@mohasinac/appkit 4.30.0 → 4.30.2

package/dist/_internal/server/features/products/list-public.d.ts

@@ -116,6 +116,17 @@ export interface PublicProductQuery {
     page: number;
     pageSize: number;
     cursor?: string | null;
+    /**
+     * Free-text search, carried OUTSIDE `filters` on purpose.
+     *
+     * `searchTxt` matching is `array-contains`, which Sieve cannot express — so
+     * it travels as an opt to `productRepository.list` (and as `baseOpts.search`
+     * to the listingProcessor Function, whose products lister forwards opts
+     * wholesale). Every executor must pass it on; dropping it is silent, because
+     * a query with no search term is still a perfectly valid query that returns
+     * rows.
+     */
+    search?: string;
 }
 export interface ExecutorResult {
     items: unknown[];

package/dist/_internal/server/features/products/list-public.js

@@ -275,8 +275,18 @@ function buildFirestoreSafeFilters(input) {
     if (input.prizeRevealStatus) {
         parts.push(sieveFilter(PRODUCT_FIELDS.PRIZE_REVEAL_STATUS, SIEVE_OP.EQ, input.prizeRevealStatus));
     }
-    if (input.q)
-        parts.push(sieveFilter(PRODUCT_FIELDS.TITLE, SIEVE_OP.CONTAINS_CI, input.q));
+    // `input.q` is deliberately NOT a filter clause.
+    //
+    // It used to be `title@=*<q>` pushed HERE — before the features, tags,
+    // sublisting and typeFacets clauses below. The Firebase adapter throws on
+    // case-insensitive operators and `throwExceptions: false` swallowed it, so
+    // the processor returned the query as of the throw: with this clause first,
+    // NOTHING was applied. Typing a search term discarded every facet the user
+    // had selected AND the sort, and answered 200 with the whole catalogue.
+    //
+    // Search now travels as `query.search` (see PublicProductQuery) and becomes an
+    // `array-contains` on `searchTxt` inside the repository, which is the only
+    // shape Firestore can serve for token matching.
     // `array-contains-any` isn't supported by the Sieve Firebase adapter, so only a
     // single feature can be pushed down; multi-select falls through to the caller.
     if (input.features?.length === 1) {
@@ -329,7 +339,11 @@ async function defaultExecutor(query) {
         sorts: query.sorts,
         page: query.page,
         pageSize: query.pageSize,
-    });
+    }, 
+    // Without this second argument the repository's searchTxt read path is
+    // unreachable on the default executor, which is what every SSR listing view
+    // uses. It was implemented and simply never called.
+    query.search ? { search: query.search } : undefined);
     return {
         items: result.items,
         total: result.total,
@@ -405,6 +419,7 @@ export async function listPublicProducts(input, opts) {
             page,
             pageSize,
             cursor: input.cursor ?? null,
+            search: input.q,
         });
         if (!result)
             return null;
@@ -440,6 +455,7 @@ export async function listPublicProducts(input, opts) {
                 page: 1,
                 pageSize: PUBLIC_PRODUCT_MAX_PAGE_SIZE,
                 cursor: null,
+                search: input.q,
             });
         }));
         // One failed branch must not blank the whole scope — but it is already
@@ -505,6 +521,7 @@ export async function listPublicProducts(input, opts) {
         page: inMemory ? 1 : page,
         pageSize: inMemory ? PUBLIC_PRODUCT_MAX_PAGE_SIZE : pageSize,
         cursor: inMemory ? null : (input.cursor ?? null),
+        search: input.q,
     });
     if (!result)
         return null;

package/dist/features/auth/repository/token.repository.d.ts

@@ -3,8 +3,23 @@ import { BaseRepository } from "../../../providers/db-firebase";
 import { type EmailVerificationTokenDocument, type PasswordResetTokenDocument } from "../schemas";
 export declare class EmailVerificationTokenRepository extends BaseRepository<EmailVerificationTokenDocument> {
     constructor();
+    /**
+     * Declared, not hand-rolled in a `create` override.
+     *
+     * The override this replaces computed `encryptPiiFields(...)` and then
+     * OVERWROTE the result with `addPiiIndices(data, MAP)` — which returns
+     * `{...plaintext, ...indices}` — so the ciphertext was discarded and every
+     * verification token's email was written to Firestore in CLEARTEXT. It was
+     * invisible because `mapDoc` decrypts on read and `decryptPiiFields` passes
+     * plaintext straight through, so reads looked identical either way.
+     *
+     * `applyWriteHooks` covers create/createWithId/update and the `*InTx` /
+     * `*InBatch` family, so no write path can skip encryption the way an
+     * override of `create` alone did.
+     */
+    protected piiFields: readonly ["email"];
+    protected piiIndexMap: Record<string, string>;
     protected mapDoc<D = EmailVerificationTokenDocument>(snap: DocumentSnapshot): D;
-    create(data: Partial<EmailVerificationTokenDocument>): Promise<EmailVerificationTokenDocument>;
     findByToken(token: string): Promise<EmailVerificationTokenDocument | null>;
     findByUserId(userId: string): Promise<EmailVerificationTokenDocument[]>;
     findByEmail(email: string): Promise<EmailVerificationTokenDocument[]>;
@@ -15,8 +30,16 @@ export declare class EmailVerificationTokenRepository extends BaseRepository<Ema
 }
 export declare class PasswordResetTokenRepository extends BaseRepository<PasswordResetTokenDocument> {
     constructor();
+    /**
+     * Same defect as its sibling above, one spread further along: the override
+     * this replaces built `{...encrypted, ...addPiiIndices(data, MAP)}`, and
+     * because `addPiiIndices` returns `{...plaintext, ...indices}` the plaintext
+     * `email` was spread back OVER the ciphertext. Reset-token emails were
+     * written in cleartext too.
+     */
+    protected piiFields: readonly ["email"];
+    protected piiIndexMap: Record<string, string>;
     protected mapDoc<D = PasswordResetTokenDocument>(snap: DocumentSnapshot): D;
-    create(data: Partial<PasswordResetTokenDocument>): Promise<PasswordResetTokenDocument>;
     findByToken(token: string): Promise<PasswordResetTokenDocument | null>;
     findByUserId(userId: string): Promise<PasswordResetTokenDocument[]>;
     findByEmail(email: string): Promise<PasswordResetTokenDocument[]>;

package/dist/features/auth/repository/token.repository.js

@@ -1,12 +1,28 @@
 import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository } from "../../../providers/db-firebase";
-import { TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, addPiiIndices, decryptPiiFields, encryptPiiFields, piiBlindIndex, } from "../../../security";
+import { TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, decryptPiiFields, piiBlindIndex, } from "../../../security";
 import { resolveDate } from "../../../utils";
 import { EMAIL_VERIFICATION_COLLECTION, PASSWORD_RESET_COLLECTION, TOKEN_FIELDS, } from "../schemas";
 export class EmailVerificationTokenRepository extends BaseRepository {
     constructor() {
         super(EMAIL_VERIFICATION_COLLECTION);
+        /**
+         * Declared, not hand-rolled in a `create` override.
+         *
+         * The override this replaces computed `encryptPiiFields(...)` and then
+         * OVERWROTE the result with `addPiiIndices(data, MAP)` — which returns
+         * `{...plaintext, ...indices}` — so the ciphertext was discarded and every
+         * verification token's email was written to Firestore in CLEARTEXT. It was
+         * invisible because `mapDoc` decrypts on read and `decryptPiiFields` passes
+         * plaintext straight through, so reads looked identical either way.
+         *
+         * `applyWriteHooks` covers create/createWithId/update and the `*InTx` /
+         * `*InBatch` family, so no write path can skip encryption the way an
+         * override of `create` alone did.
+         */
+        this.piiFields = TOKEN_PII_FIELDS;
+        this.piiIndexMap = TOKEN_PII_INDEX_MAP;
     }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
@@ -14,15 +30,6 @@ export class EmailVerificationTokenRepository extends BaseRepository {
             ...TOKEN_PII_FIELDS,
         ]);
     }
-    async create(data) {
-        let encrypted = encryptPiiFields(data, [...TOKEN_PII_FIELDS]);
-        encrypted = addPiiIndices(data, TOKEN_PII_INDEX_MAP);
-        const merged = {
-            ...encrypted,
-            ...addPiiIndices(data, TOKEN_PII_INDEX_MAP),
-        };
-        return super.create(merged);
-    }
     async findByToken(token) {
         return this.findOneBy(TOKEN_FIELDS.TOKEN, token);
     }
@@ -80,6 +87,15 @@ export class EmailVerificationTokenRepository extends BaseRepository {
 export class PasswordResetTokenRepository extends BaseRepository {
     constructor() {
         super(PASSWORD_RESET_COLLECTION);
+        /**
+         * Same defect as its sibling above, one spread further along: the override
+         * this replaces built `{...encrypted, ...addPiiIndices(data, MAP)}`, and
+         * because `addPiiIndices` returns `{...plaintext, ...indices}` the plaintext
+         * `email` was spread back OVER the ciphertext. Reset-token emails were
+         * written in cleartext too.
+         */
+        this.piiFields = TOKEN_PII_FIELDS;
+        this.piiIndexMap = TOKEN_PII_INDEX_MAP;
     }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
@@ -87,14 +103,6 @@ export class PasswordResetTokenRepository extends BaseRepository {
             ...TOKEN_PII_FIELDS,
         ]);
     }
-    async create(data) {
-        let encrypted = encryptPiiFields(data, [...TOKEN_PII_FIELDS]);
-        encrypted = {
-            ...encrypted,
-            ...addPiiIndices(data, TOKEN_PII_INDEX_MAP),
-        };
-        return super.create(encrypted);
-    }
     async findByToken(token) {
         return this.findOneBy(TOKEN_FIELDS.TOKEN, token);
     }

package/dist/features/products/repository/products.repository.js

@@ -5,7 +5,7 @@ import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../..
 import { cacheManager } from "../../../core";
 import { serverLogger } from "../../../monitoring";
 import { generateUniqueId, slugify, generateBarcodeId } from "../../../utils";
-import { buildSearchTxt, parseSearchTxtQuery } from "../../../utils/search-txt";
+import { buildSearchTxt, matchesAllSearchTerms, parseSearchTxtQuery, } from "../../../utils/search-txt";
 import { PRODUCT_COLLECTION, ProductStatusValues } from "../schemas";
 import { PRODUCT_FIELDS } from "../../../constants/field-names";
 /**
@@ -408,12 +408,36 @@ export class ProductRepository extends BaseRepository {
         return baseQuery;
     }
     async list(model, opts) {
-        return this.sieveQuery(model, ProductRepository.SIEVE_FIELDS, {
+        const result = await this.sieveQuery(model, ProductRepository.SIEVE_FIELDS, {
             baseQuery: this.buildScopedQuery(opts),
             defaultPageSize: 20,
             maxPageSize: 100,
             aliases: ProductRepository.FILTER_ALIASES,
         });
+        // Only the most selective term became the `array-contains` clause, because
+        // Firestore permits one array operator per query. The REST of the terms
+        // were described as "AND-refined" in buildScopedQuery for a long time while
+        // nothing actually refined them — so "red dranzer" returned everything
+        // matching "dranzer" and the second word did nothing at all.
+        //
+        // Same shape as faqsRepository.list, deliberately: one implementation of
+        // "AND the remaining terms" that both collections read the same way.
+        const terms = parseSearchTxtQuery(opts?.search ?? "");
+        const extraTerms = terms.slice(1);
+        if (extraTerms.length === 0)
+            return result;
+        const items = result.items.filter((p) => matchesAllSearchTerms(p.searchTxt, extraTerms));
+        // `total` becomes a FLOOR once rows are dropped after the page was cut —
+        // it counts this page only. That is the known post-pagination-filter debt
+        // (Phase 5), not a new invention: reporting the pre-filter total here would
+        // promise pages that render empty.
+        return {
+            ...result,
+            items,
+            total: items.length,
+            totalPages: items.length === 0 ? 0 : 1,
+            hasMore: false,
+        };
     }
     /**
      * How many products of each listing type exist within a scope — the numbers

package/dist/index.d.ts

@@ -444,8 +444,6 @@ export { Can } from "./security/index";
 export { DEFAULT_ROLES } from "./security/index";
 export { EVENT_ENTRY_PII_FIELDS } from "./security/index";
 export { LOTTERY_ENTRY_PII_FIELDS } from "./security/index";
-export { NEWSLETTER_PII_FIELDS } from "./security/index";
-export { NEWSLETTER_PII_INDEX_MAP } from "./security/index";
 export { OFFER_PII_FIELDS } from "./security/index";
 export { ORDER_PII_FIELDS } from "./security/index";
 export { PAYOUT_PII_FIELDS } from "./security/index";

package/dist/index.js

@@ -787,12 +787,6 @@ export { EVENT_ENTRY_PII_FIELDS } from "./security/index";
 // LOTTERY_ENTRY_PII_FIELDS - PII fields for lottery entries.
 export { LOTTERY_ENTRY_PII_FIELDS } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// NEWSLETTER_PII_FIELDS - Constant used across modules.
-export { NEWSLETTER_PII_FIELDS } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// NEWSLETTER_PII_INDEX_MAP - Constant used across modules.
-export { NEWSLETTER_PII_INDEX_MAP } from "./security/index";
-// [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // OFFER_PII_FIELDS - Constant used across modules.
 export { OFFER_PII_FIELDS } from "./security/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.

package/dist/providers/db-firebase/sieve.js

@@ -76,12 +76,24 @@ import { createFirebaseAdapter } from "@mohasinac/sievejs/adapters/firebase";
  * (OR semantics). The stock adapter tries `whereOr` which Firestore Admin SDK
  * doesn't support. Firestore's `.where(field, "in", [v1, v2])` is the correct
  * equivalent and supports up to 30 values.
+ *
+ * It also REPORTS every case-insensitive condition it sees, because those are
+ * the ones the stock adapter throws on — see `buildFilteredSieveQuery`.
+ * Reading `operatorIsCaseInsensitive` off the parsed condition is deliberate:
+ * re-scanning the raw filter string for a trailing `*` cannot tell an operator
+ * suffix from a `*` inside a value (`title==foo*bar`).
  */
-function createEnhancedFirebaseAdapter() {
+function createEnhancedFirebaseAdapter(onCaseInsensitive) {
     const base = createFirebaseAdapter();
     return {
         ...base,
         applyFilterGroup(query, group) {
+            if (onCaseInsensitive) {
+                for (const c of group) {
+                    if (c.operatorIsCaseInsensitive)
+                        onCaseInsensitive(c);
+                }
+            }
             if (group.length > 1 &&
                 group.every((c) => c.parsedOperator === "equals" &&
                     !c.operatorIsNegated &&
@@ -94,6 +106,9 @@ function createEnhancedFirebaseAdapter() {
     };
 }
 import { FirebaseRepository } from "./base";
+// Defining module, not the barrel — `errors/index` re-exports a lot, and this
+// file is imported by every repository (Root Cause #18).
+import { ValidationError } from "../../errors/validation-error";
 import { deserializeTimestamps, getFirestoreCount } from "./helpers";
 import { expandFilterAliases as _expandFilterAliases, } from "./filter-aliases";
 // Re-export the pure alias helper + types so consumers that already imported
@@ -138,6 +153,22 @@ function withAliasesExpanded(model, aliases) {
  */
 function buildFilteredSieveQuery(baseQuery, model, fields, merged, aliases) {
     const effective = withAliasesExpanded(model, aliases);
+    // Case-insensitive operators (`@=*`, `_=*`, `==*`, `!=*`, `_-=*`) are the one
+    // shape the Firebase adapter throws on, and `throwExceptions: false` turns
+    // that throw into SILENCE — measured, not assumed:
+    //
+    //   filters="status==published,title==foo"      → where, where, orderBy   ✅
+    //   filters="title@=*dranzer,status==published" → NOTHING APPLIED         ✗
+    //   filters="status==published,title@=*dranzer" → where(status) only, no sort
+    //
+    // The processor catches the adapter's throw and returns the query as of that
+    // point, so the remaining clauses AND the entire sort phase are discarded.
+    // With the CI clause first that is the bare collection — every facet the user
+    // picked, gone, and a 200 carrying the whole table as "search results".
+    // `ignoreUnsupported: true` does NOT help; it drops the clause just as
+    // quietly. So the only honest options are "throw" or "keep lying", and a
+    // caller asking for an operator this backend cannot express is a 400.
+    const caseInsensitive = [];
     const processor = new SieveProcessorBase({
         // MUST be the enhanced adapter, not the stock one. This is the path
         // `BaseRepository.sieveQuery` delegates to, so it is what ProductRepository
@@ -148,14 +179,25 @@ function buildFilteredSieveQuery(baseQuery, model, fields, merged, aliases) {
         // not implement; `throwExceptions: false` then swallowed it and the clause
         // vanished, returning the ENTIRE collection instead of the selected subset.
         // See __tests__/sieve-or-group.test.ts.
-        adapter: createEnhancedFirebaseAdapter(),
+        adapter: createEnhancedFirebaseAdapter((c) => caseInsensitive.push(c)),
         autoLoadConfig: false,
         options: merged,
         fields,
     });
-    return processor.apply(effective, baseQuery, {
+    const query = processor.apply(effective, baseQuery, {
         applyPagination: false,
     });
+    // Thrown AFTER apply so the message can name every offending clause, not just
+    // the first one the adapter happened to reach.
+    if (caseInsensitive.length > 0) {
+        const clauses = caseInsensitive
+            .map((c) => `${c.field} (${c.parsedOperator})`)
+            .join(", ");
+        throw new ValidationError(`Case-insensitive filter operators are not supported by Firestore. ` +
+            `Offending clause(s): ${clauses}. Use searchTxt token search instead ` +
+            `— see appkit/src/utils/search-txt.ts.`, { fields: caseInsensitive.map((c) => c.field) });
+    }
+    return query;
 }
 /**
  * Count matching documents WITHOUT reading any of them.

package/dist/security/browser.d.ts

@@ -2,6 +2,6 @@ export { generateNonce, buildCSP } from "./csp";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
 export { redactPii } from "./pii-redact";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
 export type { Permission, RoleDefinition, RbacConfig, ResolvedUser, RbacHookReturn, } from "./rbac";
 export { DEFAULT_ROLES, resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, createRbacHook, Can, createRbacMiddleware, } from "./rbac";

package/dist/security/browser.js

@@ -1,5 +1,5 @@
 export { generateNonce, buildCSP } from "./csp";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export { redactPii } from "./pii-redact";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, } from "./pii-schemas";
 export { DEFAULT_ROLES, resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, createRbacHook, Can, createRbacMiddleware, } from "./rbac";

package/dist/security/index.d.ts

@@ -4,9 +4,9 @@ export type { RateLimitConfig, RateLimitResult } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
 export type { Permission, RoleDefinition, RbacConfig, ResolvedUser, RbacHookReturn, } from "./rbac";
 export { DEFAULT_ROLES, resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, createRbacHook, Can, createRequirePermission, createRequirePermissionSync, createRbacMiddleware, } from "./rbac";

package/dist/security/index.js

@@ -2,11 +2,11 @@ export { generateNonce, buildCSP } from "./csp";
 export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, getClientIP, hashGuestIdentity, } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, addPiiIndices, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 // Crypto-free display-masking helpers -- sourced from pii-mask.ts (not
 // pii-encrypt.ts) so this barrel stays safe to re-export from the
 // universal client+server index.ts. See pii-mask.ts's header comment.
 export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
-export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, NEWSLETTER_PII_FIELDS, NEWSLETTER_PII_INDEX_MAP, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
+export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";
 export { DEFAULT_ROLES, resolvePermissions, hasPermission, hasAllPermissions, hasAnyPermission, createRbacHook, Can, createRequirePermission, createRequirePermissionSync, createRbacMiddleware, } from "./rbac";

package/dist/security/pii-encrypt.d.ts

@@ -38,16 +38,22 @@ export declare function piiBlindIndex(plaintext: string): string;
  * Blind-index fields ONLY — derived from `source` (which must be plaintext),
  * with none of `source`'s own keys carried along.
  *
- * Use this, never `addPiiIndices`, when merging indices onto an already-encrypted
- * object. `addPiiIndices` returns `{...source, ...indices}`, so spreading its
- * result over ciphertext silently restores the plaintext — which is exactly how
- * `payouts.sellerEmail`, `payouts.upiId` and `reviews.userName` ended up stored
- * in cleartext beside a valid index.
+ * This is the ONLY index helper. Its predecessor, `addPiiIndices`, returned
+ * `{...source, ...indices}`, so spreading its result over ciphertext silently
+ * restored the plaintext — which is how `payouts.sellerEmail`, `payouts.upiId`
+ * and `reviews.userName` ended up stored in cleartext beside a valid index, and
+ * how both token repositories wrote every verification and password-reset email
+ * in cleartext until it was deleted. Returning indices only makes that class of
+ * bug unrepresentable rather than merely documented.
+ *
+ * Merge order is still the caller's responsibility:
+ *   `{ ...encryptPiiFields(data, FIELDS), ...piiIndicesFor(data, MAP) }`
+ * — both arguments read the PLAINTEXT `data`; hashing ciphertext yields an
+ * index nothing can look up.
  *
  * @param source plaintext document — hashing ciphertext produces a useless index
  */
 export declare function piiIndicesFor(source: object, mapping: Record<string, string>): Record<string, string>;
-export declare function addPiiIndices<T extends object>(obj: T, mapping: Record<string, string>): T;
 /**
  * Encrypt PII inside a shipping address stored in an order.
  * Supports string and object address shapes.

package/dist/security/pii-encrypt.js

@@ -325,11 +325,18 @@ export function piiBlindIndex(plaintext) {
  * Blind-index fields ONLY — derived from `source` (which must be plaintext),
  * with none of `source`'s own keys carried along.
  *
- * Use this, never `addPiiIndices`, when merging indices onto an already-encrypted
- * object. `addPiiIndices` returns `{...source, ...indices}`, so spreading its
- * result over ciphertext silently restores the plaintext — which is exactly how
- * `payouts.sellerEmail`, `payouts.upiId` and `reviews.userName` ended up stored
- * in cleartext beside a valid index.
+ * This is the ONLY index helper. Its predecessor, `addPiiIndices`, returned
+ * `{...source, ...indices}`, so spreading its result over ciphertext silently
+ * restored the plaintext — which is how `payouts.sellerEmail`, `payouts.upiId`
+ * and `reviews.userName` ended up stored in cleartext beside a valid index, and
+ * how both token repositories wrote every verification and password-reset email
+ * in cleartext until it was deleted. Returning indices only makes that class of
+ * bug unrepresentable rather than merely documented.
+ *
+ * Merge order is still the caller's responsibility:
+ *   `{ ...encryptPiiFields(data, FIELDS), ...piiIndicesFor(data, MAP) }`
+ * — both arguments read the PLAINTEXT `data`; hashing ciphertext yields an
+ * index nothing can look up.
  *
  * @param source plaintext document — hashing ciphertext produces a useless index
  */
@@ -344,17 +351,6 @@ export function piiIndicesFor(source, mapping) {
     }
     return indices;
 }
-export function addPiiIndices(obj, mapping) {
-    const result = { ...obj };
-    const access = result;
-    for (const [sourceField, indexField] of Object.entries(mapping)) {
-        const val = access[sourceField];
-        if (typeof val === "string" && val) {
-            access[indexField] = piiBlindIndex(val);
-        }
-    }
-    return result;
-}
 // --- Nested-object PII helpers ----------------------------------------------
 /**
  * Encrypt PII inside a shipping address stored in an order.

package/dist/security/pii-schemas.d.ts

@@ -26,10 +26,6 @@ export declare const PAYOUT_PII_INDEX_MAP: Record<string, string>;
  * Bidder names are already masked on the public side by `maskPublicBid`.
  */
 export declare const BID_PII_FIELDS: readonly ["userEmail"];
-/** PII fields in newsletter subscribers */
-export declare const NEWSLETTER_PII_FIELDS: readonly [];
-/** Blind-index mapping for newsletter subscribers */
-export declare const NEWSLETTER_PII_INDEX_MAP: Record<string, string>;
 /**
  * PII fields in tokens (email verification / password reset).
  *

package/dist/security/pii-schemas.js

@@ -40,10 +40,19 @@ export const PAYOUT_PII_INDEX_MAP = {
  * Bidder names are already masked on the public side by `maskPublicBid`.
  */
 export const BID_PII_FIELDS = ["userEmail"];
-/** PII fields in newsletter subscribers */
-export const NEWSLETTER_PII_FIELDS = [];
-/** Blind-index mapping for newsletter subscribers */
-export const NEWSLETTER_PII_INDEX_MAP = {};
+/*
+ * NEWSLETTER_PII_FIELDS / NEWSLETTER_PII_INDEX_MAP were DELETED here.
+ *
+ * They were an empty `[]` and `{}` with no reader anywhere — only three barrel
+ * re-exports. `NewsletterRepository` does not extend `BaseRepository`; it holds
+ * its OWN module-local `NEWSLETTER_PII_FIELDS = ["email"]` and encrypts through
+ * that, so newsletter emails ARE encrypted at rest.
+ *
+ * The empty pair therefore did nothing except read, convincingly, as proof that
+ * newsletter PII was unencrypted — a shadow constant of exactly the shape in
+ * Root Cause #53, where the symbol a grep finds is not the one doing the work.
+ * Deleting it is the fix; populating it would have been a no-op.
+ */
 /**
  * PII fields in tokens (email verification / password reset).
  *

package/dist/server.d.ts

@@ -462,7 +462,7 @@ export { encryptPii } from "./security/index";
 export { decryptPii } from "./security/index";
 export { isPiiEncrypted } from "./security/index";
 export { piiBlindIndex } from "./security/index";
-export { addPiiIndices } from "./security/index";
+export { piiIndicesFor } from "./security/index";
 export { getPiiConfigError } from "./security/index";
 export { encryptShippingAddress } from "./security/index";
 export { decryptShippingAddress } from "./security/index";

package/dist/server.js

@@ -1294,7 +1294,7 @@ export { encryptPii } from "./security/index";
 export { decryptPii } from "./security/index";
 export { isPiiEncrypted } from "./security/index";
 export { piiBlindIndex } from "./security/index";
-export { addPiiIndices } from "./security/index";
+export { piiIndicesFor } from "./security/index";
 export { getPiiConfigError } from "./security/index";
 export { encryptShippingAddress } from "./security/index";
 export { decryptShippingAddress } from "./security/index";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.30.0",
+  "version": "4.30.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"

package/scripts/seed-cli.mjs

@@ -174,7 +174,7 @@ const appkit = await import("@mohasinac/appkit");
 // client-safe barrel, only from "@mohasinac/appkit/server". The *_PII_FIELDS
 // / *_PII_INDEX_MAP constants are plain data and stay in the main barrel.
 const appkitServer = await import("@mohasinac/appkit/server");
-const { encryptPiiFields, addPiiIndices, encryptPayoutDetails, encryptPayoutBankAccount, encryptShippingConfig } = appkitServer;
+const { encryptPiiFields, piiIndicesFor, encryptPayoutDetails, encryptPayoutBankAccount, encryptShippingConfig } = appkitServer;
 
 const {
   // seed data
@@ -488,9 +488,16 @@ async function loadUsers(seed, stats) {
         await auth.setCustomUserClaims(uid, { role: u.role });
       }
 
-      let docData = stripUndefined({ ...u });
-      docData = addPiiIndices(docData, USER_PII_INDEX_MAP);
-      docData = encryptPiiFields(docData, [...USER_PII_FIELDS]);
+      // Both arguments read the PLAINTEXT `plain`: indices must be hashed from
+      // the source text, and encryption must not see an already-hashed value.
+      // The previous form relied on ordering alone (indices first, THEN
+      // encrypt) — correct, but one line-swap away from spreading plaintext
+      // back over ciphertext, which is why `addPiiIndices` no longer exists.
+      const plain = stripUndefined({ ...u });
+      let docData = {
+        ...encryptPiiFields(plain, [...USER_PII_FIELDS]),
+        ...piiIndicesFor(plain, USER_PII_INDEX_MAP),
+      };
       if (docData.payoutDetails) docData.payoutDetails = encryptPayoutDetails(docData.payoutDetails);
       if (docData.shippingConfig) docData.shippingConfig = encryptShippingConfig(docData.shippingConfig);
       await docRef.set(docData, { merge: true });