@mohasinac/appkit 4.30.15 → 4.30.16

package/dist/_internal/server/functions/https.js

@@ -64,8 +64,23 @@ export const listingProcessor = defineFunction({
     handler: listingProcessorHandler,
     options: {
         region: REGION,
-        timeoutSeconds: 30,
-        memory: "256MiB",
+        // Matched to the `gateway` function's budget ON PURPOSE, and this is not
+        // over-provisioning.
+        //
+        // `listingProcessorHandler` is reachable two ways: this direct function,
+        // and `gateway` with `action: "listingProcessor"` (it is in
+        // GATEWAY_HANDLERS). `src/lib/listing-processor.ts` chooses between them on
+        // whether FIREBASE_FUNCTION_GATEWAY_URL is set — so an ENVIRONMENT VARIABLE
+        // decided which limits the same query ran under. At 30s/256MiB here against
+        // the gateway's 120s/512MiB, a heavy listing query could succeed through
+        // one path and time out through the other, with nothing at the call site
+        // saying which path served it. That is the shape of a production bug nobody
+        // can reproduce.
+        //
+        // Cloud Functions bill on use, not on the declared ceiling, so aligning the
+        // two costs nothing while idle and removes the non-determinism.
+        timeoutSeconds: 120,
+        memory: "512MiB",
         maxInstances: 20,
         minInstances: 0,
         cors: false,

package/dist/_internal/server/jobs/core/listingProcessor.js

@@ -11,7 +11,11 @@ import { normalizeError } from "../../../../errors/normalize";
 const DEFAULT_SORT = "-createdAt";
 const DEFAULT_PAGE = 1;
 const DEFAULT_PAGE_SIZE = 20;
-const MAX_PAGE_SIZE = 100;
+// 50, matching the app's own ceiling. This was 100, so a caller reaching the
+// Function could ask for twice what every route permits — and the routes are
+// where Rule #6's `pageSize <= 50` is enforced. A limit that only one of two
+// entry points applies is not a limit.
+const MAX_PAGE_SIZE = 50;
 class ListingError extends Error {
     constructor(status, message) {
         super(message);

package/dist/features/addresses/repository/addresses.repository.d.ts

@@ -3,7 +3,18 @@ import { type AddressBanStatus, type AddressCreateInput, type AddressDocument, t
 export declare class AddressesRepository extends BaseRepository<AddressDocument> {
     constructor();
     private decryptAddress;
-    private encryptAddressData;
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptAddressData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
+     */
+    protected piiFields: readonly ["fullName", "phone", "addressLine1", "addressLine2"];
     protected mapDoc<D = AddressDocument>(snap: DocumentSnapshot): D;
     createWithId(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;
     update(id: string, data: Partial<AddressDocument>): Promise<AddressDocument>;

package/dist/features/addresses/repository/addresses.repository.js

@@ -13,28 +13,37 @@ import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { serverLogger } from "../../../monitoring";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, } from "../../../providers/db-firebase";
-import { ADDRESS_PII_FIELDS, decryptPiiFields, encryptPiiFields, } from "../../../security";
+import { ADDRESS_PII_FIELDS, decryptPiiFields, } from "../../../security";
 import { ADDRESS_FIELDS, ADDRESSES_COLLECTION, } from "../schemas";
 export class AddressesRepository extends BaseRepository {
     constructor() {
         super(ADDRESSES_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptAddressData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = ADDRESS_PII_FIELDS;
     }
     decryptAddress(doc) {
         return decryptPiiFields(doc, [...ADDRESS_PII_FIELDS]);
     }
-    encryptAddressData(data) {
-        return encryptPiiFields(data, [...ADDRESS_PII_FIELDS]);
-    }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
         return this.decryptAddress(raw);
     }
     async createWithId(id, data) {
-        const encrypted = this.encryptAddressData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.createWithId(id, encrypted);
     }
     async update(id, data) {
-        const encrypted = this.encryptAddressData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.update(id, encrypted);
     }
     async listByOwner(ownerType, ownerId) {
@@ -91,7 +100,7 @@ export class AddressesRepository extends BaseRepository {
                 createdAt: now,
                 updatedAt: now,
             };
-            const encrypted = this.encryptAddressData(addressData);
+            const encrypted = this.applyWriteHooks(addressData);
             await docRef.set(prepareForFirestore(encrypted));
             serverLogger.info("Address created", {
                 ownerType,

package/dist/features/auth/repository/user.repository.d.ts

@@ -6,7 +6,28 @@ export declare class UserRepository extends BaseRepository<UserDocument> {
     static readonly SIEVE_FIELDS: FirebaseSieveFields;
     constructor();
     private decryptUser;
-    private encryptUserData;
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptUserData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
+     */
+    protected piiFields: readonly ["email", "phoneNumber", "googleLinkedEmail"];
+    protected piiIndexMap: Record<string, string>;
+    /**
+     * The base hook, plus the nested objects it cannot see.
+     *
+     * `piiFields` is a flat list of top-level names, so a nested blob has to be
+     * encrypted separately. Calling `super.applyWriteHooks` FIRST keeps a single
+     * encryption path with one extra step on top, rather than two parallel paths
+     * that have to agree — which is what the hand-rolled override was.
+     */
+    protected applyWriteHooks<D extends object>(data: D): D;
     protected mapDoc<D = UserDocument>(snap: DocumentSnapshot): D;
     createWithId(id: string, data: Partial<UserDocument>): Promise<UserDocument>;
     create(input: Omit<UserDocument, "id" | "createdAt" | "updatedAt">): Promise<UserDocument>;

package/dist/features/auth/repository/user.repository.js

@@ -1,11 +1,24 @@
 import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { USER_PII_FIELDS, USER_PII_INDEX_MAP, piiIndicesFor, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptPiiFields, encryptShippingConfig, piiBlindIndex, } from "../../../security";
+import { USER_PII_FIELDS, USER_PII_INDEX_MAP, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptShippingConfig, piiBlindIndex, } from "../../../security";
 import { USER_COLLECTION, USER_FIELDS, } from "../schemas";
 export class UserRepository extends BaseRepository {
     constructor() {
         super(USER_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptUserData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = USER_PII_FIELDS;
+        this.piiIndexMap = USER_PII_INDEX_MAP;
     }
     decryptUser(doc) {
         const decrypted = decryptPiiFields(doc, [...USER_PII_FIELDS]);
@@ -17,32 +30,22 @@ export class UserRepository extends BaseRepository {
         }
         return decrypted;
     }
-    encryptUserData(data) {
-        // encryptPiiFields encrypts each PII field in-place AND adds the corresponding
-        // blind-index sibling (e.g. email → emailIndex) from the plaintext value.
-        // addPiiIndices is intentionally NOT called here — it spreads the original
-        // plaintext `data` back into the result, which would overwrite the encrypted
-        // ciphertext with the original plaintext values, defeating the encryption.
-        //
-        // The mapped indices below are not optional. `encryptPiiFields` derives its
-        // sibling name mechanically as `${field}Index`, so `phoneNumber` produces
-        // `phoneNumberIndex` — but `findByPhone` queries `USER_FIELDS.PHONE_INDEX`,
-        // which is `phoneIndex`. Only the seed paths ever wrote that name, so
-        // **phone lookup could never match a user created by the app.**
-        // `piiIndicesFor` applies USER_PII_INDEX_MAP's real names and, unlike
-        // `addPiiIndices`, carries no plaintext back over the ciphertext.
-        const encrypted = {
-            ...encryptPiiFields(data, [...USER_PII_FIELDS]),
-            ...piiIndicesFor(data, USER_PII_INDEX_MAP),
-        };
-        const access = encrypted;
-        if (access.payoutDetails) {
+    /**
+     * The base hook, plus the nested objects it cannot see.
+     *
+     * `piiFields` is a flat list of top-level names, so a nested blob has to be
+     * encrypted separately. Calling `super.applyWriteHooks` FIRST keeps a single
+     * encryption path with one extra step on top, rather than two parallel paths
+     * that have to agree — which is what the hand-rolled override was.
+     */
+    applyWriteHooks(data) {
+        const out = super.applyWriteHooks(data);
+        const access = out;
+        if (access.payoutDetails)
             access.payoutDetails = encryptPayoutDetails(access.payoutDetails);
-        }
-        if (access.shippingConfig) {
+        if (access.shippingConfig)
             access.shippingConfig = encryptShippingConfig(access.shippingConfig);
-        }
-        return encrypted;
+        return out;
     }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
@@ -57,7 +60,7 @@ export class UserRepository extends BaseRepository {
         // check with no error anywhere (found via a live RBAC bug where an
         // admin account created this way couldn't access /admin).
         const withUid = { uid: id, ...data };
-        const encrypted = this.encryptUserData(withUid);
+        const encrypted = this.applyWriteHooks(withUid);
         return super.createWithId(id, encrypted);
     }
     async create(input) {
@@ -78,7 +81,7 @@ export class UserRepository extends BaseRepository {
             createdAt: new Date(),
             updatedAt: new Date(),
         };
-        const encrypted = this.encryptUserData(userData);
+        const encrypted = this.applyWriteHooks(userData);
         await this.db
             .collection(this.collection)
             .doc(id)
@@ -155,7 +158,7 @@ export class UserRepository extends BaseRepository {
         }
     }
     async update(uid, data) {
-        const encrypted = this.encryptUserData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.update(uid, encrypted);
     }
     async markEmailAsVerified(uid) {

package/dist/features/cart/repository/cart.repository.d.ts

@@ -1,5 +1,4 @@
 import { type DocumentReference } from "firebase-admin/firestore";
-import type { DocumentSnapshot } from "../../../providers/db-firebase";
 import { BaseRepository, type FirebaseSieveResult, type SieveModel } from "../../../providers/db-firebase";
 import { type AddToCartInput, type CartAppliedCoupon, type CartDocument, type CartStoreAddons, type CartItemDocument, type AddGroupLineInput, type UpdateCartItemInput, type UpdateCartGroupMembersInput } from "../schemas";
 export declare class CartRepository extends BaseRepository<CartDocument> {
@@ -7,7 +6,21 @@ export declare class CartRepository extends BaseRepository<CartDocument> {
     constructor();
     /** Admin-facing paginated list of carts. */
     list(model: SieveModel): Promise<FirebaseSieveResult<CartDocument>>;
-    protected mapDoc<D = CartDocument>(snap: DocumentSnapshot): D;
+    /**
+     * `mapDoc` is deliberately NOT overridden.
+     *
+     * It used to decrypt `items[].storeName` on every read — and nothing has
+     * ever encrypted that field. `CartRepository` declares no `piiFields`, and
+     * `storeName` appears nowhere in pii-schemas.ts. `decryptPii` passes a
+     * non-`enc:v1:` string straight through, so the call was a no-op on every
+     * document while reading as protection — the most expensive kind of dead
+     * code, because it answers the question "is this handled?" wrongly.
+     *
+     * A store name is not PII: it is the seller's public shopfront name, shown
+     * on every listing. If a genuinely private field is added to a cart line,
+     * declare it in `piiFields` so `applyWriteHooks` encrypts it on all nine
+     * write paths — do not reintroduce a decrypt with no matching encrypt.
+     */
     findByUserId(userId: string): Promise<CartDocument | null>;
     getOrCreate(userId: string): Promise<CartDocument>;
     createEmpty(userId: string): Promise<CartDocument>;

package/dist/features/cart/repository/cart.repository.js

@@ -6,7 +6,6 @@ import { normalizeError } from "../../../errors/normalize";
 const ERR_CART_ITEM_NOT_FOUND = "Cart item not found";
 const ERR_CART_ITEM_LOCKED = "This item requires payment and cannot be removed or modified.";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { decryptPii } from "../../../security";
 import { CART_COLLECTION, } from "../schemas";
 export class CartRepository extends BaseRepository {
     constructor() {
@@ -16,18 +15,21 @@ export class CartRepository extends BaseRepository {
     async list(model) {
         return this.sieveQuery(model, CartRepository.SIEVE_FIELDS);
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return {
-            ...raw,
-            items: (raw.items ?? []).map((item) => ({
-                ...item,
-                storeName: typeof item.storeName === "string"
-                    ? (decryptPii(item.storeName) ?? item.storeName)
-                    : item.storeName,
-            })),
-        };
-    }
+    /**
+     * `mapDoc` is deliberately NOT overridden.
+     *
+     * It used to decrypt `items[].storeName` on every read — and nothing has
+     * ever encrypted that field. `CartRepository` declares no `piiFields`, and
+     * `storeName` appears nowhere in pii-schemas.ts. `decryptPii` passes a
+     * non-`enc:v1:` string straight through, so the call was a no-op on every
+     * document while reading as protection — the most expensive kind of dead
+     * code, because it answers the question "is this handled?" wrongly.
+     *
+     * A store name is not PII: it is the seller's public shopfront name, shown
+     * on every listing. If a genuinely private field is added to a cart line,
+     * declare it in `piiFields` so `applyWriteHooks` encrypts it on all nine
+     * write paths — do not reintroduce a decrypt with no matching encrypt.
+     */
     async findByUserId(userId) {
         return this.findById(userId);
     }

package/dist/features/orders/repository/orders.repository.d.ts

@@ -27,7 +27,18 @@ export interface OrderWriteContext {
 declare class OrderRepository extends BaseRepository<OrderDocument> {
     constructor();
     private decryptOrder;
-    private encryptOrderData;
+    /**
+     * Declared, not hand-rolled.
+     *
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptOrderData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
+     */
+    protected piiFields: readonly ["userName", "userEmail", "sellerEmail"];
     protected mapDoc<D = OrderDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
     create(input: OrderCreateInput): Promise<OrderDocument>;
     findByUser(userId: string): Promise<OrderDocument[]>;

package/dist/features/orders/repository/orders.repository.js

@@ -3,7 +3,7 @@ import { planSearchTxt, refineSearchTxt, emptySearchResult, } from "../../../uti
 import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError, NotFoundError } from "../../../errors";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { decryptPiiFields, encryptPiiFields, ORDER_PII_FIELDS, } from "../../../security";
+import { decryptPiiFields, ORDER_PII_FIELDS, } from "../../../security";
 import { serverTimestamp, arrayUnion } from "../../../contracts/field-ops";
 import { createOrderId, ORDER_COLLECTION, ORDER_TRACKED_FIELDS, OrderStatusValues, } from "../schemas";
 import { withHistory } from "../../../_internal/shared/history/index";
@@ -24,15 +24,24 @@ const ACTIVE_ALLOWANCE_STATUSES = [
 class OrderRepository extends BaseRepository {
     constructor() {
         super(ORDER_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptOrderData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = ORDER_PII_FIELDS;
     }
     decryptOrder(doc) {
         return decryptPiiFields(doc, [
             ...ORDER_PII_FIELDS,
         ]);
     }
-    encryptOrderData(data) {
-        return encryptPiiFields(data, [...ORDER_PII_FIELDS]);
-    }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
         return this.decryptOrder(raw);
@@ -46,7 +55,7 @@ class OrderRepository extends BaseRepository {
             createdAt: new Date(),
             updatedAt: new Date(),
         };
-        const encrypted = this.encryptOrderData(orderData);
+        const encrypted = this.applyWriteHooks(orderData);
         await this.db
             .collection(this.collection)
             .doc(id)

package/dist/features/payments/repository/payout.repository.d.ts

@@ -20,17 +20,27 @@ export declare class PayoutRepository extends BaseRepository<PayoutDocument> {
     /** Decrypt PII fields on a payout document after Firestore read */
     private decryptPayout;
     /**
-     * Encrypt PII, then attach blind indices derived from the plaintext.
+     * Declared, not hand-rolled.
      *
-     * Previously this reassigned `encrypted = addPiiIndices(data, …)` — which
-     * re-reads the ORIGINAL plaintext and returns `{...data, ...indices}` — and
-     * then spread that over the ciphertext, so plaintext won and `sellerEmail`
-     * and `upiId` were written to Firestore in the clear beside a valid index.
-     * `piiIndicesFor` returns the index fields alone, so the ciphertext cannot be
-     * overwritten. The identical bug was fixed in UserRepository and never
-     * propagated here.
+     * `BaseRepository.applyWriteHooks` already does exactly what the private
+     * `encryptPayoutData` did — encrypt the listed fields, then add the mapped blind
+     * indices derived from the PLAINTEXT source. Declaring the fields means all
+     * nine mutating methods get it, including the `createWithId` / `*InTx` /
+     * `*InBatch` family that inherited unhooked base implementations while the
+     * encryption lived in a private method only three call sites remembered to
+     * call.
      */
-    private encryptPayoutData;
+    protected piiFields: readonly ["sellerEmail", "upiId"];
+    protected piiIndexMap: Record<string, string>;
+    /**
+     * The base hook, plus the nested objects it cannot see.
+     *
+     * `piiFields` is a flat list of top-level names, so a nested blob has to be
+     * encrypted separately. Calling `super.applyWriteHooks` FIRST keeps a single
+     * encryption path with one extra step on top, rather than two parallel paths
+     * that have to agree — which is what the hand-rolled override was.
+     */
+    protected applyWriteHooks<D extends object>(data: D): D;
     /** Override mapDoc to auto-decrypt PII on every Firestore read */
     protected mapDoc<D = PayoutDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
     /**

package/dist/features/payments/repository/payout.repository.js

@@ -7,10 +7,23 @@
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
 import { PAYOUT_COLLECTION, PAYOUT_FIELDS, PAYOUT_TRACKED_FIELDS, createPayoutId } from "../schemas";
 import { withHistory } from "../../../_internal/shared/history/index";
-import { encryptPiiFields, decryptPiiFields, piiIndicesFor, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "../../../security";
+import { decryptPiiFields, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "../../../security";
 export class PayoutRepository extends BaseRepository {
     constructor() {
         super(PAYOUT_COLLECTION);
+        /**
+         * Declared, not hand-rolled.
+         *
+         * `BaseRepository.applyWriteHooks` already does exactly what the private
+         * `encryptPayoutData` did — encrypt the listed fields, then add the mapped blind
+         * indices derived from the PLAINTEXT source. Declaring the fields means all
+         * nine mutating methods get it, including the `createWithId` / `*InTx` /
+         * `*InBatch` family that inherited unhooked base implementations while the
+         * encryption lived in a private method only three call sites remembered to
+         * call.
+         */
+        this.piiFields = PAYOUT_PII_FIELDS;
+        this.piiIndexMap = PAYOUT_PII_INDEX_MAP;
     }
     /** Decrypt PII fields on a payout document after Firestore read */
     decryptPayout(doc) {
@@ -21,26 +34,19 @@ export class PayoutRepository extends BaseRepository {
         return decrypted;
     }
     /**
-     * Encrypt PII, then attach blind indices derived from the plaintext.
+     * The base hook, plus the nested objects it cannot see.
      *
-     * Previously this reassigned `encrypted = addPiiIndices(data, …)` — which
-     * re-reads the ORIGINAL plaintext and returns `{...data, ...indices}` — and
-     * then spread that over the ciphertext, so plaintext won and `sellerEmail`
-     * and `upiId` were written to Firestore in the clear beside a valid index.
-     * `piiIndicesFor` returns the index fields alone, so the ciphertext cannot be
-     * overwritten. The identical bug was fixed in UserRepository and never
-     * propagated here.
+     * `piiFields` is a flat list of top-level names, so a nested blob has to be
+     * encrypted separately. Calling `super.applyWriteHooks` FIRST keeps a single
+     * encryption path with one extra step on top, rather than two parallel paths
+     * that have to agree — which is what the hand-rolled override was.
      */
-    encryptPayoutData(data) {
-        const encrypted = {
-            ...encryptPiiFields(data, [...PAYOUT_PII_FIELDS]),
-            ...piiIndicesFor(data, PAYOUT_PII_INDEX_MAP),
-        };
-        const access = encrypted;
-        if (access.bankAccount) {
+    applyWriteHooks(data) {
+        const out = super.applyWriteHooks(data);
+        const access = out;
+        if (access.bankAccount)
             access.bankAccount = encryptPayoutBankAccount(access.bankAccount);
-        }
-        return encrypted;
+        return out;
     }
     /** Override mapDoc to auto-decrypt PII on every Firestore read */
     mapDoc(snap) {
@@ -61,7 +67,7 @@ export class PayoutRepository extends BaseRepository {
             updatedAt: now,
         };
         // Encrypt PII before persisting
-        const encrypted = this.encryptPayoutData(data);
+        const encrypted = this.applyWriteHooks(data);
         await this.db
             .collection(this.collection)
             .doc(id)
@@ -70,7 +76,7 @@ export class PayoutRepository extends BaseRepository {
     }
     /** Override base update to preserve encryption/indexing for changed PII fields. */
     async update(payoutId, data) {
-        const encrypted = this.encryptPayoutData(data);
+        const encrypted = this.applyWriteHooks(data);
         return super.update(payoutId, encrypted);
     }
     /**

package/dist/features/products/components/ProductFilters.d.ts

@@ -1,3 +1,4 @@
+import type { ReactNode } from "react";
 import type { FacetOption } from "../../filters/FilterFacetSection";
 import type { UrlTable } from "../../filters/FilterPanel";
 import type { AsyncFacetSectionProps } from "../../filters/AsyncFacetSection";
@@ -115,6 +116,23 @@ export interface ProductFiltersProps {
     sublistingCategoryOptions?: FacetOption[];
     /** Feature badge options for filtering by product features */
     featureOptions?: FacetOption[];
+    /**
+     * Listing-type facet options — `{ value: <canonical ListingType>, label }`.
+     *
+     * Opt-in: only the combined browse pages (`/products`, `/art`) span more than
+     * one listing type, so every other caller leaves this empty and the section
+     * does not render. Derive the options from `PRODUCT_TYPE_FILTER_TABS` /
+     * `ART_STICKERS_TYPE_FILTER_TABS` — never a hand-written list, which is what
+     * `audit-listing-type-tab-coverage.mjs` exists to prevent (Root Cause #61).
+     */
+    listingTypeOptions?: FacetOption[];
+    /**
+     * Rendered directly beneath the listing-type section. The caller owns it so
+     * this shared component does not have to know about the listing-type plugin
+     * registry — `/products` uses it for the "Full <type> filters →" link to a
+     * single selected type's dedicated browse page.
+     */
+    listingTypeFooter?: ReactNode;
     showStatus?: boolean;
     variant?: ProductFilterVariant;
     statusOptions?: FacetOption[];
@@ -124,4 +142,4 @@ export interface ProductFiltersProps {
     /** Show "part of a bundle" switch filter (default true) */
     showBundleFilter?: boolean;
 }
-export declare function ProductFilters({ table, categoryOptions, brandOptions, storeOptions, sellerOptions, tagOptions, sublistingCategoryOptions, featureOptions, showStatus, variant, statusOptions, currencyPrefix, showShipping, showBundleFilter, loadCategoryOptions, loadBrandOptions, loadStoreOptions, }: ProductFiltersProps): import("react").JSX.Element;
+export declare function ProductFilters({ table, categoryOptions, brandOptions, storeOptions, sellerOptions, tagOptions, sublistingCategoryOptions, featureOptions, listingTypeOptions, listingTypeFooter, showStatus, variant, statusOptions, currencyPrefix, showShipping, showBundleFilter, loadCategoryOptions, loadBrandOptions, loadStoreOptions, }: ProductFiltersProps): import("react").JSX.Element;

package/dist/features/products/components/ProductFilters.js

@@ -1,5 +1,5 @@
 "use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { useTranslations } from "next-intl";
 import { FilterFacetSection } from "../../filters/FilterFacetSection";
 import { AsyncFacetSection } from "../../filters/AsyncFacetSection";
@@ -66,7 +66,7 @@ export function getProductSortOptions(variant) {
             return PRODUCT_PUBLIC_SORT_OPTIONS;
     }
 }
-export function ProductFilters({ table, categoryOptions = [], brandOptions = [], storeOptions = [], sellerOptions, tagOptions = [], sublistingCategoryOptions = [], featureOptions = [], showStatus = false, variant, statusOptions, currencyPrefix = "", showShipping = true, showBundleFilter = true, loadCategoryOptions, loadBrandOptions, loadStoreOptions, }) {
+export function ProductFilters({ table, categoryOptions = [], brandOptions = [], storeOptions = [], sellerOptions, tagOptions = [], sublistingCategoryOptions = [], featureOptions = [], listingTypeOptions = [], listingTypeFooter, showStatus = false, variant, statusOptions, currencyPrefix = "", showShipping = true, showBundleFilter = true, loadCategoryOptions, loadBrandOptions, loadStoreOptions, }) {
     const resolvedStoreOptions = storeOptions.length > 0 ? storeOptions : (sellerOptions ?? []);
     const t = useTranslations("filters");
     const conditionOptions = [
@@ -99,5 +99,13 @@ export function ProductFilters({ table, categoryOptions = [], brandOptions = [],
     const selectedStatuses = splitPipe(TABLE_KEYS.STATUS);
     const selectedSublistings = splitPipe(TABLE_KEYS.SUBLISTING_CATEGORY);
     const selectedFeatures = splitPipe(TABLE_KEYS.FEATURES);
-    return (_jsxs(Div, { children: [loadCategoryOptions ? (_jsx(AsyncFacetSection, { title: t("category"), loadOptions: loadCategoryOptions, selected: selectedCategories, onChange: (vals) => table.set(TABLE_KEYS.CATEGORY, vals.join("|")), defaultCollapsed: false })) : categoryOptions.length > 0 ? (_jsx(FilterFacetSection, { title: t("category"), options: categoryOptions, selected: selectedCategories, onChange: (vals) => table.set(TABLE_KEYS.CATEGORY, vals.join("|")), searchable: true, defaultCollapsed: categoryOptions.length > 6 })) : null, _jsx(FilterFacetSection, { title: t("condition"), options: conditionOptions, selected: selectedConditions, onChange: (vals) => table.set(TABLE_KEYS.CONDITION, vals.join("|")), searchable: false, defaultCollapsed: false }), _jsx(RangeFilter, { title: t("priceRange"), minValue: table.get(TABLE_KEYS.MIN_PRICE), maxValue: table.get(TABLE_KEYS.MAX_PRICE), onMinChange: (v) => table.set(TABLE_KEYS.MIN_PRICE, v), onMaxChange: (v) => table.set(TABLE_KEYS.MAX_PRICE, v), prefix: currencyPrefix, showSlider: true, minBound: 0, maxBound: 500000, step: 500, minPlaceholder: t("minPrice"), maxPlaceholder: t("maxPrice"), defaultCollapsed: false }), loadBrandOptions ? (_jsx(AsyncFacetSection, { title: t("brand"), loadOptions: loadBrandOptions, selected: selectedBrands, onChange: (vals) => table.set(TABLE_KEYS.BRAND, vals.join("|")), defaultCollapsed: false })) : brandOptions.length > 0 ? (_jsx(FilterFacetSection, { title: t("brand"), options: brandOptions, selected: selectedBrands, onChange: (vals) => table.set(TABLE_KEYS.BRAND, vals.join("|")), searchable: brandOptions.length > 4, defaultCollapsed: brandOptions.length > 6 })) : null, loadStoreOptions ? (_jsx(AsyncFacetSection, { title: t("store"), loadOptions: loadStoreOptions, selected: selectedSellers, onChange: (vals) => table.set(TABLE_KEYS.STORE_ID, vals.join("|")), defaultCollapsed: false })) : resolvedStoreOptions.length > 0 ? (_jsx(FilterFacetSection, { title: t("store"), options: resolvedStoreOptions, selected: selectedSellers, onChange: (vals) => table.set(TABLE_KEYS.STORE_ID, vals.join("|")), searchable: resolvedStoreOptions.length > 4, defaultCollapsed: resolvedStoreOptions.length > 6 })) : null, showShipping && (_jsx(SwitchFilter, { title: t("shipping"), label: t("freeShippingOnly"), checked: table.get(TABLE_KEYS.FREE_SHIPPING) === "true", onChange: (v) => table.set(TABLE_KEYS.FREE_SHIPPING, v ? "true" : ""), defaultCollapsed: false })), tagOptions.length > 0 && (_jsx(FilterFacetSection, { title: t("tags"), options: tagOptions, selected: selectedTags, onChange: (vals) => table.set(TABLE_KEYS.TAGS, vals.join("|")), searchable: tagOptions.length > 4, defaultCollapsed: tagOptions.length > 6 })), shouldShowStatus && (_jsx(FilterFacetSection, { title: t("status"), options: statusOptions ?? defaultStatusOptions, selected: selectedStatuses, onChange: (vals) => table.set(TABLE_KEYS.STATUS, vals.join("|")), searchable: false, defaultCollapsed: false })), sublistingCategoryOptions.length > 0 && (_jsx(FilterFacetSection, { title: "Sublisting Type", options: sublistingCategoryOptions, selected: selectedSublistings, onChange: (vals) => table.set(TABLE_KEYS.SUBLISTING_CATEGORY, vals.join("|")), searchable: sublistingCategoryOptions.length > 4, defaultCollapsed: false })), showBundleFilter && (_jsx(SwitchFilter, { title: "Bundles", label: "Part of a bundle only", checked: table.get(TABLE_KEYS.IS_PART_OF_BUNDLE) === "true", onChange: (v) => table.set(TABLE_KEYS.IS_PART_OF_BUNDLE, v ? "true" : ""), defaultCollapsed: false })), featureOptions.length > 0 && (_jsx(FilterFacetSection, { title: "Features", options: featureOptions, selected: selectedFeatures, onChange: (vals) => table.set(TABLE_KEYS.FEATURES, vals.join("|")), searchable: featureOptions.length > 4, defaultCollapsed: featureOptions.length > 4 }))] }));
+    const selectedListingTypes = splitPipe(TABLE_KEYS.LISTING_TYPE);
+    return (_jsxs(Div, { children: [listingTypeOptions.length > 0 && (_jsxs(_Fragment, { children: [_jsx(FilterFacetSection, { title: "Listing type", options: listingTypeOptions, selected: selectedListingTypes, onChange: (vals) => 
+                        // Serialise in the OPTIONS' order, not the order the boxes were
+                        // ticked — `auction|art` and `art|auction` are the same result
+                        // set but two different React Query keys and two different URLs.
+                        table.set(TABLE_KEYS.LISTING_TYPE, listingTypeOptions
+                            .filter((o) => vals.includes(o.value))
+                            .map((o) => o.value)
+                            .join("|")), searchable: false, defaultCollapsed: false }), listingTypeFooter] })), loadCategoryOptions ? (_jsx(AsyncFacetSection, { title: t("category"), loadOptions: loadCategoryOptions, selected: selectedCategories, onChange: (vals) => table.set(TABLE_KEYS.CATEGORY, vals.join("|")), defaultCollapsed: false })) : categoryOptions.length > 0 ? (_jsx(FilterFacetSection, { title: t("category"), options: categoryOptions, selected: selectedCategories, onChange: (vals) => table.set(TABLE_KEYS.CATEGORY, vals.join("|")), searchable: true, defaultCollapsed: categoryOptions.length > 6 })) : null, _jsx(FilterFacetSection, { title: t("condition"), options: conditionOptions, selected: selectedConditions, onChange: (vals) => table.set(TABLE_KEYS.CONDITION, vals.join("|")), searchable: false, defaultCollapsed: false }), _jsx(RangeFilter, { title: t("priceRange"), minValue: table.get(TABLE_KEYS.MIN_PRICE), maxValue: table.get(TABLE_KEYS.MAX_PRICE), onMinChange: (v) => table.set(TABLE_KEYS.MIN_PRICE, v), onMaxChange: (v) => table.set(TABLE_KEYS.MAX_PRICE, v), prefix: currencyPrefix, showSlider: true, minBound: 0, maxBound: 500000, step: 500, minPlaceholder: t("minPrice"), maxPlaceholder: t("maxPrice"), defaultCollapsed: false }), loadBrandOptions ? (_jsx(AsyncFacetSection, { title: t("brand"), loadOptions: loadBrandOptions, selected: selectedBrands, onChange: (vals) => table.set(TABLE_KEYS.BRAND, vals.join("|")), defaultCollapsed: false })) : brandOptions.length > 0 ? (_jsx(FilterFacetSection, { title: t("brand"), options: brandOptions, selected: selectedBrands, onChange: (vals) => table.set(TABLE_KEYS.BRAND, vals.join("|")), searchable: brandOptions.length > 4, defaultCollapsed: brandOptions.length > 6 })) : null, loadStoreOptions ? (_jsx(AsyncFacetSection, { title: t("store"), loadOptions: loadStoreOptions, selected: selectedSellers, onChange: (vals) => table.set(TABLE_KEYS.STORE_ID, vals.join("|")), defaultCollapsed: false })) : resolvedStoreOptions.length > 0 ? (_jsx(FilterFacetSection, { title: t("store"), options: resolvedStoreOptions, selected: selectedSellers, onChange: (vals) => table.set(TABLE_KEYS.STORE_ID, vals.join("|")), searchable: resolvedStoreOptions.length > 4, defaultCollapsed: resolvedStoreOptions.length > 6 })) : null, showShipping && (_jsx(SwitchFilter, { title: t("shipping"), label: t("freeShippingOnly"), checked: table.get(TABLE_KEYS.FREE_SHIPPING) === "true", onChange: (v) => table.set(TABLE_KEYS.FREE_SHIPPING, v ? "true" : ""), defaultCollapsed: false })), tagOptions.length > 0 && (_jsx(FilterFacetSection, { title: t("tags"), options: tagOptions, selected: selectedTags, onChange: (vals) => table.set(TABLE_KEYS.TAGS, vals.join("|")), searchable: tagOptions.length > 4, defaultCollapsed: tagOptions.length > 6 })), shouldShowStatus && (_jsx(FilterFacetSection, { title: t("status"), options: statusOptions ?? defaultStatusOptions, selected: selectedStatuses, onChange: (vals) => table.set(TABLE_KEYS.STATUS, vals.join("|")), searchable: false, defaultCollapsed: false })), sublistingCategoryOptions.length > 0 && (_jsx(FilterFacetSection, { title: "Sublisting Type", options: sublistingCategoryOptions, selected: selectedSublistings, onChange: (vals) => table.set(TABLE_KEYS.SUBLISTING_CATEGORY, vals.join("|")), searchable: sublistingCategoryOptions.length > 4, defaultCollapsed: false })), showBundleFilter && (_jsx(SwitchFilter, { title: "Bundles", label: "Part of a bundle only", checked: table.get(TABLE_KEYS.IS_PART_OF_BUNDLE) === "true", onChange: (v) => table.set(TABLE_KEYS.IS_PART_OF_BUNDLE, v ? "true" : ""), defaultCollapsed: false })), featureOptions.length > 0 && (_jsx(FilterFacetSection, { title: "Features", options: featureOptions, selected: selectedFeatures, onChange: (vals) => table.set(TABLE_KEYS.FEATURES, vals.join("|")), searchable: featureOptions.length > 4, defaultCollapsed: featureOptions.length > 4 }))] }));
 }

package/dist/features/products/components/ProductsIndexListing.d.ts

@@ -6,8 +6,10 @@ export interface ProductsIndexListingProps {
      * (e.g. `["art", "stickers"]`) to reuse this component for a different
      * combined browse page. */
     listingTypes?: readonly string[];
-    /** Type-filter chip tabs shown above the grid. Defaults to the generic
-     * Products tabs; pass a matching set when overriding `listingTypes`. */
+    /** Options for the "Listing type" checkbox facet in the filter drawer. `id`
+     * must be the canonical `ListingType` — it is passed straight into
+     * `sieveFilter("listingType", EQ, id)`. Defaults to the generic Products set;
+     * pass a matching set when overriding `listingTypes`. */
     typeTabs?: readonly {
         id: string;
         label: string;