, 50);
-    }
     async createItem(input) {
         const id = createChecklistItemId(input.groupKey, input.pageKey, input.label);
-        const searchTokens = this.buildSearchTokens(input);
-        return this.createWithId(id, { ...input, searchTokens });
+        const searchTxt = buildSearchTxt([input.label, input.description, input.groupLabel, input.pageLabel]);
+        return this.createWithId(id, { ...input, searchTxt });
     }
     async update(id, data) {
         const current = await this.findById(id);
@@ -28,7 +19,7 @@ export class TesterChecklistItemRepository extends BaseRepository {
         const merged = { ...current, ...data };
         return super.update(id, {
             ...data,
-            searchTokens: this.buildSearchTokens(merged),
+            searchTxt: buildSearchTxt([merged.label, merged.description, merged.groupLabel, merged.pageLabel]),
         });
     }
     async listActive() {
@@ -90,7 +81,7 @@ export class TesterChecklistItemRepository extends BaseRepository {
             isActive: true,
             version: nextVersion,
             previousVersionId: old.id,
-            searchTokens: this.buildSearchTokens(old),
+            searchTxt: buildSearchTxt([old.label, old.description, old.groupLabel, old.pageLabel]),
         });
         await this.update(old.id, { supersededByItemId: newId });
         return newItem;
@@ -129,7 +120,7 @@ TesterChecklistItemRepository.SIEVE_FIELDS = {
     order: { canFilter: true, canSort: true },
     phase: { canFilter: true, canSort: true },
     isActive: { canFilter: true, canSort: false },
-    searchTokens: { canFilter: true, canSort: false },
+    searchTxt: { canFilter: true, canSort: false },
     createdAt: { canFilter: true, canSort: true, parseValue: parseSieveDateValue },
     bugConfirmed: { canFilter: true, canSort: false },
 };

package/dist/features/tester/schemas/firestore.d.ts

@@ -17,7 +17,8 @@ export interface TesterChecklistItemDocument extends BaseDocument {
     order: number;
     phase: number;
     isActive: boolean;
-    searchTokens: string[];
+    /** Normalized edge-n-gram search field. Replaced `searchTokens`. */
+    searchTxt: string[];
     adminOnly?: boolean;
     bugConfirmed?: boolean;
     bugHunterId?: string;
@@ -29,9 +30,9 @@ export interface TesterChecklistItemDocument extends BaseDocument {
 }
 export declare const TESTER_CHECKLIST_ITEM_COLLECTION: "testerChecklistItems";
 export declare const TESTER_CHECKLIST_ITEM_ID_PREFIX: "checklist-";
-export declare const TESTER_CHECKLIST_ITEM_INDEXED_FIELDS: readonly ["groupKey", "pageKey", "phase", "order", "isActive", "searchTokens", "createdAt"];
+export declare const TESTER_CHECKLIST_ITEM_INDEXED_FIELDS: readonly ["groupKey", "pageKey", "phase", "order", "isActive", "searchTxt", "createdAt"];
 export declare const DEFAULT_TESTER_CHECKLIST_ITEM_DATA: Partial<TesterChecklistItemDocument>;
-export type TesterChecklistItemCreateInput = Omit<TesterChecklistItemDocument, "id" | "createdAt" | "updatedAt" | "searchTokens">;
+export type TesterChecklistItemCreateInput = Omit<TesterChecklistItemDocument, "id" | "createdAt" | "updatedAt" | "searchTxt">;
 export type TesterChecklistItemUpdateInput = Partial<Pick<TesterChecklistItemDocument, "groupKey" | "groupLabel" | "pageKey" | "pageLabel" | "label" | "description" | "href" | "order" | "phase" | "isActive" | "adminOnly" | "bugConfirmed" | "bugHunterId" | "bugHunterName" | "bugConfirmedAt" | "version" | "previousVersionId" | "supersededByItemId">>;
 export declare const testerChecklistItemQueryHelpers: {
     readonly byGroup: (groupKey: string) => readonly ["groupKey", "==", string];
@@ -84,7 +85,7 @@ export declare const TESTER_CHECKLIST_ITEM_FIELDS: {
     readonly ORDER: "order";
     readonly PHASE: "phase";
     readonly IS_ACTIVE: "isActive";
-    readonly SEARCH_TOKENS: "searchTokens";
+    readonly SEARCH_TOKENS: "searchTxt";
     readonly ADMIN_ONLY: "adminOnly";
     readonly BUG_CONFIRMED: "bugConfirmed";
     readonly BUG_HUNTER_ID: "bugHunterId";

package/dist/features/tester/schemas/firestore.js

@@ -14,14 +14,14 @@ export const TESTER_CHECKLIST_ITEM_INDEXED_FIELDS = [
     "phase",
     "order",
     "isActive",
-    "searchTokens",
+    "searchTxt",
     "createdAt",
 ];
 export const DEFAULT_TESTER_CHECKLIST_ITEM_DATA = {
     order: 0,
     phase: 1,
     isActive: true,
-    searchTokens: [],
+    searchTxt: [],
     adminOnly: false,
 };
 export const testerChecklistItemQueryHelpers = {
@@ -80,7 +80,7 @@ export const TESTER_CHECKLIST_ITEM_FIELDS = {
     ORDER: "order",
     PHASE: "phase",
     IS_ACTIVE: "isActive",
-    SEARCH_TOKENS: "searchTokens",
+    SEARCH_TOKENS: "searchTxt",
     ADMIN_ONLY: "adminOnly",
     BUG_CONFIRMED: "bugConfirmed",
     BUG_HUNTER_ID: "bugHunterId",

package/dist/security/pii-schemas.d.ts

@@ -42,6 +42,18 @@ export declare const NEWSLETTER_PII_INDEX_MAP: Record<string, string>;
 export declare const TOKEN_PII_FIELDS: readonly ["email"];
 /** Blind-index mapping for token email queries */
 export declare const TOKEN_PII_INDEX_MAP: Record<string, string>;
+/**
+ * PII fields in conversations — buyer↔seller message bodies.
+ *
+ * `messages[].body` uses the array-path form, and `lastMessage` is the
+ * denormalised copy of the newest body: encrypting one without the other would
+ * leave every conversation's latest message readable at rest, which is most of
+ * the exposure.
+ *
+ * Participant display names are deliberately NOT here — decision D1 keeps names
+ * searchable, and both sides already know who they are talking to.
+ */
+export declare const CONVERSATION_PII_FIELDS: readonly ["lastMessage", "messages[].body"];
 /** PII fields in reviews */
 export declare const REVIEW_PII_FIELDS: readonly ["userName"];
 /** Blind-index mapping for queryable review PII */

package/dist/security/pii-schemas.js

@@ -58,6 +58,21 @@ export const TOKEN_PII_FIELDS = ["email"];
 export const TOKEN_PII_INDEX_MAP = {
     email: "emailIndex",
 };
+/**
+ * PII fields in conversations — buyer↔seller message bodies.
+ *
+ * `messages[].body` uses the array-path form, and `lastMessage` is the
+ * denormalised copy of the newest body: encrypting one without the other would
+ * leave every conversation's latest message readable at rest, which is most of
+ * the exposure.
+ *
+ * Participant display names are deliberately NOT here — decision D1 keeps names
+ * searchable, and both sides already know who they are talking to.
+ */
+export const CONVERSATION_PII_FIELDS = [
+    "lastMessage",
+    "messages[].body",
+];
 /** PII fields in reviews */
 export const REVIEW_PII_FIELDS = ["userName"];
 /** Blind-index mapping for queryable review PII */

package/dist/seed/_helpers/search-txt-wrappers.d.ts

@@ -0,0 +1,20 @@
+import type { StoreDocument } from "../../features/stores/schemas";
+import type { EventDocument } from "../../features/events/schemas";
+import type { BlogPostDocument } from "../../features/blog/schemas";
+import type { ReviewDocument } from "../../features/reviews/schemas";
+/** stores — name, description, category. No payout details, no contact. */
+export declare function withStoreSearchTxt<T extends Partial<StoreDocument>>(p: T): T;
+/** events — title, description, type, tags. */
+export declare function withEventSearchTxt<T extends Partial<EventDocument>>(p: T): T;
+/**
+ * blogPosts — title, excerpt, category, tags.
+ *
+ * The full `content` body is deliberately EXCLUDED. FAQ answers are short
+ * (measured: max 449 tokens, avg 200, nothing near the 600 cap), but blog bodies
+ * are an order of magnitude larger and would blow the cap — at which point
+ * `buildSearchTxt` truncates silently and the tail of every post becomes
+ * unsearchable with no error anywhere. The excerpt is the searchable summary.
+ */
+export declare function withBlogSearchTxt<T extends Partial<BlogPostDocument>>(p: T): T;
+/** reviews — title, comment, productTitle. `userName` is PII and excluded. */
+export declare function withReviewSearchTxt<T extends Partial<ReviewDocument>>(p: T): T;

package/dist/seed/_helpers/search-txt-wrappers.js

@@ -0,0 +1,73 @@
+import { buildSearchTxt } from "../../utils/search-txt";
+/**
+ * Per-collection `searchTxt` derivation for seed data.
+ *
+ * Applied to the WHOLE array at each file's export, never per record. Writing
+ * the field inside object literals is how five product seed files shipped their
+ * last fixture — the sold/depleted row — with no tokens at all: the field was
+ * added to every record except the one appended at the bottom. The `...p` spread
+ * comes FIRST here so a record cannot override or omit it.
+ *
+ * All of these are pure functions of the record's own content, so they do not
+ * reintroduce the `appkit-seed` idempotency problem of Root Cause #25.
+ *
+ * 🛑 **No PII in any of these.** `searchTxt` stores readable fragments of the
+ * source text, so feeding it an encrypted field would undo the encryption.
+ * Decision D1: names stay searchable, emails/phones/addresses do not.
+ *
+ * Each wrapper is typed against its own document rather than a shared
+ * `Record<string, unknown>`: that shape trips `audit-unknown-leakage`, and more
+ * importantly it would silently accept a field that no longer exists after a
+ * rename, which is exactly the class of drift this migration is fixing.
+ */
+const stripHtml = (s) => (s ?? "").replace(/<[^>]+>/g, " ");
+/** stores — name, description, category. No payout details, no contact. */
+export function withStoreSearchTxt(p) {
+    return {
+        ...p,
+        searchTxt: buildSearchTxt([
+            p.storeName,
+            stripHtml(p.storeDescription),
+            p.storeCategory,
+        ]),
+    };
+}
+/** events — title, description, type, tags. */
+export function withEventSearchTxt(p) {
+    return {
+        ...p,
+        searchTxt: buildSearchTxt([
+            p.title,
+            stripHtml(p.description),
+            p.type,
+            p.tags ?? [],
+        ]),
+    };
+}
+/**
+ * blogPosts — title, excerpt, category, tags.
+ *
+ * The full `content` body is deliberately EXCLUDED. FAQ answers are short
+ * (measured: max 449 tokens, avg 200, nothing near the 600 cap), but blog bodies
+ * are an order of magnitude larger and would blow the cap — at which point
+ * `buildSearchTxt` truncates silently and the tail of every post becomes
+ * unsearchable with no error anywhere. The excerpt is the searchable summary.
+ */
+export function withBlogSearchTxt(p) {
+    return {
+        ...p,
+        searchTxt: buildSearchTxt([
+            p.title,
+            stripHtml(p.excerpt),
+            p.category,
+            p.tags ?? [],
+        ]),
+    };
+}
+/** reviews — title, comment, productTitle. `userName` is PII and excluded. */
+export function withReviewSearchTxt(p) {
+    return {
+        ...p,
+        searchTxt: buildSearchTxt([p.title, stripHtml(p.comment), p.productTitle]),
+    };
+}

package/dist/seed/blog-posts-seed-data.d.ts

@@ -1,2 +1,6 @@
 import type { BlogPostDocument } from "../features/blog/schemas";
+/**
+ * Tokens derived here, not per record — see _helpers/search-txt-wrappers.ts for
+ * why the wrapper form is what makes omission impossible.
+ */
 export declare const blogPostsSeedData: Partial<BlogPostDocument>[];

package/dist/seed/blog-posts-seed-data.js

@@ -13,10 +13,11 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
+import { withBlogSearchTxt } from "./_helpers/search-txt-wrappers";
 import { seedExtMedia } from "./_helpers/media";
 const NOW = new Date();
 const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
-export const blogPostsSeedData = [
+const _rawblogPostsSeedData = [
     // ── GUIDES (6) ────────────────────────────────────────────────────────────
     {
         id: "blog-spot-genuine-takara-tomy-beyblade",
@@ -434,3 +435,8 @@ export const blogPostsSeedData = [
         updatedAt: daysAgo(60),
     },
 ];
+/**
+ * Tokens derived here, not per record — see _helpers/search-txt-wrappers.ts for
+ * why the wrapper form is what makes omission impossible.
+ */
+export const blogPostsSeedData = _rawblogPostsSeedData.map(withBlogSearchTxt);

package/dist/seed/events-seed-data.d.ts

@@ -1,3 +1,7 @@
 import type { EventDocument, EventEntryDocument } from "../features/events/schemas";
-export declare const eventsSeedData: EventDocument[];
 export declare const eventEntriesSeedData: EventEntryDocument[];
+/**
+ * Tokens derived here, not per record — see _helpers/search-txt-wrappers.ts for
+ * why the wrapper form is what makes omission impossible.
+ */
+export declare const eventsSeedData: EventDocument[];

package/dist/seed/events-seed-data.js

@@ -13,12 +13,13 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
+import { withEventSearchTxt } from "./_helpers/search-txt-wrappers";
 import { EVENT_FIELDS, EVENT_ENTRY_FIELDS } from "../features/events/schemas";
 import { seedExtMedia } from "./_helpers/media";
 const NOW = new Date();
 const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
 const daysAhead = (n) => new Date(NOW.getTime() + n * 86400000);
-export const eventsSeedData = [
+const _raweventsSeedData = [
     // ── 1. ACTIVE — Poll: Favourite Blader Original Series ────────────────────
     {
         id: "event-favourite-blader-poll",
@@ -469,3 +470,8 @@ export const eventEntriesSeedData = [
         createdAt: daysAgo(2),
     },
 ];
+/**
+ * Tokens derived here, not per record — see _helpers/search-txt-wrappers.ts for
+ * why the wrapper form is what makes omission impossible.
+ */
+export const eventsSeedData = _raweventsSeedData.map(withEventSearchTxt);

package/dist/seed/reviews-seed-data.js

@@ -14,6 +14,7 @@
  * @tag consumers:seed/index.ts,seed/runner.ts
  * @tag sideEffects:none
  */
+import { withReviewSearchTxt } from "./_helpers/search-txt-wrappers";
 import { seedExtMedia } from "./_helpers/media";
 const NOW = new Date();
 const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
@@ -176,4 +177,4 @@ for (let i = 0; i < 14; i++) {
         updatedAt: daysAgo(daysAgoCreated),
     });
 }
-export const reviewsSeedData = _rawReviewsSeedData;
+export const reviewsSeedData = _rawReviewsSeedData.map(withReviewSearchTxt);

package/dist/seed/stores-seed-data.d.ts

@@ -1,2 +1,6 @@
 import type { StoreDocument } from "../features/stores/schemas";
+/**
+ * Tokens derived here, not per record — see _helpers/search-txt-wrappers.ts for
+ * why the wrapper form is what makes omission impossible.
+ */
 export declare const storesSeedData: Partial<StoreDocument>[];

package/dist/seed/stores-seed-data.js

@@ -15,6 +15,7 @@
  * @tag consumers:seed/runner.ts
  * @tag sideEffects:none
  */
+import { withStoreSearchTxt } from "./_helpers/search-txt-wrappers";
 import { STORE_FIELDS } from "../constants/field-names";
 import { seedExtMedia } from "./_helpers/media";
 const NOW = new Date();
@@ -30,7 +31,7 @@ const daysAgo = (n) => new Date(NOW.getTime() - n * 86400000);
 function entry(at, actorRole, trigger, changes, extra) {
     return { at, actorRole, trigger, changes, ...extra };
 }
-export const storesSeedData = [
+const _rawstoresSeedData = [
     // ── Store 1: LetItRip Official (admin-owned, platform storefront) ──────────
     {
         id: "store-letitrip-official",
@@ -177,6 +178,24 @@ export const storesSeedData = [
         },
         isPublic: true,
         isVacationMode: false,
+        /*
+         * Reachable, but never advertised to search engines.
+         *
+         * This is a QA store — real enough for a tester to exercise seller flows
+         * against, and not something that belongs in Google's index. `isTestData`
+         * is what the codebase already uses to express that: the sitemap's store
+         * fetcher filters it out (it has no viewer), public store listings hide
+         * it, and `canViewTestData()` keeps it visible to testers and admins — so
+         * the checklist case linking to `/stores/store-tester-qa-seller` still
+         * resolves.
+         *
+         * 🛑 NOTE the deliberate absence of `testDataExpiresAt`. Every sandbox
+         * FIXTURE carries one; this store is permanent. `getTestDataRefs` skips
+         * docs without an expiry on the force-purge path precisely so
+         * `tester:purge-sandbox --force` cannot delete it. Do not add an expiry
+         * here — that would put a permanent seed store in range of the sweep.
+         */
+        isTestData: true,
         stats: { totalProducts: 0, itemsSold: 0, totalReviews: 0, averageRating: 0 },
         capabilities: ["host_preorders", "verified_seller", "create_coupons"],
         createdAt: daysAgo(1),
@@ -262,3 +281,8 @@ export const storesSeedData = [
         ],
     },
 ];
+/**
+ * Tokens derived here, not per record — see _helpers/search-txt-wrappers.ts for
+ * why the wrapper form is what makes omission impossible.
+ */
+export const storesSeedData = _rawstoresSeedData.map(withStoreSearchTxt);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.28.0",
+  "version": "4.29.1",
   "license": "MIT",
   "publishConfig": {
     "access": "public"