@mohasinac/appkit 4.30.13 → 4.30.16

package/dist/features/scams/schemas/index.d.ts

@@ -10,11 +10,11 @@ export declare const scammerSocialMediaSchema: z.ZodObject<{
     handle: z.ZodString;
     url: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+    platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
     handle: string;
     url?: string | undefined;
 }, {
-    platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+    platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
     handle: string;
     url?: string | undefined;
 }>;
@@ -44,11 +44,11 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
         handle: z.ZodString;
         url: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }, {
-        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }>, "many">;
@@ -93,7 +93,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     scamType: string;
     reportedBy: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     phones: string[];
     upiIds: string[];
@@ -102,7 +102,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     incidentCount: number;
     seoSlug: string;
     socialMedia: {
-        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }[];
@@ -133,7 +133,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     scamType: string;
     reportedBy: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     phones: string[];
     upiIds: string[];
@@ -142,7 +142,7 @@ export declare const scammerFirestoreSchema: z.ZodObject<{
     incidentCount: number;
     seoSlug: string;
     socialMedia: {
-        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+        platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
         handle: string;
         url?: string | undefined;
     }[];
@@ -201,7 +201,7 @@ export declare const scammerIncidentFirestoreSchema: z.ZodObject<{
     reportedBy: string;
     scammerId: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     verifiedBy?: string | undefined;
     amountLost?: number | undefined;
@@ -224,7 +224,7 @@ export declare const scammerIncidentFirestoreSchema: z.ZodObject<{
     reportedBy: string;
     scammerId: string;
     reportedByAnon: boolean;
-    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+    scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
     evidence: string[];
     verifiedBy?: string | undefined;
     amountLost?: number | undefined;

package/dist/features/seller/components/SellerCouponsView.js

@@ -50,7 +50,13 @@ export function SellerCouponsView({ onCreateClick, onEditClick, onToggle, onDele
         portal: "seller",
         title: "Coupons",
         // buildCouponSearchTxt indexes code + name + description — nothing else.
-        searchPlaceholder: "Search by code, name or description…",
+        // buildCouponSearchTxt indexes exactly these three.
+        search: {
+            placeholder: "Search by code, name or description…",
+            mode: "partial",
+            fields: ["code", "name", "description"],
+            commit: "debounce",
+        },
         emptyLabel: "No coupons found — create your first coupon",
         filterKeys: ["isActive"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/seller/components/SellerOffersView.js

@@ -24,7 +24,14 @@ export function SellerOffersView({ children, onAcceptOffer, onRejectOffer, onCou
         title: "Offers",
         // buildOfferSearchTxt indexes productTitle + productSlug + storeName — never
         // the buyer's name or email.
-        searchPlaceholder: "Search by product or store…",
+        // buildOfferSearchTxt indexes productTitle + productSlug + storeName —
+        // never the buyer's name or email.
+        search: {
+            placeholder: "Search by product or store…",
+            mode: "partial",
+            fields: ["productTitle", "productSlug", "storeName"],
+            commit: "debounce",
+        },
         emptyLabel: "No offers received",
         filterKeys: ["status"],
         defaultSort: sortBy("createdAt", "DESC"),

package/dist/features/seller/components/SellerOrdersView.js

@@ -297,7 +297,14 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
         // buildOrderSearchTxt indexes productTitle, storeName and trackingNumber.
         // It does NOT index the buyer's name, email or address — those are PII,
         // and the placeholder must not promise a match it will never make.
-        searchPlaceholder: "Search by product, store or tracking number…",
+        // buildOrderSearchTxt indexes productTitle, storeName and trackingNumber.
+        // NOT the buyer's name, email or address — those are PII (D1).
+        search: {
+            placeholder: "Search by product, store or tracking number…",
+            mode: "partial",
+            fields: ["productTitle", "storeName", "trackingNumber"],
+            commit: "debounce",
+        },
         emptyLabel: "No orders yet",
         filterKeys: ["status"],
         defaultSort: DEFAULT_SORT,

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -220,52 +220,70 @@ const rawTesterChecklistItems = [
                     description: "Verify against the seeded fixtures: \"Test Collectible — Sold Out\" (standard, hidden until \"Show sold\" is on), \"Test Auction — Already Won\" (hidden until \"Show ended\" is on), \"Test Prize Draw — Already Closed\" (hidden until \"Show closed\" is on). All three should be genuinely absent by default, not just from an unrelated broken query.",
                     href: "/products",
                 },
+                {
+                    key: "product-type-filter-lives-in-drawer",
+                    label: "There is NO standalone \"TYPE\" chip row on /products — the listing-type filter is a \"Listing type\" checkbox section at the TOP of the Filters drawer",
+                    description: "Changed 2026-08-28. BEFORE: a full-width band of pill chips (Standard / Auctions / Pre-Orders / …) sat between the Available-Sold-All tabs and the product grid, and clicking one filtered instantly. AFTER: that band is gone — the availability tabs sit directly above the grid — and the same options appear as checkboxes under \"Listing type\" when you press Filters. Report it if you can still see the old chip band anywhere.",
+                    href: "/products",
+                },
                 {
                     key: "product-type-chips-cover-all-types",
-                    label: "The TYPE chip row on /products lists ALL nine listing types — Standard, Auctions, Pre-Orders, Prize Draws, Classifieds, Digital Codes, Live Items, Art and Stickers",
-                    description: "Fixed 2026-08-21 — the row used to show only 5 chips (All / Standard / Classified / Digital Codes / Live Items), so auctions, pre-orders, prize draws, art and stickers were unreachable from the main catalogue even though items of those types existed. Count the chips: there should be nine, and none labelled \"Bundles\" (bundles are not a listing type).",
+                    label: "The \"Listing type\" section in the /products Filters drawer lists ALL nine listing types — Standard, Auctions, Pre-Orders, Prize Draws, Classifieds, Digital Codes, Live Items, Art and Stickers",
+                    description: "Open Filters and count the checkboxes under \"Listing type\": there should be nine, and none labelled \"Bundles\" (bundles are not a listing type). A type missing here is unreachable from the main catalogue even when items of that type exist.",
                     href: "/products",
                 },
                 {
                     key: "product-type-chips-multi-select",
-                    label: "The TYPE chips behave as CHECKBOXES, not radio buttons — several can be ticked at once, and ticking Auctions + Pre-Orders shows both types in one grid",
-                    description: "Tick Auctions, then tick Pre-Orders WITHOUT unticking Auctions. Both must stay highlighted and the grid must contain items of both types. Untick both and the grid returns to showing every type.",
+                    label: "The \"Listing type\" boxes are CHECKBOXES, not radio buttons — ticking Auctions + Pre-Orders and pressing Apply shows both types in one grid",
+                    description: "Tick Auctions, then tick Pre-Orders WITHOUT unticking Auctions, then press Apply. Both must stay ticked when you reopen the drawer, and the grid must contain items of both types. Untick both, Apply, and the grid returns to showing every type.",
                     href: "/products",
                 },
                 {
                     key: "product-type-chips-none-means-all",
-                    label: "With NO type chip ticked, /products shows a mix of listing types — check the coloured type badges on the cards",
+                    label: "With NO \"Listing type\" box ticked, /products shows a mix of listing types — check the coloured type badges on the cards",
                     description: "\"Nothing ticked\" means \"every type\", so you should be able to spot at least two different badges (e.g. an \"Auction\" and a \"Digital Code\") within the first page without filtering.",
                     href: "/products",
                 },
+                {
+                    key: "product-type-filter-counts-in-badge",
+                    label: "Ticking a \"Listing type\" box and pressing Apply increases the number on the Filters button, and \"Reset all\" in the drawer clears the type selection again",
+                    description: "Changed 2026-08-28 — the type filter used to sit outside the drawer and was invisible to both the badge and Reset. BEFORE: pick a type, badge stays where it was, Reset all leaves the type selection in place. AFTER: the badge goes up by one, and Reset all unticks every type box and repopulates the grid with all types.",
+                    href: "/products",
+                },
                 {
                     key: "product-type-chip-drives-sort-options",
-                    label: "Ticking exactly ONE type changes the Sort dropdown to that type's own sorts — Auctions alone offers \"Ending Soon\", Pre-Orders alone offers \"Earliest Delivery\"",
-                    description: "Tick only Auctions and open Sort: \"Ending Soon\" must be present. Untick it, tick only Pre-Orders: \"Earliest Delivery\" must be present and \"Ending Soon\" gone. With two types ticked only the sorts valid for both remain (Newest / Price / Name) — that is correct, not a bug.",
+                    label: "Applying exactly ONE listing type changes the Sort dropdown to that type's own sorts — Auctions alone offers \"Ending Soon\", Pre-Orders alone offers \"Earliest Delivery\"",
+                    description: "Filters → tick only Auctions → Apply, then open Sort: \"Ending Soon\" must be present. Swap to only Pre-Orders and Apply: \"Earliest Delivery\" must be present and \"Ending Soon\" gone. With two types applied only the sorts valid for both remain (Newest / Price / Name) — that is correct, not a bug.",
                     href: "/products",
                 },
                 {
                     key: "product-type-chip-sort-resets-no-empty-page",
                     label: "Choosing a type-specific sort and THEN changing the type selection never leaves an empty grid or an error",
-                    description: "The important regression check. Tick Auctions, sort by \"Ending Soon\", then untick Auctions and tick Standard instead. The grid must repopulate with products. A blank page here means a stale sort leaked into the new query.",
+                    description: "The important regression check. Apply Auctions, sort by \"Ending Soon\", then reopen Filters, untick Auctions, tick Standard, Apply. The grid must repopulate with products and the Sort dropdown must fall back to Newest. A blank page here means a stale sort leaked into the new query.",
                     href: "/products",
                 },
                 {
                     key: "product-type-toggles-follow-selection",
-                    label: "The toolbar toggles follow the type selection — \"Show ended\" appears only when a time-limited type is in play, \"Show sold\" only when a sellable type is",
-                    description: "Tick only Auctions: a \"Show ended\" toggle appears. Tick only Standard instead: \"Show ended\" disappears and \"Show sold\" remains. With nothing ticked (= all types) both may appear, which is correct.",
+                    label: "The middle availability tab is worded for the applied types — \"Ended\" for Auctions alone, \"Sold\" for Standard alone, \"Sold & Ended\" with nothing applied",
+                    description: "Apply only Auctions and read the middle tab above the grid; then swap to only Standard and read it again. It must re-word itself, and switching to that tab must list the unavailable items of the applied type.",
                     href: "/products",
                 },
                 {
                     key: "product-type-chip-dedicated-page-link",
-                    label: "Ticking exactly one type that has its own browse page shows a \"Full <type> filters\" link that lands on the right page",
-                    description: "Tick only Auctions — a \"Full Auctions filters\" link should appear beside the chips and open /auctions. Repeat for Pre-Orders and Prize Draws.",
+                    label: "Ticking exactly one type that has its own browse page shows a \"Full <type> filters\" link, inside the drawer under the Listing type section, that lands on the right page",
+                    description: "Changed 2026-08-28 — the link used to sit beside the old chip row. Open Filters, tick only Auctions: a \"Full Auctions filters →\" link appears directly under the Listing type checkboxes (before you press Apply) and opens /auctions. Repeat for Pre-Orders and Prize Draws. With two types ticked, or none, the link must NOT appear.",
                     href: "/products",
                 },
                 {
                     key: "product-type-selection-survives-reload",
-                    label: "The ticked type chips are reflected in the URL and survive a reload and the browser Back button",
-                    description: "Tick Auctions + Art, copy the URL, open it in a new tab: the same two chips must come back ticked with the same grid. Then press Back and confirm the previous selection returns.",
+                    label: "The applied listing types are reflected in the URL and survive a reload and the browser Back button",
+                    description: "Apply Auctions + Art, copy the URL, open it in a new tab: the grid must match and reopening Filters must show those two boxes already ticked. Then press Back and confirm the previous selection returns.",
+                    href: "/products",
+                },
+                {
+                    key: "product-type-pending-until-apply",
+                    label: "Ticking a \"Listing type\" box does NOT change the grid until you press Apply — and closing the drawer with the X discards the change",
+                    description: "Changed 2026-08-28 — the old chips filtered on every click. Tick Auctions and watch the grid behind the drawer: it must not change. Press Apply and it does. Reopen, tick Art, close the drawer with the X (not Apply), and reopen: Art must be unticked again, matching what is actually applied.",
                     href: "/products",
                 },
                 {
@@ -282,8 +300,8 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "pre-orders-reachable-from-products",
-                    label: "Pre-orders are reachable from /products — tick the Pre-Orders chip and confirm real pre-order items appear with a \"Pre-Order\" badge",
-                    description: "This was the original report: pre-orders (and auctions, prize draws, art, stickers) had no chip at all, so they could only be found via their own dedicated pages.",
+                    label: "Pre-orders are reachable from /products — Filters → Listing type → tick Pre-Orders → Apply, and confirm real pre-order items appear with a \"Pre-Order\" badge",
+                    description: "This was the original report: pre-orders (and auctions, prize draws, art, stickers) had no entry in the type filter at all, so they could only be found via their own dedicated pages.",
                     href: "/products",
                 },
                 {
@@ -294,7 +312,8 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "art-stickers-type-chips-narrow",
-                    label: "On /art, the \"Art\" and \"Stickers\" type chips each narrow the grid to only that type — neither chip nor \"All\" ever returns zero rows",
+                    label: "On /art, the Filters drawer's \"Listing type\" section offers exactly two boxes — Art and Stickers — and each one alone narrows the grid to that type without ever returning zero rows",
+                    description: "This page spans only two of the nine listing types, so its Listing type section must show only those two. Tick Art → Apply, then Stickers → Apply, then untick both → Apply; all three states must return rows.",
                     href: "/art",
                 },
                 {
@@ -2338,6 +2357,131 @@ const rawTesterChecklistItems = [
                 { key: "tabs-mobile-dropdown", label: "Tabs on category/brand/product/event detail pages collapse into a colored dropdown on mobile once there are more than 5 tabs" },
             ],
         },
+        {
+            pageKey: "search",
+            pageLabel: "Search",
+            href: "/products",
+            cases: [
+                {
+                    key: "search-typeahead-differs",
+                    label: "Typing \"dranzer\" and then \"dragoon\" in the header search gives DIFFERENT suggestions",
+                    description: "WAS: the same 5 newest rows appeared for every keystroke, because no search term reached the query at all. If both terms give an identical list, the term is still being ignored.",
+                },
+                {
+                    key: "search-typeahead-no-drafts",
+                    label: "Header search suggestions contain no draft or archived listings",
+                    description: "WAS: the suggestion query applied no status filter, so unpublished drafts were visible to the public.",
+                },
+                {
+                    key: "search-prefix-match",
+                    label: "Searching \"dran\" finds Dranzer products on /products",
+                    description: "WAS: no match at all - only whole words matched, so a partial term found nothing.",
+                    href: "/products",
+                },
+                {
+                    key: "search-both-words-required",
+                    label: "Searching \"red dranzer\" returns only items matching BOTH words, not either one",
+                    description: "WAS: array-contains-any made multi-word search an OR, so adding a second word made the list LONGER instead of narrower. Check the count drops versus \"dranzer\" alone.",
+                    href: "/products",
+                },
+                {
+                    key: "search-plus-category-filter",
+                    label: "A search term AND a category filter apply together on /products",
+                    description: "WAS: an empty if-body dropped BOTH, so the page ignored the search and the filter simultaneously and showed everything. Apply one, note the count, then add the other and confirm it narrows again.",
+                    href: "/products",
+                },
+                {
+                    key: "search-keeps-sort",
+                    label: "Changing the sort while a search term is active re-orders the results and keeps the term",
+                    description: "WAS: the sort was silently discarded whenever a term was present, so the dropdown said \"Oldest\" over unsorted rows.",
+                    href: "/products",
+                },
+                {
+                    key: "search-keeps-facets",
+                    label: "On /products, searching keeps the price, tag and availability facets working",
+                    description: "WAS: the old case-insensitive operator threw inside the query builder, and because exceptions were suppressed the throw aborted every clause AFTER it - so one search term silently disabled the rest of the filter bar.",
+                    href: "/products",
+                },
+                {
+                    key: "search-case-and-accents",
+                    label: "\"POKEMON\" with an accent, without one, and capitalised all return the same results",
+                    description: "WAS: matching was case- and accent-sensitive, so only the exact stored spelling matched.",
+                    href: "/products",
+                },
+                {
+                    key: "search-single-char-narrows",
+                    label: "A single-character query narrows the list instead of showing everything",
+                    description: "WAS: a 1-char term was discarded as too short and the unfiltered collection came back - indistinguishable from a search that matched everything.",
+                    href: "/products",
+                },
+                {
+                    key: "search-faqs",
+                    label: "Searching on /faqs returns matching questions",
+                    description: "WAS: this is the report that started the whole migration - 63 FAQs existed, none had search tokens, so every query returned empty.",
+                    href: "/faqs",
+                },
+                {
+                    key: "search-faq-category-page",
+                    label: "Opening a FAQ category page renders its questions",
+                    description: "WAS: a missing index threw FAILED_PRECONDITION, which was swallowed, leaving a blank page with no error.",
+                    href: "/faqs",
+                },
+                {
+                    key: "search-scams-listing",
+                    label: "/scams lists the verified scammer profiles",
+                    description: "WAS: \"No verified scammers yet\" always, because the query needed an index that did not exist.",
+                    href: "/scams",
+                },
+                {
+                    key: "search-scam-partial-and-upi",
+                    label: "On /admin/scammers, searching \"Vikram\" finds \"Vikram Mehta\", and searching a UPI id also finds its profile",
+                    description: "WAS: the query matched a WHOLE array element, so \"Vikram\" found nothing against a list holding \"Vikram M\" and \"Vikram Mehta\" - and phones and UPI ids were never searched at all despite the box promising them.",
+                    href: "/admin/scammers",
+                },
+                {
+                    key: "search-store-event-blog-review",
+                    label: "Store, event, blog and review searches each return matches",
+                    description: "WAS: never implemented for any of the four - the box existed and the endpoint ignored the term.",
+                    href: "/blog",
+                },
+                {
+                    key: "search-admin-exact-match",
+                    label: "On /admin/reviews a FULL reviewer name matches, a partial one matches nothing, and the box says \"exact match\"",
+                    description: "This asserts a DELIBERATE decision, not a bug: the field is encrypted, and ciphertext has no usable prefix, so it is resolved through a blind index that matches exactly. What was wrong was the placeholder - it read \"Search reviews, products, or seller names\" and matched none of those three.",
+                    href: "/admin/reviews",
+                },
+                {
+                    key: "search-admin-degraded-sort",
+                    label: "Searching on /admin/payouts shows a notice that results are not sorted while searching",
+                    description: "Preserving the sort would need 14 more composite indexes to order a result an exact email match bounds at one row, so the sort is dropped on purpose. WAS: dropped SILENTLY - the sort dropdown kept displaying \"Oldest\" over unsorted rows.",
+                    href: "/admin/payouts",
+                },
+                {
+                    key: "search-admin-team-filter-chip",
+                    label: "On /admin/team, applying any filter chip still returns employees",
+                    description: "WAS: the filter string was CONCATENATED rather than joined, producing one malformed clause that matched nothing - so the team list silently emptied the moment anyone filtered it.",
+                    href: "/admin/team",
+                },
+                {
+                    key: "search-no-empty-toolbar-gap",
+                    label: "A listing page whose search box was removed shows no empty gap in its toolbar",
+                    description: "31 boxes were removed because their endpoints ignored the term. The toolbar should close up, not leave a hole where the input was.",
+                    href: "/admin/coupons",
+                },
+                {
+                    key: "search-nonsense-term-returns-nothing",
+                    label: "Searching \"zzzznope\" anywhere returns ZERO results",
+                    description: "The single most important case here. Every bug above returned HTTP 200 with plausible-looking rows, so a real term matching something proves nothing - only a nonsense term returning nothing distinguishes \"filtering\" from \"returning everything\". Try it on /products, /faqs, /blog and /admin/scammers.",
+                    href: "/products",
+                },
+                {
+                    key: "search-finds-older-records",
+                    label: "An OLDER listing - one that existed before this feature shipped - is findable by name",
+                    description: "Write this one carefully. Every other case here passes on freshly seeded data while real production documents stay invisible, because search tokens are only written when a record is saved. Pick a listing that has NOT been edited recently and confirm it is findable; if it is not, the backfill did not cover it.",
+                    href: "/products",
+                },
+            ],
+        },
     ]),
     ...group("community-support", "Community & Support", [
         {

package/dist/providers/db-firebase/base.repository.d.ts

@@ -62,6 +62,18 @@ export declare abstract class BaseRepository<T extends DocumentData> {
     update(id: string, data: Partial<T>): Promise<T>;
     delete(id: string): Promise<void>;
     exists(id: string): Promise<boolean>;
+    /**
+     * Server-side aggregation — never a full read.
+     *
+     * This used to be `getCollection().get()` then `.size`, which downloads every
+     * document in the collection to learn how many there are. On `products` or
+     * `orders` that is the entire collection billed as reads, and the payload is
+     * discarded immediately. Straight Rule #6 violation, and it scales with the
+     * data rather than staying flat.
+     *
+     * `count()` is a Firestore aggregation query: the server returns a number,
+     * billed at one read per 1000 documents matched rather than one per document.
+     */
     count(): Promise<number>;
     protected sieveQuery<TResult extends DocumentData = T>(model: SieveModel, fields: FirebaseSieveFields, options?: FirebaseSieveOptions & {
         baseQuery?: CollectionReference | Query;

package/dist/providers/db-firebase/base.repository.js

@@ -218,10 +218,22 @@ export class BaseRepository {
             throw new DatabaseError(`Failed to check document existence: ${id}`, error);
         }
     }
+    /**
+     * Server-side aggregation — never a full read.
+     *
+     * This used to be `getCollection().get()` then `.size`, which downloads every
+     * document in the collection to learn how many there are. On `products` or
+     * `orders` that is the entire collection billed as reads, and the payload is
+     * discarded immediately. Straight Rule #6 violation, and it scales with the
+     * data rather than staying flat.
+     *
+     * `count()` is a Firestore aggregation query: the server returns a number,
+     * billed at one read per 1000 documents matched rather than one per document.
+     */
     async count() {
         try {
-            const snapshot = await this.getCollection().get();
-            return snapshot.size;
+            const snapshot = await this.getCollection().count().get();
+            return snapshot.data().count;
         }
         catch (error) {
             void normalizeError(error);

package/dist/react/hooks/usePendingFilters.d.ts

@@ -19,8 +19,18 @@ export interface UsePendingFiltersReturn {
     appliedCount: number;
     /** Update one key in pending state (does NOT write to URL) */
     set: (key: string, values: string[]) => void;
-    /** Write all pending keys to the URL (resets page to 1) */
-    apply: () => void;
+    /**
+     * Write all pending keys to the URL (resets page to 1).
+     *
+     * `extras` piggy-backs non-filter keys onto the SAME `router.replace` —
+     * the escape hatch `clearAll` already has, for the same reason. A caller
+     * that needs to blank `sort` alongside a filter change (a sort valid for
+     * one selection can be FAILED_PRECONDITION for the next) must not issue a
+     * second `set`: it would read stale searchParams and overwrite this update
+     * (Root Cause #13). Filter keys are written last, so `extras` can never
+     * shadow one.
+     */
+    apply: (extras?: Record<string, string>) => void;
     /** Discard pending, revert to applied (URL) state */
     reset: () => void;
     /** Clear all keys in both pending state and the URL */

package/dist/react/hooks/usePendingFilters.js

@@ -47,8 +47,8 @@ export function usePendingFilters({ table, keys, }) {
     const set = useCallback((key, values) => {
         setPending((prev) => ({ ...prev, [key]: values }));
     }, []);
-    const apply = useCallback(() => {
-        const updates = { page: "1" };
+    const apply = useCallback((extras) => {
+        const updates = { page: "1", ...extras };
         for (const k of keys) {
             updates[k] = (pending[k] ?? []).join(",");
         }

package/dist/react/hooks/usePendingTable.d.ts

@@ -13,8 +13,15 @@ export interface UsePendingTableReturn {
     pendingTable: PendingTable;
     /** Count of applied (URL) filter values — use for the filter badge */
     filterActiveCount: number;
-    /** Commit all pending changes to the URL (resets page to 1) */
-    onFilterApply: () => void;
+    /**
+     * Commit all pending changes to the URL (resets page to 1).
+     *
+     * Pass `extras` to write non-filter keys in the SAME `router.replace` —
+     * e.g. blanking `sort` when the applied filters invalidate it. A follow-up
+     * `table.set` would read stale searchParams and clobber this one
+     * (Root Cause #13).
+     */
+    onFilterApply: (extras?: Record<string, string>) => void;
     /** Clear all filter keys from pending state and URL */
     onFilterClear: () => void;
     /**

package/dist/schemas/registry.d.ts

@@ -3281,11 +3281,11 @@ export declare const SCHEMAS: {
                 handle: import("zod").ZodString;
                 url: import("zod").ZodOptional<import("zod").ZodString>;
             }, "strip", import("zod").ZodTypeAny, {
-                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
                 handle: string;
                 url?: string | undefined;
             }, {
-                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
                 handle: string;
                 url?: string | undefined;
             }>, "many">;
@@ -3330,7 +3330,7 @@ export declare const SCHEMAS: {
             scamType: string;
             reportedBy: string;
             reportedByAnon: boolean;
-            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
             evidence: string[];
             phones: string[];
             upiIds: string[];
@@ -3339,7 +3339,7 @@ export declare const SCHEMAS: {
             incidentCount: number;
             seoSlug: string;
             socialMedia: {
-                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
                 handle: string;
                 url?: string | undefined;
             }[];
@@ -3370,7 +3370,7 @@ export declare const SCHEMAS: {
             scamType: string;
             reportedBy: string;
             reportedByAnon: boolean;
-            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
             evidence: string[];
             phones: string[];
             upiIds: string[];
@@ -3379,7 +3379,7 @@ export declare const SCHEMAS: {
             incidentCount: number;
             seoSlug: string;
             socialMedia: {
-                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "twitter" | "linkedin" | "telegram" | "olx";
+                platform: "other" | "whatsapp" | "youtube" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "linkedin";
                 handle: string;
                 url?: string | undefined;
             }[];
@@ -3438,7 +3438,7 @@ export declare const SCHEMAS: {
             reportedBy: string;
             scammerId: string;
             reportedByAnon: boolean;
-            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
             evidence: string[];
             verifiedBy?: string | undefined;
             amountLost?: number | undefined;
@@ -3461,7 +3461,7 @@ export declare const SCHEMAS: {
             reportedBy: string;
             scammerId: string;
             reportedByAnon: boolean;
-            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "twitter" | "telegram" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
+            scamPlatform: "other" | "whatsapp" | "letitrip" | "instagram" | "facebook" | "telegram" | "twitter" | "olx" | "facebook_marketplace" | "in_person" | "phone_call";
             evidence: string[];
             verifiedBy?: string | undefined;
             amountLost?: number | undefined;

package/dist/security/pii-schemas.d.ts

@@ -5,7 +5,25 @@
  * encrypted before storage and decrypted on read.
  */
 /** PII fields in the users collection (top-level string fields) */
-export declare const USER_PII_FIELDS: readonly ["email", "phoneNumber"];
+/**
+ * `googleLinkedEmail` was added 2026-08-28, found by audit-pii-coverage.
+ *
+ * It is a real email address, written in cleartext by the Google OAuth callback
+ * (`api/auth/google/callback`, three write sites) and stored on the user
+ * document beside `email` — which has always been encrypted. So one user's two
+ * email addresses sat in the same document, one ciphertext and one plaintext,
+ * and nothing pointed at the difference.
+ *
+ * No blind index: nothing queries by it. Its only reader is the account
+ * holder's own profile ("Signed in as …"), which is a legitimate plaintext read.
+ *
+ * Existing rows stay plaintext until backfilled and keep reading correctly —
+ * `decryptValue` passes a non-`enc:v1:` string through unchanged — so new
+ * writes encrypt while old rows converge, never diverge. Add
+ * `googleLinkedEmail` to the `users` target in `backfill-pii.mjs` when that
+ * backfill is next run.
+ */
+export declare const USER_PII_FIELDS: readonly ["email", "phoneNumber", "googleLinkedEmail"];
 /** Blind-index mapping for queryable user PII: source → index field name */
 export declare const USER_PII_INDEX_MAP: Record<string, string>;
 /** PII fields in the addresses subcollection */

package/dist/security/pii-schemas.js

@@ -5,7 +5,25 @@
  * encrypted before storage and decrypted on read.
  */
 /** PII fields in the users collection (top-level string fields) */
-export const USER_PII_FIELDS = ["email", "phoneNumber"];
+/**
+ * `googleLinkedEmail` was added 2026-08-28, found by audit-pii-coverage.
+ *
+ * It is a real email address, written in cleartext by the Google OAuth callback
+ * (`api/auth/google/callback`, three write sites) and stored on the user
+ * document beside `email` — which has always been encrypted. So one user's two
+ * email addresses sat in the same document, one ciphertext and one plaintext,
+ * and nothing pointed at the difference.
+ *
+ * No blind index: nothing queries by it. Its only reader is the account
+ * holder's own profile ("Signed in as …"), which is a legitimate plaintext read.
+ *
+ * Existing rows stay plaintext until backfilled and keep reading correctly —
+ * `decryptValue` passes a non-`enc:v1:` string through unchanged — so new
+ * writes encrypt while old rows converge, never diverge. Add
+ * `googleLinkedEmail` to the `users` target in `backfill-pii.mjs` when that
+ * backfill is next run.
+ */
+export const USER_PII_FIELDS = ["email", "phoneNumber", "googleLinkedEmail"];
 /** Blind-index mapping for queryable user PII: source → index field name */
 export const USER_PII_INDEX_MAP = {
     email: "emailIndex",

package/dist/seed/_helpers/search-txt-wrappers.d.ts

@@ -1,4 +1,5 @@
 import type { StoreDocument } from "../../features/stores/schemas/firestore";
+import type { ScammerDocument } from "../../features/scams/schemas/firestore";
 import type { EventDocument } from "../../features/events/schemas/firestore";
 import type { BlogPostDocument } from "../../features/blog/schemas/firestore";
 import type { ReviewDocument } from "../../features/reviews/schemas/firestore";
@@ -12,3 +13,4 @@ export declare function withReviewSearchTxt<T extends Partial<ReviewDocument>>(p
 export declare function withOrderSearchTxt<T extends Partial<OrderDocument>>(p: T): T;
 export declare function withCouponSearchTxt<T extends Partial<CouponDocument>>(p: T): T;
 export declare function withOfferSearchTxt<T extends Partial<OfferDocument>>(p: T): T;
+export declare function withScammerSearchTxt<T extends Partial<ScammerDocument>>(p: T): T;