@mohasinac/appkit 4.30.11 → 4.30.13

package/dist/errors/degraded.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Degradation that the caller can SEE.
+ *
+ * Every bug this search/PII migration surfaced returned HTTP 200 with
+ * plausible-looking rows. A dropped Sieve clause, a swallowed
+ * FAILED_PRECONDITION, a retry with `q` deleted — none of them errored, and a
+ * reader had no way to tell a narrowed list from an unnarrowed one. A
+ * `serverLogger.warn` does not help: it goes to the operator, and the person
+ * being misled is the user.
+ *
+ * So when a handler cannot serve exactly what was asked for but chooses to
+ * serve something anyway, it must say so ON THE RESPONSE.
+ *
+ * This is not an error channel. A degraded response is a successful response
+ * whose shape is honest about a compromise the handler made deliberately —
+ * "I applied your filter but ignored your sort", not "something went wrong".
+ * A failure that has no defensible partial answer should still throw.
+ */
+/** One thing the handler could not honour, and why. */
+export interface DegradedNotice {
+    /** What was dropped, in the caller's vocabulary: "sorts", "filters.status". */
+    dropped: string;
+    /**
+     * Why, in one sentence a UI can show verbatim. Written for the user, not the
+     * operator — "Results are not sorted while searching" beats
+     * "FAILED_PRECONDITION: composite index required".
+     */
+    reason: string;
+}
+/**
+ * Attach notices to a response payload.
+ *
+ * Returns the payload UNCHANGED when nothing degraded, so the common path
+ * carries no `degraded: false` noise and a client can treat the field's mere
+ * presence as the signal.
+ */
+export declare function withDegraded<T extends object>(payload: T, notices: readonly DegradedNotice[]): T | (T & {
+    degraded: readonly DegradedNotice[];
+});
+/**
+ * The specific compromise three admin search endpoints make.
+ *
+ * `/api/admin/{users,reviews,payouts}` resolve `q` through an HMAC blind index
+ * (`emailIndex==<hash>`) or an exact name match. Firestore needs a composite
+ * index for each equality x sort x direction combination, and preserving the
+ * caller's sort across all three endpoints was measured at **14** additional
+ * indexes — to order a result set that an exact email match bounds at one row.
+ *
+ * Dropping the sort is therefore the right trade. Dropping it SILENTLY was not:
+ * the sort dropdown went on displaying "Oldest" over unsorted rows.
+ */
+export declare const SORT_DROPPED_FOR_EXACT_SEARCH: DegradedNotice;

package/dist/errors/degraded.js

@@ -0,0 +1,47 @@
+/**
+ * Degradation that the caller can SEE.
+ *
+ * Every bug this search/PII migration surfaced returned HTTP 200 with
+ * plausible-looking rows. A dropped Sieve clause, a swallowed
+ * FAILED_PRECONDITION, a retry with `q` deleted — none of them errored, and a
+ * reader had no way to tell a narrowed list from an unnarrowed one. A
+ * `serverLogger.warn` does not help: it goes to the operator, and the person
+ * being misled is the user.
+ *
+ * So when a handler cannot serve exactly what was asked for but chooses to
+ * serve something anyway, it must say so ON THE RESPONSE.
+ *
+ * This is not an error channel. A degraded response is a successful response
+ * whose shape is honest about a compromise the handler made deliberately —
+ * "I applied your filter but ignored your sort", not "something went wrong".
+ * A failure that has no defensible partial answer should still throw.
+ */
+/**
+ * Attach notices to a response payload.
+ *
+ * Returns the payload UNCHANGED when nothing degraded, so the common path
+ * carries no `degraded: false` noise and a client can treat the field's mere
+ * presence as the signal.
+ */
+export function withDegraded(payload, notices) {
+    if (notices.length === 0)
+        return payload;
+    return { ...payload, degraded: notices };
+}
+/**
+ * The specific compromise three admin search endpoints make.
+ *
+ * `/api/admin/{users,reviews,payouts}` resolve `q` through an HMAC blind index
+ * (`emailIndex==<hash>`) or an exact name match. Firestore needs a composite
+ * index for each equality x sort x direction combination, and preserving the
+ * caller's sort across all three endpoints was measured at **14** additional
+ * indexes — to order a result set that an exact email match bounds at one row.
+ *
+ * Dropping the sort is therefore the right trade. Dropping it SILENTLY was not:
+ * the sort dropdown went on displaying "Oldest" over unsorted rows.
+ */
+export const SORT_DROPPED_FOR_EXACT_SEARCH = {
+    dropped: "sorts",
+    reason: "Results are not sorted while searching — search matches an exact value, " +
+        "so ordering is unavailable for this query.",
+};

package/dist/errors/index.d.ts

@@ -16,3 +16,4 @@ export { ERROR_DISPLAY_MAP, getErrorDisplay, type ErrorDisplayEntry, } from "./e
 export { safeRead, installDegradedReadReporter, type DegradedReadReport, } from "./safe-read";
 export { normalizeError, getErrorMessage, isAuthError, isApiNormalized, isAppNormalized, isFirebaseAuthNormalized, isFirebaseFirestoreNormalized, isFirebaseStorageNormalized, isNativeNormalized, isNetworkNormalized, isUnknownNormalized, isZodNormalized, } from "./normalize";
 export type { NormalizedError, NormalizedApiError, NormalizedAppError, NormalizedFirebaseAuthError, NormalizedFirebaseFirestoreError, NormalizedFirebaseStorageError, NormalizedNativeError, NormalizedNetworkError, NormalizedUnknownThrownValue, NormalizedZodError, } from "./normalize";
+export * from "./degraded";

package/dist/errors/index.js

@@ -25,3 +25,4 @@ export { safeRead, installDegradedReadReporter, } from "./safe-read";
 // `isAuthError` here replaces the legacy keyword matcher at
 // `appkit/src/utils/auth-error.ts` (now a thin re-export shim).
 export { normalizeError, getErrorMessage, isAuthError, isApiNormalized, isAppNormalized, isFirebaseAuthNormalized, isFirebaseFirestoreNormalized, isFirebaseStorageNormalized, isNativeNormalized, isNetworkNormalized, isUnknownNormalized, isZodNormalized, } from "./normalize";
+export * from "./degraded";

package/dist/features/admin/components/AdminBlogView.js

@@ -21,7 +21,9 @@ export function AdminBlogView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Blog Posts",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildBlogSearchTxt indexes title + excerpt + category + tags — NOT the post
+        // body, which is not tokenised.
+        searchPlaceholder: "Search by title, excerpt, category or tag…",
         emptyLabel: "No blog posts found",
         filterKeys: ["status", "isFeatured"],
         defaultSort: sortBy("publishedAt", "DESC"),

package/dist/features/admin/components/AdminCouponsView.js

@@ -52,7 +52,8 @@ export function AdminCouponsView({ children, onBulkArchive, onBulkDelete, ...pro
     const config = {
         portal: "admin",
         title: "Coupons",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildCouponSearchTxt indexes code + name + description — nothing else.
+        searchPlaceholder: "Search by code, name or description…",
         emptyLabel: "No coupons found",
         filterKeys: ["type", "showExpired"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/AdminOffersView.js

@@ -103,7 +103,10 @@ export function AdminOffersView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Offers",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildOfferSearchTxt indexes productTitle + productSlug + storeName. It does
+        // NOT index buyerName or buyerEmail — those are PII, and the placeholder
+        // must not promise a match it will never make.
+        searchPlaceholder: "Search by product or store…",
         emptyLabel: "No offers found",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/events/components/AdminEventsView.js

@@ -33,7 +33,8 @@ export function AdminEventsView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Events",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildEventSearchTxt indexes title + description + type + tags.
+        searchPlaceholder: "Search by title, description, type or tag…",
         emptyLabel: "No events found",
         filterKeys: ["status", "type"],
         defaultSort: sortBy("startsAt", "DESC"),

package/dist/features/events/server.d.ts

@@ -6,5 +6,4 @@
 export * from "./actions";
 export { EventRepository, EventsRepository, eventRepository, } from "./repository/events.repository";
 export { EventEntryRepository, EventEntriesRepository, eventEntryRepository, } from "./repository/event-entry.repository";
-export { GET as eventsGET, GET } from "./api/route";
 export { GET as eventIdGET } from "./api/[id]/route";

package/dist/features/events/server.js

@@ -6,5 +6,4 @@
 export * from "./actions";
 export { EventRepository, EventsRepository, eventRepository, } from "./repository/events.repository";
 export { EventEntryRepository, EventEntriesRepository, eventEntryRepository, } from "./repository/event-entry.repository";
-export { GET as eventsGET, GET } from "./api/route";
 export { GET as eventIdGET } from "./api/[id]/route";

package/dist/features/faq/index.d.ts

@@ -1,5 +1,4 @@
 export * from "./types";
-export * from "./hooks/useFAQs";
 export * from "./hooks/useFaqList";
 export * from "./hooks/useFaqVote";
 export * from "./components";

package/dist/features/faq/index.js

@@ -1,5 +1,4 @@
 export * from "./types";
-export * from "./hooks/useFAQs";
 export * from "./hooks/useFaqList";
 export * from "./hooks/useFaqVote";
 export * from "./components";

package/dist/features/faq/server.d.ts

@@ -5,4 +5,3 @@
  */
 export * from "./actions";
 export { FAQsRepository, FirebaseFAQsRepository, faqsRepository, } from "./repository/faqs.repository";
-export { GET as faqGET, GET } from "./api/route";

package/dist/features/faq/server.js

@@ -5,4 +5,3 @@
  */
 export * from "./actions";
 export { FAQsRepository, FirebaseFAQsRepository, faqsRepository, } from "./repository/faqs.repository";
-export { GET as faqGET, GET } from "./api/route";

package/dist/features/orders/repository/orders.repository.d.ts

@@ -151,7 +151,9 @@ declare class OrderRepository extends BaseRepository<OrderDocument> {
             canSort: boolean;
         };
     };
-    listForSeller(productIds: string[], model: SieveModel): Promise<FirebaseSieveResult<OrderDocument>>;
+    listForSeller(productIds: string[], model: SieveModel, opts?: {
+        search?: string;
+    }): Promise<FirebaseSieveResult<OrderDocument>>;
     listForUser(userId: string, model: SieveModel): Promise<FirebaseSieveResult<OrderDocument>>;
     static readonly ADMIN_SIEVE_FIELDS: {
         searchTxt: {

package/dist/features/orders/repository/orders.repository.js

@@ -260,7 +260,12 @@ class OrderRepository extends BaseRepository {
             throw new DatabaseError(`Failed to delete orders for user: ${userId}`, error);
         }
     }
-    async listForSeller(productIds, model) {
+    async listForSeller(productIds, model, opts) {
+        const plan = planSearchTxt(opts?.search);
+        // A search that yielded no usable term must return NOTHING, not the
+        // seller's whole order list.
+        if (plan.empty)
+            return emptySearchResult();
         if (productIds.length === 0) {
             const page = Math.max(1, Number(model.page ?? 1));
             const pageSize = Math.max(1, Number(model.pageSize ?? 20));
@@ -273,12 +278,22 @@ class OrderRepository extends BaseRepository {
                 hasMore: false,
             };
         }
-        const baseQuery = this.getCollection().where(ORDER_FIELDS.PRODUCT_ID, "in", productIds);
-        return this.sieveQuery(model, OrderRepository.SELLER_SIEVE_FIELDS, {
+        let baseQuery = this.getCollection().where(ORDER_FIELDS.PRODUCT_ID, "in", productIds);
+        if (plan.head) {
+            // `array-contains` alongside `in` is legal — Firestore's one-per-query
+            // limits are on `array-contains` and on the `in`/`not-in`/
+            // `array-contains-any` family separately, so one of each is fine.
+            // Verified against production data before this shipped, and the
+            // matching composite index is declared in firestore.indexes.json;
+            // the query happened to plan without one, which is not a guarantee.
+            baseQuery = baseQuery.where(ORDER_FIELDS.SEARCH_TXT, "array-contains", plan.head);
+        }
+        const result = await this.sieveQuery(model, OrderRepository.SELLER_SIEVE_FIELDS, {
             baseQuery,
             defaultPageSize: 20,
             maxPageSize: 100,
         });
+        return refineSearchTxt(result, plan.rest);
     }
     async listForUser(userId, model) {
         const baseQuery = this.getCollection().where(ORDER_FIELDS.USER_ID, "==", userId);

package/dist/features/reviews/server.d.ts

@@ -5,5 +5,4 @@
  */
 export * from "./actions";
 export { ReviewRepository, reviewRepository, } from "./repository/reviews.repository";
-export { GET as reviewsGET, GET, POST } from "./api/route";
 export { reviewItemGET, reviewItemPATCH, reviewItemDELETE, } from "./api/[id]/route";

package/dist/features/reviews/server.js

@@ -5,5 +5,4 @@
  */
 export * from "./actions";
 export { ReviewRepository, reviewRepository, } from "./repository/reviews.repository";
-export { GET as reviewsGET, GET, POST } from "./api/route";
 export { reviewItemGET, reviewItemPATCH, reviewItemDELETE, } from "./api/[id]/route";

package/dist/features/seller/components/SellerCouponsView.js

@@ -49,7 +49,8 @@ export function SellerCouponsView({ onCreateClick, onEditClick, onToggle, onDele
     const config = {
         portal: "seller",
         title: "Coupons",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildCouponSearchTxt indexes code + name + description — nothing else.
+        searchPlaceholder: "Search by code, name or description…",
         emptyLabel: "No coupons found — create your first coupon",
         filterKeys: ["isActive"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/seller/components/SellerOffersView.js

@@ -22,7 +22,9 @@ export function SellerOffersView({ children, onAcceptOffer, onRejectOffer, onCou
     const config = {
         portal: "seller",
         title: "Offers",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildOfferSearchTxt indexes productTitle + productSlug + storeName — never
+        // the buyer's name or email.
+        searchPlaceholder: "Search by product or store…",
         emptyLabel: "No offers received",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/seller/components/SellerOrdersView.js

@@ -294,7 +294,10 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
     const config = {
         portal: "seller",
         title: "Orders",
-        // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
+        // buildOrderSearchTxt indexes productTitle, storeName and trackingNumber.
+        // It does NOT index the buyer's name, email or address — those are PII,
+        // and the placeholder must not promise a match it will never make.
+        searchPlaceholder: "Search by product, store or tracking number…",
         emptyLabel: "No orders yet",
         filterKeys: ["status"],
         defaultSort: DEFAULT_SORT,

package/dist/features/seller/hooks/useSellerListingData.d.ts

@@ -1,30 +1,16 @@
+/**
+ * Row-shaping helpers for the seller listing views.
+ *
+ * The `useSellerListingData` hook that used to live here was deleted: it was
+ * a second listing-fetch engine beside `DataListingView`/`useAdminListing`,
+ * with its own q/sorts/filters handling, and it had ZERO call sites. Two
+ * engines for one job is what this whole investigation was about — the dead
+ * one is what the next session copies from.
+ *
+ * The four helpers below are NOT dead: six seller views import them.
+ */
 import type { JsonValue } from "@mohasinac/appkit/client";
 type UnknownRecord = Record<string, JsonValue>;
-interface UseSellerListingDataOptions<TResponse, TRow extends {
-    id: string;
-}> {
-    queryKey: readonly unknown[];
-    endpoint: string;
-    page?: number;
-    pageSize?: number;
-    sorts?: string;
-    filters?: string;
-    q?: string;
-    mapRows: (response: TResponse) => TRow[];
-    getTotal?: (response: TResponse, rows: TRow[]) => number;
-}
-export interface UseSellerListingDataResult<TRow extends {
-    id: string;
-}> {
-    rows: TRow[];
-    total: number;
-    isLoading: boolean;
-    errorMessage?: string;
-    refetch: () => void;
-}
-export declare function useSellerListingData<TResponse, TRow extends {
-    id: string;
-}>({ queryKey, endpoint, page, pageSize, sorts, filters, q, mapRows, getTotal, }: UseSellerListingDataOptions<TResponse, TRow>): UseSellerListingDataResult<TRow>;
 export declare function toRecordArray(value: unknown): UnknownRecord[];
 export declare function toStringValue(value: unknown, fallback?: string): string;
 export declare function toCurrency(value: unknown): string;

package/dist/features/seller/hooks/useSellerListingData.js

@@ -1,43 +1,5 @@
 "use client";
-import { useQuery } from "@tanstack/react-query";
-import { apiClient, ApiClientError } from "../../../http";
 import { formatCurrency } from "../../../utils/number.formatter";
-function withQueryParams(endpoint, params) {
-    const hasQuery = endpoint.includes("?");
-    const query = new URLSearchParams(params).toString();
-    return `${endpoint}${hasQuery ? "&" : "?"}${query}`;
-}
-export function useSellerListingData({ queryKey, endpoint, page = 1, pageSize = 25, sorts = "-createdAt", filters = "", q, mapRows, getTotal, }) {
-    const params = {
-        page: String(page),
-        pageSize: String(pageSize),
-        sorts,
-    };
-    if (filters)
-        params.filters = filters;
-    if (q)
-        params.q = q;
-    const query = useQuery({
-        queryKey: [...queryKey, page, pageSize, sorts, filters, q ?? ""],
-        queryFn: () => apiClient.get(withQueryParams(endpoint, params)),
-        staleTime: 60000,
-    });
-    const rows = query.data ? mapRows(query.data) : [];
-    const total = query.data
-        ? (getTotal?.(query.data, rows) ?? rows.length)
-        : rows.length;
-    return {
-        rows,
-        total,
-        isLoading: query.isLoading,
-        errorMessage: query.error instanceof ApiClientError
-            ? query.error.message
-            : query.error
-                ? "Unable to load records"
-                : undefined,
-        refetch: query.refetch,
-    };
-}
 export function toRecordArray(value) {
     return Array.isArray(value) ? value.filter(Boolean) : [];
 }

package/dist/features/stores/server.d.ts

@@ -5,7 +5,6 @@
  */
 export * from "./actions";
 export { StoreRepository, storeRepository, } from "./repository/store.repository";
-export { GET as storesGET, GET } from "./api/route";
 export { GET as storeSlugGET } from "./api/[storeSlug]/route";
 export { GET as storeProductsGET } from "./api/[storeSlug]/products/route";
 export { GET as storeAuctionsGET } from "./api/[storeSlug]/auctions/route";

package/dist/features/stores/server.js

@@ -7,7 +7,6 @@ export * from "./actions";
 export { StoreRepository, storeRepository, } from "./repository/store.repository";
 // SB-UNI-A 2026-05-13 — storeAddressRepository deleted. Use addressesRepository
 // (top-level addresses collection with ownerType:"store").
-export { GET as storesGET, GET } from "./api/route";
 export { GET as storeSlugGET } from "./api/[storeSlug]/route";
 export { GET as storeProductsGET } from "./api/[storeSlug]/products/route";
 export { GET as storeAuctionsGET } from "./api/[storeSlug]/auctions/route";

package/dist/index.d.ts

@@ -316,6 +316,8 @@ export type { PasswordStrength } from "./validation/index";
 export type { ZodSetupProps } from "./validation/index";
 export { ApiError } from "./errors/index";
 export { AppError } from "./errors/index";
+export { withDegraded, SORT_DROPPED_FOR_EXACT_SEARCH } from "./errors/index";
+export type { DegradedNotice } from "./errors/index";
 export { AuthenticationError } from "./errors/index";
 export { AuthorizationError } from "./errors/index";
 export { DatabaseError } from "./errors/index";
@@ -1866,7 +1868,6 @@ export { createEvent } from "./features/events/server";
 export { deleteEvent } from "./features/events/server";
 export { enterEvent } from "./features/events/server";
 export { eventIdGET } from "./features/events/server";
-export { eventsGET } from "./features/events/server";
 export { getEventLeaderboard } from "./features/events/server";
 export { getEventPollResults } from "./features/events/server";
 export { getEventSpinResults } from "./features/events/server";
@@ -1914,8 +1915,6 @@ export { faqStatsSchema } from "./features/faq/index";
 export { getHelpfulnessPercentage } from "./features/faq/index";
 export { isPopularFAQ } from "./features/faq/index";
 export { slugifyQuestion } from "./features/faq/index";
-export { useFAQ } from "./features/faq/index";
-export { useFAQs } from "./features/faq/index";
 export { useFaqList } from "./features/faq/index";
 export { useFaqVote } from "./features/faq/index";
 export { usesVariableInterpolation } from "./features/faq/index";
@@ -1940,7 +1939,6 @@ export type { VoteFaqResult } from "./features/faq/index";
 export { createFaq } from "./features/faq/server";
 export { deleteFaq } from "./features/faq/server";
 export { faqCreateSchema } from "./features/faq/server";
-export { faqGET } from "./features/faq/server";
 export { faqUpdateSchema } from "./features/faq/server";
 export { getFaqById } from "./features/faq/server";
 export { listFaqs } from "./features/faq/server";
@@ -2676,7 +2674,6 @@ export { listReviewsBySeller } from "./features/reviews/server";
 export { reviewItemDELETE } from "./features/reviews/server";
 export { reviewItemGET } from "./features/reviews/server";
 export { reviewItemPATCH } from "./features/reviews/server";
-export { reviewsGET } from "./features/reviews/server";
 export { updateReview } from "./features/reviews/server";
 export { voteReviewHelpful } from "./features/reviews/server";
 export type { CreateReviewActionInput } from "./features/reviews/server";
@@ -2995,7 +2992,6 @@ export { storeAuctionsGET } from "./features/stores/server";
 export { storeProductsGET } from "./features/stores/server";
 export { storeReviewsGET } from "./features/stores/server";
 export { storeSlugGET } from "./features/stores/server";
-export { storesGET } from "./features/stores/server";
 export { updateStoreAddressForSeller } from "./features/stores/server";
 export type { StoreContentParams } from "./features/stores/server";
 export type { StoreQueryListParams } from "./features/stores/server";
@@ -3131,7 +3127,6 @@ export type { UseUrlTableOptions } from "./react/index";
 export { SUCCESS_MESSAGES } from "./values/index";
 export { splitCartIntoOrderGroups } from "./features/orders/index";
 export { groupOrderItemsByLine, type LineOrderGroup, type OrderItemForLineGrouping, } from "./features/orders/index";
-export { buildSieveFilters } from "./utils/filter.helper";
 export { formatCurrency, formatFileSize } from "./utils/number.formatter";
 export { formatMonthYear } from "./utils/date.formatter";
 export { generateMediaFilename } from "./utils/id-generators";

package/dist/index.js

@@ -526,6 +526,9 @@ export { ApiError } from "./errors/index";
 // [UTIL]-Pure utility â€" no framework or runtime dependency; safe to import from any environment.
 // AppError - Model for app error.
 export { AppError } from "./errors/index";
+// withDegraded / DegradedNotice / SORT_DROPPED_FOR_EXACT_SEARCH — a response
+// that is honest about a compromise the handler made deliberately.
+export { withDegraded, SORT_DROPPED_FOR_EXACT_SEARCH } from "./errors/index";
 // [UTIL]-Pure utility â€" no framework or runtime dependency; safe to import from any environment.
 // AuthenticationError - Model for authentication error.
 export { AuthenticationError } from "./errors/index";
@@ -3481,8 +3484,6 @@ export { enterEvent } from "./features/events/server";
 // eventIdGET - Shared export for event id get.
 export { eventIdGET } from "./features/events/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// eventsGET - Shared export for events get.
-export { eventsGET } from "./features/events/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getEventLeaderboard - Helper for get event leaderboard.
 export { getEventLeaderboard } from "./features/events/server";
@@ -3602,11 +3603,7 @@ export { isPopularFAQ } from "./features/faq/index";
 // slugifyQuestion - Shared export for slugify question.
 export { slugifyQuestion } from "./features/faq/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// useFAQ - React hook for use faq.
-export { useFAQ } from "./features/faq/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
-// useFAQs - React hook for use faqs.
-export { useFAQs } from "./features/faq/index";
 // [CLIENT-SSR]-Runs in both SSR and browser â€" React component or hook that does not depend on browser-only APIs.
 // useFaqList - React hook for use faq list.
 export { useFaqList } from "./features/faq/index";
@@ -3630,8 +3627,6 @@ export { deleteFaq } from "./features/faq/server";
 // faqCreateSchema - Model for faq create schema.
 export { faqCreateSchema } from "./features/faq/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// faqGET - Shared export for faq get.
-export { faqGET } from "./features/faq/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // faqUpdateSchema - Model for faq update schema.
 export { faqUpdateSchema } from "./features/faq/server";
@@ -4828,8 +4823,6 @@ export { reviewItemGET } from "./features/reviews/server";
 // reviewItemPATCH - Shared export for review item patch.
 export { reviewItemPATCH } from "./features/reviews/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// reviewsGET - Shared export for reviews get.
-export { reviewsGET } from "./features/reviews/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // updateReview - Helper for update review.
 export { updateReview } from "./features/reviews/server";
@@ -5349,8 +5342,6 @@ export { storeReviewsGET } from "./features/stores/server";
 // storeSlugGET - Shared export for store slug get.
 export { storeSlugGET } from "./features/stores/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// storesGET - Shared export for stores get.
-export { storesGET } from "./features/stores/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // updateStoreAddressForSeller - Helper for update store address for seller.
 export { updateStoreAddressForSeller } from "./features/stores/server";
@@ -5540,7 +5531,6 @@ export { splitCartIntoOrderGroups } from "./features/orders/index";
 // S-SBUNI-5 2026-05-13 â€" bundle-aware order item grouping for receipts.
 export { groupOrderItemsByLine, } from "./features/orders/index";
 // -- Missing utils
-export { buildSieveFilters } from "./utils/filter.helper";
 export { formatCurrency, formatFileSize } from "./utils/number.formatter";
 export { formatMonthYear } from "./utils/date.formatter";
 export { generateMediaFilename } from "./utils/id-generators"; // generateProductImageFilename already exported from "./utils/id-generators";

package/dist/providers/db-firebase/base.js

@@ -63,23 +63,19 @@ export class FirebaseRepository {
             q = q.orderBy(sortField, sortDir);
         }
         // -- Basic Sieve filter parsing --------------------------------------------
-        // Supports: ==, !=, <, <=, >, >=, @= (array-contains), @=* (prefix/starts-with)
+        // Supports: ==, !=, <, <=, >, >=, @= (array-contains).
+        //
+        // The `@=*` prefix arm was DELETED. It built a >= / <= range against a
+        //  sentinel, which is a real prefix match — but only over a field
+        // stored verbatim and case-sensitively, so it never matched what callers
+        // used it for, and pairing an inequality with an unrelated orderBy demanded
+        // an index nobody declared. `searchTxt` + `array-contains` replaces it.
         if (query?.filters) {
             const clauses = query.filters
                 .split(",")
                 .map((s) => s.trim())
                 .filter(Boolean);
             for (const clause of clauses) {
-                // Try @=* (string prefix) before the generic @= match
-                const prefixMatch = clause.match(/^([^<>=!@]+)\s*@=\*\s*(.+)$/);
-                if (prefixMatch) {
-                    const field = prefixMatch[1].trim();
-                    const prefix = prefixMatch[2].trim();
-                    q = q
-                        .where(field, ">=", prefix)
-                        .where(field, "<=", prefix + "");
-                    continue;
-                }
                 const match = clause.match(/^([^<>=!@]+)\s*(==|!=|<=|>=|<|>|@=)\s*(.+)$/);
                 if (!match)
                     continue;

package/dist/security/index.d.ts

@@ -4,7 +4,7 @@ export type { RateLimitConfig, RateLimitResult } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export type { UserRole } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 export { isPiiEncrypted, maskName, maskEmail, maskPublicReview, maskPublicBid, maskPublicEventEntry, maskOfferForSeller, ENC_PREFIX, HMAC_PREFIX, } from "./pii-mask";
 export { USER_PII_FIELDS, USER_PII_INDEX_MAP, ADDRESS_PII_FIELDS, ORDER_PII_FIELDS, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, BID_PII_FIELDS, TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, OFFER_PII_FIELDS, CHAT_PII_FIELDS, EVENT_ENTRY_PII_FIELDS, LOTTERY_ENTRY_PII_FIELDS, PAYMENT_METHOD_PII_FIELDS, } from "./pii-schemas";
 export { encryptSecret, decryptSecret, isSecretEncrypted, maskSecret, } from "./settings-encryption";

package/dist/security/index.js

@@ -2,7 +2,7 @@ export { generateNonce, buildCSP } from "./csp";
 export { rateLimit, applyRateLimit, rateLimitByIdentifier, RateLimitPresets, clearRateLimitStore, getClientIP, hashGuestIdentity, } from "./rate-limit";
 export { requireAuth, requireRole, requireOwnership, requireEmailVerified, requireActiveAccount, canChangeRole, getRoleLevel, } from "./authorization";
 export { redactPii, safeDisplayName, safeDisplayEmail, maskIp } from "./pii-redact";
-export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptShippingAddress, decryptShippingAddress, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
+export { encryptValue, decryptValue, hmacBlindIndex, encryptPiiFields, decryptPiiFields, encryptPii, decryptPii, piiBlindIndex, piiIndicesFor, getPiiConfigError, encryptPayoutDetails, decryptPayoutDetails, encryptShippingConfig, decryptShippingConfig, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "./pii-encrypt";
 // Crypto-free display-masking helpers -- sourced from pii-mask.ts (not
 // pii-encrypt.ts) so this barrel stays safe to re-export from the
 // universal client+server index.ts. See pii-mask.ts's header comment.

package/dist/security/pii-encrypt.d.ts

@@ -54,16 +54,6 @@ export declare function piiBlindIndex(plaintext: string): string;
  * @param source plaintext document — hashing ciphertext produces a useless index
  */
 export declare function piiIndicesFor(source: object, mapping: Record<string, string>): Record<string, string>;
-/**
- * Encrypt PII inside a shipping address stored in an order.
- * Supports string and object address shapes.
- */
-export declare function encryptShippingAddress<T>(addr: T | undefined | null): T | undefined | null;
-/**
- * Decrypt PII inside a shipping address read from an order.
- * Supports string and object address shapes.
- */
-export declare function decryptShippingAddress<T>(addr: T | undefined | null): T | undefined | null;
 /**
  * Encrypt PII inside seller payoutDetails before writing to Firestore.
  */

package/dist/security/pii-encrypt.js

@@ -352,44 +352,6 @@ export function piiIndicesFor(source, mapping) {
     return indices;
 }
 // --- Nested-object PII helpers ----------------------------------------------
-/**
- * Encrypt PII inside a shipping address stored in an order.
- * Supports string and object address shapes.
- */
-export function encryptShippingAddress(addr) {
-    if (!addr)
-        return addr;
-    if (typeof addr === "string") {
-        return encryptPii(addr);
-    }
-    if (typeof addr !== "object")
-        return addr;
-    return encryptPiiFields(addr, [
-        "fullName",
-        "phone",
-        "addressLine1",
-        "addressLine2",
-    ]);
-}
-/**
- * Decrypt PII inside a shipping address read from an order.
- * Supports string and object address shapes.
- */
-export function decryptShippingAddress(addr) {
-    if (!addr)
-        return addr;
-    if (typeof addr === "string") {
-        return decryptPii(addr);
-    }
-    if (typeof addr !== "object")
-        return addr;
-    return decryptPiiFields(addr, [
-        "fullName",
-        "phone",
-        "addressLine1",
-        "addressLine2",
-    ]);
-}
 /**
  * Encrypt PII inside seller payoutDetails before writing to Firestore.
  */

package/dist/server.d.ts

@@ -274,7 +274,6 @@ export { createEvent } from "./features/events/server";
 export { deleteEvent } from "./features/events/server";
 export { enterEvent } from "./features/events/server";
 export { eventIdGET } from "./features/events/server";
-export { eventsGET } from "./features/events/server";
 export { getEventLeaderboard } from "./features/events/server";
 export { getEventPollResults } from "./features/events/server";
 export type { PollResultEntry, SpinResultEntry } from "./features/events/index";
@@ -292,7 +291,6 @@ export { applyRefundDeductionAction, type ApplyRefundDeductionInput, type ApplyR
 export { createFaq } from "./features/faq/server";
 export { deleteFaq } from "./features/faq/server";
 export { faqCreateSchema } from "./features/faq/server";
-export { faqGET } from "./features/faq/server";
 export { faqUpdateSchema } from "./features/faq/server";
 export { getFaqById } from "./features/faq/server";
 export { listFaqs } from "./features/faq/server";
@@ -380,7 +378,6 @@ export { listReviewsBySeller } from "./features/reviews/server";
 export { reviewItemDELETE } from "./features/reviews/server";
 export { reviewItemGET } from "./features/reviews/server";
 export { reviewItemPATCH } from "./features/reviews/server";
-export { reviewsGET } from "./features/reviews/server";
 export { updateReview } from "./features/reviews/server";
 export { voteReviewHelpful } from "./features/reviews/server";
 export { searchGET } from "./features/search/server";
@@ -426,7 +423,6 @@ export { storeAuctionsGET } from "./features/stores/server";
 export { storeProductsGET } from "./features/stores/server";
 export { storeReviewsGET } from "./features/stores/server";
 export { storeSlugGET } from "./features/stores/server";
-export { storesGET } from "./features/stores/server";
 export { updateStoreAddressForSeller } from "./features/stores/server";
 export { buildCheckoutMessageURL } from "./features/whatsapp-bot/server";
 export { buildStatusMessage } from "./features/whatsapp-bot/server";
@@ -466,8 +462,6 @@ export { piiIndicesFor } from "./security/index";
 export { reserveUserSlug, userSlugBase, USER_SLUGS_COLLECTION } from "./features/auth/actions/user-slug";
 export { resolveProfileUser } from "./features/auth/actions/profile-actions";
 export { getPiiConfigError } from "./security/index";
-export { encryptShippingAddress } from "./security/index";
-export { decryptShippingAddress } from "./security/index";
 export { encryptPayoutDetails } from "./security/index";
 export { decryptPayoutDetails } from "./security/index";
 export { encryptShippingConfig } from "./security/index";

package/dist/server.js

@@ -776,8 +776,6 @@ export { enterEvent } from "./features/events/server";
 // eventIdGET - Shared export for event id get.
 export { eventIdGET } from "./features/events/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// eventsGET - Shared export for events get.
-export { eventsGET } from "./features/events/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getEventLeaderboard - Helper for get event leaderboard.
 export { getEventLeaderboard } from "./features/events/server";
@@ -820,8 +818,6 @@ export { deleteFaq } from "./features/faq/server";
 // faqCreateSchema - Model for faq create schema.
 export { faqCreateSchema } from "./features/faq/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// faqGET - Shared export for faq get.
-export { faqGET } from "./features/faq/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // faqUpdateSchema - Model for faq update schema.
 export { faqUpdateSchema } from "./features/faq/server";
@@ -1082,8 +1078,6 @@ export { reviewItemGET } from "./features/reviews/server";
 // reviewItemPATCH - Shared export for review item patch.
 export { reviewItemPATCH } from "./features/reviews/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// reviewsGET - Shared export for reviews get.
-export { reviewsGET } from "./features/reviews/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // updateReview - Helper for update review.
 export { updateReview } from "./features/reviews/server";
@@ -1221,8 +1215,6 @@ export { storeReviewsGET } from "./features/stores/server";
 // storeSlugGET - Shared export for store slug get.
 export { storeSlugGET } from "./features/stores/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// storesGET - Shared export for stores get.
-export { storesGET } from "./features/stores/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // updateStoreAddressForSeller - Helper for update store address for seller.
 export { updateStoreAddressForSeller } from "./features/stores/server";
@@ -1298,8 +1290,6 @@ export { piiIndicesFor } from "./security/index";
 export { reserveUserSlug, userSlugBase, USER_SLUGS_COLLECTION } from "./features/auth/actions/user-slug";
 export { resolveProfileUser } from "./features/auth/actions/profile-actions";
 export { getPiiConfigError } from "./security/index";
-export { encryptShippingAddress } from "./security/index";
-export { decryptShippingAddress } from "./security/index";
 export { encryptPayoutDetails } from "./security/index";
 export { decryptPayoutDetails } from "./security/index";
 export { encryptShippingConfig } from "./security/index";

package/dist/utils/index.d.ts

@@ -10,7 +10,6 @@ export * from "./array.helper";
 export * from "./object.helper";
 export * from "./pagination.helper";
 export * from "./sorting.helper";
-export * from "./filter.helper";
 export * from "./animation.helper";
 export * from "./color.helper";
 export * from "./business-day";

package/dist/utils/index.js

@@ -10,7 +10,6 @@ export * from "./array.helper";
 export * from "./object.helper";
 export * from "./pagination.helper";
 export * from "./sorting.helper";
-export * from "./filter.helper";
 export * from "./animation.helper";
 export * from "./color.helper";
 export * from "./business-day";

package/dist/utils/sieve-builder.d.ts

@@ -11,11 +11,6 @@ export declare const SIEVE_OP: {
     readonly NOT_CONTAINS: "!@=";
     readonly NOT_STARTS: "!_=";
     readonly NOT_ENDS: "!_-=";
-    readonly CONTAINS_CI: "@=*";
-    readonly STARTS_CI: "_=*";
-    readonly ENDS_CI: "_-=*";
-    readonly EQ_CI: "==*";
-    readonly NEQ_CI: "!=*";
 };
 export type SieveOp = (typeof SIEVE_OP)[keyof typeof SIEVE_OP];
 /** Operators for which the pipe `|` is valid for OR-matching within a single clause */

package/dist/utils/sieve-builder.js

@@ -11,20 +11,19 @@ export const SIEVE_OP = {
     NOT_CONTAINS: "!@=",
     NOT_STARTS: "!_=",
     NOT_ENDS: "!_-=",
-    CONTAINS_CI: "@=*",
-    STARTS_CI: "_=*",
-    ENDS_CI: "_-=*",
-    EQ_CI: "==*",
-    NEQ_CI: "!=*",
+    // The five case-insensitive operators (@=* _=* _-=* ==* !=*) were
+    // DELETED. Firestore has no case-insensitive comparison, so the adapter
+    // threw on every one — and with `throwExceptions: false` that throw
+    // returned a PARTIALLY-BUILT query rather than an error, so the clause,
+    // and every clause after it, was silently dropped. They read as working
+    // search operators and did the opposite. `searchTxt` + `array-contains`
+    // is the replacement.
 };
 /** Operators for which the pipe `|` is valid for OR-matching within a single clause */
 export const SIEVE_PIPE_OPS = new Set([
     SIEVE_OP.CONTAINS,
     SIEVE_OP.STARTS,
     SIEVE_OP.ENDS,
-    SIEVE_OP.CONTAINS_CI,
-    SIEVE_OP.STARTS_CI,
-    SIEVE_OP.ENDS_CI,
 ]);
 /** Single Sieve clause: sieveFilter("status", "==", "published") → "status==published" */
 export function sieveFilter(field, op, value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.30.11",
+  "version": "4.30.13",
   "license": "MIT",
   "publishConfig": {
     "access": "public"