@mohasinac/appkit 4.30.13 → 4.30.16

package/dist/_internal/server/functions/https.js

@@ -64,8 +64,23 @@ export const listingProcessor = defineFunction({
     handler: listingProcessorHandler,
     options: {
         region: REGION,
-        timeoutSeconds: 30,
-        memory: "256MiB",
+        // Matched to the `gateway` function's budget ON PURPOSE, and this is not
+        // over-provisioning.
+        //
+        // `listingProcessorHandler` is reachable two ways: this direct function,
+        // and `gateway` with `action: "listingProcessor"` (it is in
+        // GATEWAY_HANDLERS). `src/lib/listing-processor.ts` chooses between them on
+        // whether FIREBASE_FUNCTION_GATEWAY_URL is set — so an ENVIRONMENT VARIABLE
+        // decided which limits the same query ran under. At 30s/256MiB here against
+        // the gateway's 120s/512MiB, a heavy listing query could succeed through
+        // one path and time out through the other, with nothing at the call site
+        // saying which path served it. That is the shape of a production bug nobody
+        // can reproduce.
+        //
+        // Cloud Functions bill on use, not on the declared ceiling, so aligning the
+        // two costs nothing while idle and removes the non-determinism.
+        timeoutSeconds: 120,
+        memory: "512MiB",
         maxInstances: 20,
         minInstances: 0,
         cors: false,

package/dist/_internal/server/jobs/core/listingProcessor.js

@@ -11,7 +11,11 @@ import { normalizeError } from "../../../../errors/normalize";
 const DEFAULT_SORT = "-createdAt";
 const DEFAULT_PAGE = 1;
 const DEFAULT_PAGE_SIZE = 20;
-const MAX_PAGE_SIZE = 100;
+// 50, matching the app's own ceiling. This was 100, so a caller reaching the
+// Function could ask for twice what every route permits — and the routes are
+// where Rule #6's `pageSize <= 50` is enforced. A limit that only one of two
+// entry points applies is not a limit.
+const MAX_PAGE_SIZE = 50;
 class ListingError extends Error {
     constructor(status, message) {
         super(message);

package/dist/features/addresses/repository/addresses.repository.d.ts

@@ -3,7 +3,18 @@ import { type AddressBanStatus, type AddressCreateInput, type AddressDocument, t
 export declare class AddressesRepository extends BaseRepository<AddressDocument> {
     constructor();
     private decryptAddress;
-    private encryptAddressData;
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptAddressData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
+     */
+    protected piiFields: readonly ["fullName", "phone", "addressLine1", "addressLine2"];
     protected mapDoc<D = AddressDocument>(snap: DocumentSnapshot): D;
     createWithId(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;
     update(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;

package/dist/features/addresses/repository/addresses.repository.js

@@ -13,28 +13,37 @@ import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { serverLogger } from "../../../monitoring";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, } from "../../../providers/db-firebase";
-import { ADDRESS_PII_FIELDS, decryptPiiFields, encryptPiiFields, } from "../../../security";
+import { ADDRESS_PII_FIELDS, decryptPiiFields, } from "../../../security";
 import { ADDRESS_FIELDS, ADDRESSES_COLLECTION, } from "../schemas";
 export class AddressesRepository extends BaseRepository {
     constructor() {
         super(ADDRESSES_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptAddressData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = ADDRESS_PII_FIELDS;
     }
     decryptAddress(doc) {
         return decryptPiiFields(doc, [...ADDRESS_PII_FIELDS]);
     }
-    encryptAddressData(data) {
-        return encryptPiiFields(data, [...ADDRESS_PII_FIELDS]);
-    }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
         return this.decryptAddress(raw);
     }
     async createWithId(id, data) {
-        const encrypted = this.encryptAddressData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.createWithId(id, encrypted);
     }
     async update(id, data) {
-        const encrypted = this.encryptAddressData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.update(id, encrypted);
     }
     async listByOwner(ownerType, ownerId) {
@@ -91,7 +100,7 @@ export class AddressesRepository extends BaseRepository {
                 createdAt: now,
                 updatedAt: now,
             };
-            const encrypted = this.encryptAddressData(addressData);
+            const encrypted = this.applyWriteHooks(addressData);
             await docRef.set(prepareForFirestore(encrypted));
             serverLogger.info("Address created", {
                 ownerType,

package/dist/features/admin/components/AdminBlogView.js

@@ -23,7 +23,14 @@ export function AdminBlogView({ children, ...props }) {
         title: "Blog Posts",
         // buildBlogSearchTxt indexes title + excerpt + category + tags — NOT the post
         // body, which is not tokenised.
-        searchPlaceholder: "Search by title, excerpt, category or tag…",
+        // buildBlogSearchTxt indexes title + excerpt + category + tags — NOT the
+        // post body, which is not tokenised.
+        search: {
+            placeholder: "Search by title, excerpt, category or tag…",
+            mode: "partial",
+            fields: ["title", "excerpt", "category", "tags"],
+            commit: "debounce",
+        },
         emptyLabel: "No blog posts found",
         filterKeys: ["status", "isFeatured"],
         defaultSort: sortBy("publishedAt", "DESC"),

package/dist/features/admin/components/AdminCouponsView.js

@@ -53,7 +53,14 @@ export function AdminCouponsView({ children, onBulkArchive, onBulkDelete, ...pro
         portal: "admin",
         title: "Coupons",
         // buildCouponSearchTxt indexes code + name + description — nothing else.
-        searchPlaceholder: "Search by code, name or description…",
+        // buildCouponSearchTxt indexes exactly these three. Partial prefix
+        // matching, so debounce is the right commit here.
+        search: {
+            placeholder: "Search by code, name or description…",
+            mode: "partial",
+            fields: ["code", "name", "description"],
+            commit: "debounce",
+        },
         emptyLabel: "No coupons found",
         filterKeys: ["type", "showExpired"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/AdminOffersView.js

@@ -106,7 +106,15 @@ export function AdminOffersView({ children, ...props }) {
         // buildOfferSearchTxt indexes productTitle + productSlug + storeName. It does
         // NOT index buyerName or buyerEmail — those are PII, and the placeholder
         // must not promise a match it will never make.
-        searchPlaceholder: "Search by product or store…",
+        // buildOfferSearchTxt indexes productTitle + productSlug + storeName.
+        // NOT buyerName or buyerEmail — those are PII (D1), and a placeholder
+        // naming them would promise a match this corpus cannot make.
+        search: {
+            placeholder: "Search by product or store…",
+            mode: "partial",
+            fields: ["productTitle", "productSlug", "storeName"],
+            commit: "debounce",
+        },
         emptyLabel: "No offers found",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/AdminPayoutsView.js

@@ -81,7 +81,15 @@ export function AdminPayoutsView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Payouts",
-        searchPlaceholder: "Search stores, payout IDs, or order groups",
+        // 🛑 This said "Search stores, payout IDs, or order groups". The route
+        // resolves `q` as `sellerEmailIndex == piiBlindIndex(q)` when it contains
+        // an "@", else `sellerName == q` — both EXACT, and neither is a store, a
+        // payout id or an order group. All three promised things were unmatchable.
+        search: {
+            placeholder: "Seller email or name (exact match)",
+            mode: "exact",
+            fields: ["sellerEmail", "sellerName"],
+        },
         emptyLabel: "No payouts found",
         filterKeys: ["status", "showAllPayouts"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/AdminReviewsView.js

@@ -69,7 +69,20 @@ export function AdminReviewsView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Reviews",
-        searchPlaceholder: "Search reviews, products, or seller names",
+        // 🛑 This said "Search reviews, products, or seller names". The route
+        // resolves `q` as `userNameIndex == piiBlindIndex(q)` — an EXACT match on
+        // the REVIEWER's name, and nothing else. It matched no review text, no
+        // product and no seller, so a partial name returned an empty list that was
+        // indistinguishable from "no such reviewer".
+        //
+        // `mode: "exact"` is not a limitation to apologise for: the field is
+        // encrypted and ciphertext has no usable prefix (D1). Say so in the
+        // placeholder instead of promising what the corpus cannot do.
+        search: {
+            placeholder: "Reviewer name (exact match)",
+            mode: "exact",
+            fields: ["userName"],
+        },
         emptyLabel: "No reviews found",
         filterKeys: ["status", "rating"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/AdminScammersView.js

@@ -42,7 +42,21 @@ export function AdminScammersView({ children, ...props }) {
     const config = {
         portal: "admin",
         title: "Scammers",
-        searchPlaceholder: "Search by name, phone, UPI ID",
+        // buildScammerSearchTxt indexes all four identity arrays plus scamType.
+        // They are stored PLAINTEXT on purpose — a victim googles a UPI id before
+        // paying, so SEO is the feature — which is why this collection can have a
+        // partial-match box where users/reviews/payouts cannot.
+        //
+        // The old box promised the same three fields but ran `displayNames@=q`,
+        // i.e. array-contains on a WHOLE element: "Vikram" matched nothing
+        // against ["Vikram M", "Vikram Mehta"], and phone/UPI were never
+        // searched at all.
+        search: {
+            placeholder: "Search by name, phone, UPI ID or email…",
+            mode: "partial",
+            fields: ["displayNames", "phones", "upiIds", "emails", "scamType"],
+            commit: "debounce",
+        },
         emptyLabel: "No scammer profiles found",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/admin/components/DataListingView.d.ts

@@ -105,8 +105,29 @@ export interface ListingViewConfig<TResponse, TRow extends {
         placeholder: string;
         /** `exact` for a field resolved through an HMAC blind index. */
         mode?: "partial" | "exact";
-        /** Fields the endpoint actually matches on. */
+        /**
+         * Fields the endpoint actually matches on.
+         *
+         * Not decoration: this is what lets the audit check that the placeholder
+         * does not promise a match the corpus cannot make. A box reading "search
+         * by buyer" over an index built from productTitle/storeName/trackingNumber
+         * is the same lie as a box the endpoint ignores entirely — just harder to
+         * notice, because it returns a plausible empty list instead of nothing.
+         */
         fields?: readonly string[];
+        /**
+         * When the term reaches the URL. Defaults to `"enter"`, which is the
+         * behaviour every existing box already had.
+         *
+         * 🛑 `"debounce"` is invalid with `mode: "exact"` and the audit blocks the
+         * pairing. An exact search resolves an HMAC blind index or a whole-value
+         * equality, so every keystroke before the last is a query GUARANTEED to
+         * match nothing — the user watches "no results" while typing a value that
+         * is in fact present, and each of those round trips is a billed read.
+         */
+        commit?: "enter" | "debounce";
+        /** Debounce delay in ms. Ignored unless `commit: "debounce"`. */
+        debounceMs?: number;
     };
     emptyLabel?: string;
     sortOptions: ListingSortOption[];

package/dist/features/admin/components/DataListingView.js

@@ -26,6 +26,13 @@ export function DataListingView({ config, }) {
     const listing = useAdminListing({
         ...config,
         initialView: effectiveInitialView,
+        // Mapped explicitly: `...config` cannot reach these, they live one level
+        // down under `search`. An exact-match search is never debounced — every
+        // keystroke before the last is a query guaranteed to match nothing — so
+        // the mode forces "enter" regardless of what the view asked for, and the
+        // audit blocks the pairing at author time rather than relying on this.
+        searchCommit: config.search?.mode === "exact" ? "enter" : config.search?.commit,
+        searchDebounceMs: config.search?.debounceMs,
     });
     const { view, setView, table, panel, searchInput, setSearchInput, commitSearch, filterOpen, setFilterOpen, openFilters, applyFilters, clearFilters, pendingFilters, setPendingFilters, activeFilterCount, hasActiveState, resetAll, rows, isLoading, errorMessage, currentPage, totalPages, selection, pageSize, setPageSize, } = listing;
     const selectionContext = {

package/dist/features/admin/hooks/useAdminListing.d.ts

@@ -20,6 +20,15 @@ export interface AdminListingConfig<TResponse, TRow extends {
      * a non-"All" filter state (e.g. hide inactive rows) on first load, while
      * "Clear filters" (which writes an explicit "") still shows everything. */
     filterDefaults?: Record<string, string>;
+    /**
+     * When a typed term reaches the URL. `"enter"` (the default) is what every
+     * box already did — commit on Enter or the button, never on keystroke.
+     *
+     * Passed down from `ListingViewConfig.search.commit`; see the 🛑 there for
+     * why `"debounce"` is invalid with `mode: "exact"`.
+     */
+    searchCommit?: "enter" | "debounce";
+    searchDebounceMs?: number;
 }
 export declare function useAdminListing<TResponse, TRow extends {
     id: string;

package/dist/features/admin/hooks/useAdminListing.js

@@ -1,12 +1,12 @@
 "use client";
-import { useState, useCallback } from "react";
+import { useState, useCallback, useEffect, useRef } from "react";
 import { useUrlTable } from "../../../react/hooks/useUrlTable";
 import { useBulkSelection } from "../../../react/hooks/useBulkSelection";
 import { usePanelUrlSync } from "../../../react/hooks/use-panel-url-sync";
 import { useDataViewMode } from "../../account/hooks/useDataViewMode";
 import { useAdminListingData } from "./useAdminListingData";
 export function useAdminListing(config) {
-    const { filterKeys, defaultSort, pageSize: defaultPageSize = 25, queryKey, endpoint, mapRows, getTotal, buildFilters, buildExtraParams, filterDefaults = {}, } = config;
+    const { filterKeys, defaultSort, pageSize: defaultPageSize = 25, queryKey, endpoint, mapRows, getTotal, buildFilters, buildExtraParams, filterDefaults = {}, searchCommit = "enter", searchDebounceMs = 350, } = config;
     // Persisted, viewport-aware view-mode: below 768px defaults to "list"
     // (AdminViewCards' one-full-width-card-per-row layout) unless the caller
     // explicitly pins hideTableView (grid-only views like coupons); the user's
@@ -53,6 +53,34 @@ export function useAdminListing(config) {
     const commitSearch = useCallback(() => {
         table.set("q", searchInput.trim());
     }, [searchInput, table]);
+    // Debounced commit, opt-in per view.
+    //
+    // Two things here are load-bearing:
+    //
+    // 1. It compares against what is ALREADY in the URL and skips a no-op.
+    //    `table.set` issues a router.replace, and replacing the URL with the
+    //    value it already holds re-runs the query for nothing — on mount, on
+    //    every unrelated re-render, and on the render caused by the previous
+    //    commit. That is the double-navigation shape of Root Cause #13.
+    //
+    // 2. The timer is cleared on every keystroke AND on unmount, so a term is
+    //    never committed by a view the user has already navigated away from.
+    const debounceRef = useRef(null);
+    const committed = table.get("q") ?? "";
+    useEffect(() => {
+        if (searchCommit !== "debounce")
+            return;
+        const next = searchInput.trim();
+        if (next === committed)
+            return;
+        if (debounceRef.current)
+            clearTimeout(debounceRef.current);
+        debounceRef.current = setTimeout(() => table.set("q", next), searchDebounceMs);
+        return () => {
+            if (debounceRef.current)
+                clearTimeout(debounceRef.current);
+        };
+    }, [searchInput, committed, searchCommit, searchDebounceMs, table]);
     const activeFilterCount = filterKeys.filter((k) => !!table.get(k)).length;
     const hasActiveState = !!table.get("q") || table.get("sort") !== defaultSort || activeFilterCount > 0;
     const currentFilterState = Object.fromEntries(filterKeys.map((k) => [k, table.get(k)]));

package/dist/features/auth/repository/user.repository.d.ts

@@ -6,7 +6,28 @@ export declare class UserRepository extends BaseRepository<UserDocument> {
     static readonly SIEVE_FIELDS: FirebaseSieveFields;
     constructor();
     private decryptUser;
-    private encryptUserData;
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptUserData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
+     */
+    protected piiFields: readonly ["email", "phoneNumber", "googleLinkedEmail"];
+    protected piiIndexMap: Record<string, string>;
+    /**
+     * The base hook, plus the nested objects it cannot see.
+     *
+     * `piiFields` is a flat list of top-level names, so a nested blob has to be
+     * encrypted separately. Calling `super.applyWriteHooks` FIRST keeps a single
+     * encryption path with one extra step on top, rather than two parallel paths
+     * that have to agree — which is what the hand-rolled override was.
+     */
+    protected applyWriteHooks<D extends object>(data: D): D;
     protected mapDoc<D = UserDocument>(snap: DocumentSnapshot): D;
     createWithId(id: string, data: Partial<UserDocument>): Promise<UserDocument>;
     create(input: Omit<UserDocument, "id" | "createdAt" | "updatedAt">): Promise<UserDocument>;

package/dist/features/auth/repository/user.repository.js

@@ -1,11 +1,24 @@
 import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { USER_PII_FIELDS, USER_PII_INDEX_MAP, piiIndicesFor, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptPiiFields, encryptShippingConfig, piiBlindIndex, } from "../../../security";
+import { USER_PII_FIELDS, USER_PII_INDEX_MAP, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptShippingConfig, piiBlindIndex, } from "../../../security";
 import { USER_COLLECTION, USER_FIELDS, } from "../schemas";
 export class UserRepository extends BaseRepository {
     constructor() {
         super(USER_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptUserData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = USER_PII_FIELDS;
+        this.piiIndexMap = USER_PII_INDEX_MAP;
     }
     decryptUser(doc) {
         const decrypted = decryptPiiFields(doc, [...USER_PII_FIELDS]);
@@ -17,32 +30,22 @@ export class UserRepository extends BaseRepository {
         }
         return decrypted;
     }
-    encryptUserData(data) {
-        // encryptPiiFields encrypts each PII field in-place AND adds the corresponding
-        // blind-index sibling (e.g. email → emailIndex) from the plaintext value.
-        // addPiiIndices is intentionally NOT called here — it spreads the original
-        // plaintext `data` back into the result, which would overwrite the encrypted
-        // ciphertext with the original plaintext values, defeating the encryption.
-        //
-        // The mapped indices below are not optional. `encryptPiiFields` derives its
-        // sibling name mechanically as `${field}Index`, so `phoneNumber` produces
-        // `phoneNumberIndex` — but `findByPhone` queries `USER_FIELDS.PHONE_INDEX`,
-        // which is `phoneIndex`. Only the seed paths ever wrote that name, so
-        // **phone lookup could never match a user created by the app.**
-        // `piiIndicesFor` applies USER_PII_INDEX_MAP's real names and, unlike
-        // `addPiiIndices`, carries no plaintext back over the ciphertext.
-        const encrypted = {
-            ...encryptPiiFields(data, [...USER_PII_FIELDS]),
-            ...piiIndicesFor(data, USER_PII_INDEX_MAP),
-        };
-        const access = encrypted;
-        if (access.payoutDetails) {
+    /**
+     * The base hook, plus the nested objects it cannot see.
+     *
+     * `piiFields` is a flat list of top-level names, so a nested blob has to be
+     * encrypted separately. Calling `super.applyWriteHooks` FIRST keeps a single
+     * encryption path with one extra step on top, rather than two parallel paths
+     * that have to agree — which is what the hand-rolled override was.
+     */
+    applyWriteHooks(data) {
+        const out = super.applyWriteHooks(data);
+        const access = out;
+        if (access.payoutDetails)
             access.payoutDetails = encryptPayoutDetails(access.payoutDetails);
-        }
-        if (access.shippingConfig) {
+        if (access.shippingConfig)
             access.shippingConfig = encryptShippingConfig(access.shippingConfig);
-        }
-        return encrypted;
+        return out;
     }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
@@ -57,7 +60,7 @@ export class UserRepository extends BaseRepository {
         // check with no error anywhere (found via a live RBAC bug where an
         // admin account created this way couldn't access /admin).
         const withUid = { uid: id, ...data };
-        const encrypted = this.encryptUserData(withUid);
+        const encrypted = this.applyWriteHooks(withUid);
         return super.createWithId(id, encrypted);
     }
     async create(input) {
@@ -78,7 +81,7 @@ export class UserRepository extends BaseRepository {
             createdAt: new Date(),
             updatedAt: new Date(),
         };
-        const encrypted = this.encryptUserData(userData);
+        const encrypted = this.applyWriteHooks(userData);
         await this.db
             .collection(this.collection)
             .doc(id)
@@ -155,7 +158,7 @@ export class UserRepository extends BaseRepository {
         }
     }
     async update(uid, data) {
-        const encrypted = this.encryptUserData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.update(uid, encrypted);
     }
     async markEmailAsVerified(uid) {

package/dist/features/cart/repository/cart.repository.d.ts

@@ -1,5 +1,4 @@
 import { type DocumentReference } from "firebase-admin/firestore";
-import type { DocumentSnapshot } from "../../../providers/db-firebase";
 import { BaseRepository, type FirebaseSieveResult, type SieveModel } from "../../../providers/db-firebase";
 import { type AddToCartInput, type CartAppliedCoupon, type CartDocument, type CartStoreAddons, type CartItemDocument, type AddGroupLineInput, type UpdateCartItemInput, type UpdateCartGroupMembersInput } from "../schemas";
 export declare class CartRepository extends BaseRepository<CartDocument> {
@@ -7,7 +6,21 @@ export declare class CartRepository extends BaseRepository<CartDocument> {
     constructor();
     /** Admin-facing paginated list of carts. */
     list(model: SieveModel): Promise<FirebaseSieveResult<CartDocument>>;
-    protected mapDoc<D = CartDocument>(snap: DocumentSnapshot): D;
+    /**
+     * `mapDoc` is deliberately NOT overridden.
+     *
+     * It used to decrypt `items[].storeName` on every read — and nothing has
+     * ever encrypted that field. `CartRepository` declares no `piiFields`, and
+     * `storeName` appears nowhere in pii-schemas.ts. `decryptPii` passes a
+     * non-`enc:v1:` string straight through, so the call was a no-op on every
+     * document while reading as protection — the most expensive kind of dead
+     * code, because it answers the question "is this handled?" wrongly.
+     *
+     * A store name is not PII: it is the seller's public shopfront name, shown
+     * on every listing. If a genuinely private field is added to a cart line,
+     * declare it in `piiFields` so `applyWriteHooks` encrypts it on all nine
+     * write paths — do not reintroduce a decrypt with no matching encrypt.
+     */
     findByUserId(userId: string): Promise<CartDocument | null>;
     getOrCreate(userId: string): Promise<CartDocument>;
     createEmpty(userId: string): Promise<CartDocument>;

package/dist/features/cart/repository/cart.repository.js

@@ -6,7 +6,6 @@ import { normalizeError } from "../../../errors/normalize";
 const ERR_CART_ITEM_NOT_FOUND = "Cart item not found";
 const ERR_CART_ITEM_LOCKED = "This item requires payment and cannot be removed or modified.";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { decryptPii } from "../../../security";
 import { CART_COLLECTION, } from "../schemas";
 export class CartRepository extends BaseRepository {
     constructor() {
@@ -16,18 +15,21 @@ export class CartRepository extends BaseRepository {
     async list(model) {
         return this.sieveQuery(model, CartRepository.SIEVE_FIELDS);
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return {
-            ...raw,
-            items: (raw.items ?? []).map((item) => ({
-                ...item,
-                storeName: typeof item.storeName === "string"
-                    ? (decryptPii(item.storeName) ?? item.storeName)
-                    : item.storeName,
-            })),
-        };
-    }
+    /**
+     * `mapDoc` is deliberately NOT overridden.
+     *
+     * It used to decrypt `items[].storeName` on every read — and nothing has
+     * ever encrypted that field. `CartRepository` declares no `piiFields`, and
+     * `storeName` appears nowhere in pii-schemas.ts. `decryptPii` passes a
+     * non-`enc:v1:` string straight through, so the call was a no-op on every
+     * document while reading as protection — the most expensive kind of dead
+     * code, because it answers the question "is this handled?" wrongly.
+     *
+     * A store name is not PII: it is the seller's public shopfront name, shown
+     * on every listing. If a genuinely private field is added to a cart line,
+     * declare it in `piiFields` so `applyWriteHooks` encrypts it on all nine
+     * write paths — do not reintroduce a decrypt with no matching encrypt.
+     */
     async findByUserId(userId) {
         return this.findById(userId);
     }

package/dist/features/events/components/AdminEventsView.js

@@ -34,7 +34,13 @@ export function AdminEventsView({ children, ...props }) {
         portal: "admin",
         title: "Events",
         // buildEventSearchTxt indexes title + description + type + tags.
-        searchPlaceholder: "Search by title, description, type or tag…",
+        // buildEventSearchTxt indexes title + description + type + tags.
+        search: {
+            placeholder: "Search by title, description, type or tag…",
+            mode: "partial",
+            fields: ["title", "description", "type", "tags"],
+            commit: "debounce",
+        },
         emptyLabel: "No events found",
         filterKeys: ["status", "type"],
         defaultSort: sortBy("startsAt", "DESC"),

package/dist/features/orders/repository/orders.repository.d.ts

@@ -27,7 +27,18 @@ export interface OrderWriteContext {
 declare class OrderRepository extends BaseRepository<OrderDocument> {
     constructor();
     private decryptOrder;
-    private encryptOrderData;
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptOrderData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
+     */
+    protected piiFields: readonly ["userName", "userEmail", "sellerEmail"];
     protected mapDoc<D = OrderDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
     create(input: OrderCreateInput): Promise<OrderDocument>;
     findByUser(userId: string): Promise<OrderDocument[]>;

package/dist/features/orders/repository/orders.repository.js

@@ -3,7 +3,7 @@ import { planSearchTxt, refineSearchTxt, emptySearchResult, } from "../../../uti
 import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError, NotFoundError } from "../../../errors";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { decryptPiiFields, encryptPiiFields, ORDER_PII_FIELDS, } from "../../../security";
+import { decryptPiiFields, ORDER_PII_FIELDS, } from "../../../security";
 import { serverTimestamp, arrayUnion } from "../../../contracts/field-ops";
 import { createOrderId, ORDER_COLLECTION, ORDER_TRACKED_FIELDS, OrderStatusValues, } from "../schemas";
 import { withHistory } from "../../../_internal/shared/history/index";
@@ -24,15 +24,24 @@ const ACTIVE_ALLOWANCE_STATUSES = [
 class OrderRepository extends BaseRepository {
     constructor() {
         super(ORDER_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptOrderData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = ORDER_PII_FIELDS;
     }
     decryptOrder(doc) {
         return decryptPiiFields(doc, [
             ...ORDER_PII_FIELDS,
         ]);
     }
-    encryptOrderData(data) {
-        return encryptPiiFields(data, [...ORDER_PII_FIELDS]);
-    }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
         return this.decryptOrder(raw);
@@ -46,7 +55,7 @@ class OrderRepository extends BaseRepository {
             createdAt: new Date(),
             updatedAt: new Date(),
         };
-        const encrypted = this.encryptOrderData(orderData);
+        const encrypted = this.applyWriteHooks(orderData);
         await this.db
             .collection(this.collection)
             .doc(id)