@mohasinac/appkit 4.52.4 → 4.53.0

package/dist/features/orders/schemas/index.d.ts

@@ -59,10 +59,10 @@ export declare const emiInstallmentSchema: z.ZodObject<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
     transactionId?: string | undefined;
+    proofUrl?: string | undefined;
     paidAt?: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
-    proofUrl?: string | undefined;
     reminderSentAt?: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -74,10 +74,10 @@ export declare const emiInstallmentSchema: z.ZodObject<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
     transactionId?: string | undefined;
+    proofUrl?: string | undefined;
     paidAt?: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
-    proofUrl?: string | undefined;
     reminderSentAt?: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -380,10 +380,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -395,10 +395,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -640,10 +640,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -788,10 +788,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -1041,15 +1041,15 @@ export declare const orderListParamsSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     sort?: string | undefined;
     page?: number | undefined;
-    perPage?: number | undefined;
     userId?: string | undefined;
     paymentStatus?: string | undefined;
+    perPage?: number | undefined;
     orderStatus?: "pending" | "delivered" | "confirmed" | "shipped" | "processing" | "return_requested" | "cancelled" | "refunded" | "returned" | undefined;
 }, {
     sort?: string | undefined;
     page?: number | undefined;
-    perPage?: number | undefined;
     userId?: string | undefined;
     paymentStatus?: string | undefined;
+    perPage?: number | undefined;
     orderStatus?: "pending" | "delivered" | "confirmed" | "shipped" | "processing" | "return_requested" | "cancelled" | "refunded" | "returned" | undefined;
 }>;

package/dist/features/orders/types/index.d.ts

@@ -312,7 +312,7 @@ export interface OrderListResponse {
     items: Order[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
 }
 export interface OrderListParams {
@@ -321,5 +321,5 @@ export interface OrderListParams {
     paymentStatus?: PaymentStatus;
     sort?: string;
     page?: number;
-    perPage?: number;
+    pageSize?: number;
 }

package/dist/features/payments/repository/payments.repository.js

@@ -13,7 +13,7 @@ export class PaymentsRepository {
         const result = await this.paymentsRepo.findAll({
             filters: `orderId==${orderId}`,
             sort: "-createdAt",
-            perPage: 20,
+            pageSize: 20,
         });
         return result.data;
     }
@@ -27,7 +27,7 @@ export class PaymentsRepository {
         return this.paymentsRepo.delete(id);
     }
     async getSettings() {
-        const result = await this.settingsRepo.findAll({ perPage: 1 });
+        const result = await this.settingsRepo.findAll({ pageSize: 1 });
         return result.data[0] ?? null;
     }
     async updateSettings(id, data) {

package/dist/features/payments/repository/payout.repository.d.ts

@@ -6,7 +6,7 @@
  */
 import { BaseRepository, parseSieveDateValue, type SieveModel, type FirebaseSieveResult } from "../../../providers/db-firebase";
 import type { DocumentReference } from "firebase-admin/firestore";
-import type { PayoutDocument, PayoutCreateInput, PayoutRefundDeduction, PayoutStatus, PayoutUpdateInput } from "../schemas";
+import type { PayoutDocument, PayoutPlain, PayoutCreateInput, PayoutRefundDeduction, PayoutStatus, PayoutUpdateInput } from "../schemas";
 import { type HistoryActor } from "../../../_internal/shared/history/index";
 /** Who/why for a payout write that lands in `statusHistory`. */
 export interface PayoutWriteContext {
@@ -18,7 +18,26 @@ export interface PayoutWriteContext {
 export declare class PayoutRepository extends BaseRepository<PayoutDocument> {
     constructor();
     /** Decrypt PII fields on a payout document after Firestore read */
-    private decryptPayout;
+    /**
+     * Plaintext PII. **Opt-in and named** — for the payout run that has to
+     * actually pay someone, and for the remittance email.
+     */
+    revealPayout(doc: PayoutDocument): PayoutPlain;
+    /** As `revealPayout`, for a list read. */
+    revealPayouts(docs: readonly PayoutDocument[]): PayoutPlain[];
+    /**
+     * Masked PII — **the default for the admin and seller payout lists**, which
+     * need to identify a payee rather than pay them.
+     *
+     * `bankAccount.accountHolderName` is masked too — it is a person's name, and
+     * a payout list only needs to identify the payee. The other three members
+     * (`accountNumberMasked`, `ifscCode`, `bankName`) are already non-revealing,
+     * so they pass through: masking a bank name would make the row useless
+     * without protecting anything.
+     */
+    maskedPayout(doc: PayoutDocument): PayoutPlain;
+    /** As `maskedPayout`, for a list read. */
+    maskedPayouts(docs: readonly PayoutDocument[]): PayoutPlain[];
     /**
      * Declared, not hand-rolled.
      *
@@ -40,15 +59,13 @@ export declare class PayoutRepository extends BaseRepository<PayoutDocument> {
      * encryption path with one extra step on top, rather than two parallel paths
      * that have to agree — which is what the hand-rolled override was.
      */
-    protected applyWriteHooks<D extends object>(data: D): D;
     /** Override mapDoc to auto-decrypt PII on every Firestore read */
-    protected mapDoc<D = PayoutDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
     /**
      * Create a new payout request
      */
-    create(input: PayoutCreateInput): Promise<PayoutDocument>;
+    createPayout(input: PayoutCreateInput): Promise<PayoutPlain>;
     /** Override base update to preserve encryption/indexing for changed PII fields. */
-    update(payoutId: string, data: Partial<PayoutDocument>): Promise<PayoutDocument>;
+    update(payoutId: string, data: Partial<PayoutPlain>): Promise<PayoutDocument>;
     /**
      * Find all payouts for a specific seller, newest first
      */

package/dist/features/payments/repository/payout.repository.js

@@ -7,7 +7,7 @@
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase/index.js";
 import { PAYOUT_COLLECTION, PAYOUT_FIELDS, PAYOUT_TRACKED_FIELDS, createPayoutId } from "../schemas/index.js";
 import { withHistory } from "../../../_internal/shared/history/index.js";
-import { decryptPiiFields, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "../../../security/index.js";
+import { maskPii, revealPii, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, } from "../../../security/index.js";
 export class PayoutRepository extends BaseRepository {
     constructor() {
         super(PAYOUT_COLLECTION);
@@ -26,12 +26,48 @@ export class PayoutRepository extends BaseRepository {
         this.piiIndexMap = PAYOUT_PII_INDEX_MAP;
     }
     /** Decrypt PII fields on a payout document after Firestore read */
-    decryptPayout(doc) {
-        const decrypted = decryptPiiFields(doc, [...PAYOUT_PII_FIELDS]);
-        if (decrypted.bankAccount) {
-            decrypted.bankAccount = decryptPayoutBankAccount(decrypted.bankAccount);
+    /*
+     * 🛑 `mapDoc` no longer decrypts — reads return what Firestore holds.
+     *
+     * `bankAccount` is handled here rather than by `revealPii`, because it is
+     * encrypted by its OWN scheme (`decryptPayoutBankAccount`) and not by the
+     * `PAYOUT_PII_FIELDS` path list. A named accessor that silently skipped it
+     * would hand a caller an account number it could not read, which is worse
+     * than refusing: the value looks present.
+     */
+    /**
+     * Plaintext PII. **Opt-in and named** — for the payout run that has to
+     * actually pay someone, and for the remittance email.
+     */
+    revealPayout(doc) {
+        // `bankAccount` needs no unwrap: its four members are masked or public
+        // bank identifiers, never encrypted. See the tombstone in pii-encrypt.ts.
+        return revealPii(doc, PAYOUT_PII_FIELDS);
+    }
+    /** As `revealPayout`, for a list read. */
+    revealPayouts(docs) {
+        return docs.map((d) => this.revealPayout(d));
+    }
+    /**
+     * Masked PII — **the default for the admin and seller payout lists**, which
+     * need to identify a payee rather than pay them.
+     *
+     * `bankAccount.accountHolderName` is masked too — it is a person's name, and
+     * a payout list only needs to identify the payee. The other three members
+     * (`accountNumberMasked`, `ifscCode`, `bankName`) are already non-revealing,
+     * so they pass through: masking a bank name would make the row useless
+     * without protecting anything.
+     */
+    maskedPayout(doc) {
+        const masked = maskPii(doc, PAYOUT_PII_FIELDS);
+        if (masked.bankAccount) {
+            masked.bankAccount = maskPii(masked.bankAccount, ["accountHolderName"]);
         }
-        return decrypted;
+        return masked;
+    }
+    /** As `maskedPayout`, for a list read. */
+    maskedPayouts(docs) {
+        return docs.map((d) => this.maskedPayout(d));
     }
     /**
      * The base hook, plus the nested objects it cannot see.
@@ -41,24 +77,28 @@ export class PayoutRepository extends BaseRepository {
      * encryption path with one extra step on top, rather than two parallel paths
      * that have to agree — which is what the hand-rolled override was.
      */
-    applyWriteHooks(data) {
-        const out = super.applyWriteHooks(data);
-        const access = out;
-        if (access.bankAccount)
-            access.bankAccount = encryptPayoutBankAccount(access.bankAccount);
-        return out;
-    }
+    /*
+     * No `bankAccount` hook any more. It called `encryptPayoutBankAccount`,
+     * which was `encryptPiiFields(bank, [])` — a no-op — and
+     * `PayoutBankAccount` carries no secret field to encrypt. See the tombstone
+     * in `security/pii-encrypt.ts`.
+     */
     /** Override mapDoc to auto-decrypt PII on every Firestore read */
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return this.decryptPayout(raw);
-    }
     /**
      * Create a new payout request
      */
-    async create(input) {
+    /*
+     * 🛑 NOT an `override`. It returns the plaintext it was handed (no
+     * read-after-write, which would cost a Firestore read per payout), and
+     * `PayoutPlain` is not assignable to the base's `Promise<T>` — correctly,
+     * because the two genuinely differ. The declaration used to say
+     * `PayoutDocument` directly above a line commented "return plaintext to
+     * caller".
+     */
+    async createPayout(input) {
         const now = new Date();
         const id = createPayoutId({ sellerName: input.sellerName, date: now });
+        // Plain in, ciphertext out — the write hook encrypts below.
         const data = {
             ...input,
             status: "pending",
@@ -72,7 +112,7 @@ export class PayoutRepository extends BaseRepository {
             .collection(this.collection)
             .doc(id)
             .set(prepareForFirestore(encrypted));
-        return { id, ...data }; // return plaintext to caller
+        return { id, ...data };
     }
     /** Override base update to preserve encryption/indexing for changed PII fields. */
     async update(payoutId, data) {
@@ -88,7 +128,7 @@ export class PayoutRepository extends BaseRepository {
             .where(PAYOUT_FIELDS.STORE_ID, "==", storeId)
             .orderBy(PAYOUT_FIELDS.CREATED_AT, "desc")
             .get();
-        return snapshot.docs.map((doc) => this.decryptPayout({
+        return snapshot.docs.map((doc) => ({
             id: doc.id,
             ...doc.data(),
         }));
@@ -103,7 +143,7 @@ export class PayoutRepository extends BaseRepository {
             .where(PAYOUT_FIELDS.STATUS, "==", status)
             .orderBy(PAYOUT_FIELDS.CREATED_AT, "desc")
             .get();
-        return snapshot.docs.map((doc) => this.decryptPayout({
+        return snapshot.docs.map((doc) => ({
             id: doc.id,
             ...doc.data(),
         }));
@@ -197,7 +237,7 @@ export class PayoutRepository extends BaseRepository {
             .get();
         if (snapshot.empty)
             return null;
-        return this.decryptPayout({ id: snapshot.docs[0].id, ...snapshot.docs[0].data() });
+        return { id: snapshot.docs[0].id, ...snapshot.docs[0].data() };
     }
     /**
      * Atomically append a refund deduction and recalculate netAmount.
@@ -227,7 +267,7 @@ export class PayoutRepository extends BaseRepository {
             });
             return { ...doc, refundDeductions: newDeductions, netAmount, updatedAt: new Date() };
         });
-        return this.decryptPayout(updated);
+        return (updated);
     }
     /**
      * Paginated, Firestore-native payout list (admin use).

package/dist/features/payments/repository/saved-payment-methods.repository.d.ts

@@ -8,15 +8,26 @@
  * to clients. `identifierHash` is unencrypted SHA-256 for cross-account
  * dedup queries. `displayLabel` is pre-masked and safe to display.
  */
-import { BaseRepository, type DocumentSnapshot } from "../../../providers/db-firebase";
-import { type SavedPaymentMethodBanStatus, type SavedPaymentMethodCreateInput, type SavedPaymentMethodDocument } from "../schemas/saved-methods-firestore";
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type SavedPaymentMethodBanStatus, type SavedPaymentMethodCreateInput, type SavedPaymentMethodDocument, type SavedPaymentMethodPlain } from "../schemas/saved-methods-firestore";
 export declare class SavedPaymentMethodsRepository extends BaseRepository<SavedPaymentMethodDocument> {
     constructor();
-    private decrypt;
     private encrypt;
-    protected mapDoc<D = SavedPaymentMethodDocument>(snap: DocumentSnapshot): D;
-    createWithId(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
-    update(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealMethod(doc: SavedPaymentMethodDocument): SavedPaymentMethodPlain;
+    /** As `revealMethod`, for a list read. */
+    revealMethods(docs: readonly SavedPaymentMethodDocument[]): SavedPaymentMethodPlain[];
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedMethod(doc: SavedPaymentMethodDocument): SavedPaymentMethodPlain;
+    /** As `maskedMethod`, for a list read. */
+    maskedMethods(docs: readonly SavedPaymentMethodDocument[]): SavedPaymentMethodPlain[];
+    createWithId(id: string, data: Partial<SavedPaymentMethodPlain>): Promise<SavedPaymentMethodDocument>;
+    update(id: string, data: Partial<SavedPaymentMethodPlain>): Promise<SavedPaymentMethodDocument>;
     /** List all saved methods for a user. Never returns raw `identifier` — only `displayLabel`. */
     listByUser(userId: string): Promise<SavedPaymentMethodDocument[]>;
     /**

package/dist/features/payments/repository/saved-payment-methods.repository.js

@@ -13,7 +13,8 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { serverLogger } from "../../../monitoring/index.js";
 import { BaseRepository, prepareForFirestore, } from "../../../providers/db-firebase/index.js";
-import { PAYMENT_METHOD_PII_FIELDS, decryptPiiFields, encryptPiiFields, } from "../../../security/index.js";
+import { PAYMENT_METHOD_PII_FIELDS, encryptPiiFields, maskPii, revealPii, } from "../../../security/index.js";
+import { asEncrypted } from "../../../security/encrypted.js";
 import { SAVED_PAYMENT_METHOD_FIELDS, SAVED_PAYMENT_METHODS_COLLECTION, } from "../schemas/saved-methods-firestore.js";
 function normaliseIdentifier(s) {
     return s.toLowerCase().replace(/\s+/g, "").trim();
@@ -27,19 +28,53 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
     constructor() {
         super(SAVED_PAYMENT_METHODS_COLLECTION);
     }
-    decrypt(doc) {
-        return decryptPiiFields(doc, [...PAYMENT_METHOD_PII_FIELDS]);
-    }
     encrypt(data) {
         return encryptPiiFields(data, [...PAYMENT_METHOD_PII_FIELDS]);
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return this.decrypt(raw);
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `SavedPaymentMethodDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealMethod(doc) {
+        return revealPii(doc, PAYMENT_METHOD_PII_FIELDS);
+    }
+    /** As `revealMethod`, for a list read. */
+    revealMethods(docs) {
+        return docs.map((d) => this.revealMethod(d));
     }
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedMethod(doc) {
+        return maskPii(doc, PAYMENT_METHOD_PII_FIELDS);
+    }
+    /** As `maskedMethod`, for a list read. */
+    maskedMethods(docs) {
+        return docs.map((d) => this.maskedMethod(d));
+    }
+    /*
+     * Takes PLAINTEXT, like the base it overrides — this method is what
+     * encrypts, so demanding ciphertext from callers inverted its own contract.
+     */
     async createWithId(id, data) {
         return super.createWithId(id, this.encrypt(data));
     }
+    /*
+     * Takes PLAINTEXT, like the base it overrides — this method is what
+     * encrypts, so demanding ciphertext from callers inverted its own contract.
+     */
     async update(id, data) {
         return super.update(id, this.encrypt(data));
     }
@@ -52,7 +87,18 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => {
                 const doc = this.mapDoc(d);
-                doc.identifier = ""; // never expose decrypted PII to caller
+                /*
+                 * Dropped, not decrypted-then-dropped.
+                 *
+                 * This read "never expose decrypted PII to caller" — true, because
+                 * `mapDoc` decrypted every identifier and this threw it away
+                 * immediately. The decryption was pure waste plus a window in which
+                 * plaintext existed. `mapDoc` no longer decrypts, so what arrives here
+                 * is ciphertext; the field is still blanked because these list reads
+                 * are display-only, and ciphertext a caller cannot use is ciphertext
+                 * it should not receive.
+                 */
+                doc.identifier = asEncrypted("");
                 return doc;
             });
         }
@@ -81,6 +127,8 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 return this.update(docId, { lastUsedAt: now, displayLabel: input.displayLabel });
             }
             const docRef = this.getCollection().doc();
+            // PLAINTEXT in, ciphertext out: `this.encrypt(data)` below is what makes
+            // the document type true, so the payload is typed as the plain shape.
             const data = {
                 userId,
                 type: input.type,
@@ -97,7 +145,7 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
             const refetched = await this.findById(docRef.id);
             if (!refetched)
                 throw new DatabaseError("Payment method not readable after create");
-            refetched.identifier = "";
+            refetched.identifier = asEncrypted(""); // display-only — see listByUser
             return refetched;
         }
         catch (error) {
@@ -113,7 +161,7 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => {
                 const doc = this.mapDoc(d);
-                doc.identifier = "";
+                doc.identifier = asEncrypted(""); // display-only — see listByUser
                 return doc;
             });
         }
@@ -190,7 +238,7 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => {
                 const doc = this.mapDoc(d);
-                doc.identifier = "";
+                doc.identifier = asEncrypted(""); // display-only — see listByUser
                 return doc;
             });
         }

package/dist/features/payments/schemas/firestore.d.ts

@@ -4,6 +4,7 @@
 import { type GeneratePayoutIdInput } from "../../../utils/id-generators";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export interface PayoutBankAccount {
     accountHolderName: string;
     accountNumberMasked: string;
@@ -34,10 +35,20 @@ export declare const PayoutStatusValues: {
     readonly FAILED: "failed";
 };
 export type PayoutPaymentMethod = "bank_transfer" | "upi";
+/**
+ * `PayoutDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type PayoutPlain = Plaintext<PayoutDocument>;
 export interface PayoutDocument extends BaseDocument {
     storeId: string;
     sellerName: string;
-    sellerEmail: string;
+    sellerEmail: Encrypted<string>;
     amount: number;
     grossAmount: number;
     platformFee: number;
@@ -46,7 +57,7 @@ export interface PayoutDocument extends BaseDocument {
     status: PayoutStatus;
     paymentMethod: PayoutPaymentMethod;
     bankAccount?: PayoutBankAccount;
-    upiId?: string;
+    upiId?: Encrypted<string>;
     notes?: string;
     adminNote?: string;
     orderIds: string[];
@@ -119,7 +130,7 @@ export declare const PAYOUT_PUBLIC_FIELDS: readonly ["id", "storeId", "amount",
 export declare const PAYOUT_ADMIN_UPDATEABLE_FIELDS: readonly ["status", "adminNote", "processedAt", "transactionId"];
 /** The only field a seller may write on their own payout doc. */
 export declare const PAYOUT_SELLER_UPDATEABLE_FIELDS: readonly ["sellerReminderFlag"];
-export type PayoutCreateInput = Omit<PayoutDocument, "id" | "createdAt" | "updatedAt" | "status" | "requestedAt">;
+export type PayoutCreateInput = Omit<PayoutPlain, "id" | "createdAt" | "updatedAt" | "status" | "requestedAt">;
 export type PayoutUpdateInput = Partial<Pick<PayoutDocument, (typeof PAYOUT_ADMIN_UPDATEABLE_FIELDS)[number]>>;
 export declare const payoutQueryHelpers: {
     readonly byStore: (storeId: string) => readonly ["storeId", "==", string];

package/dist/features/payments/schemas/saved-methods-firestore.d.ts

@@ -10,13 +10,24 @@
  * `displayLabel` is a pre-masked string and never contains full PII.
  */
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export type SavedPaymentMethodType = "upi" | "card" | "bank_account" | "wallet";
 export type SavedPaymentMethodBanStatus = "banned" | "suspicious" | "unban_requested";
+/**
+ * `SavedPaymentMethodDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type SavedPaymentMethodPlain = Plaintext<SavedPaymentMethodDocument>;
 export interface SavedPaymentMethodDocument extends BaseDocument {
     userId: string;
     type: SavedPaymentMethodType;
     /** Full UPI VPA / card PAN / account number — ENCRYPTED at rest. */
-    identifier: string;
+    identifier: Encrypted<string>;
     /** Pre-masked display string, never contains full PII. e.g. "9876...@paytm", "XXXX 4321 (HDFC)" */
     displayLabel: string;
     /** SHA-256(type|normalised(identifier)) — unencrypted; enables cross-account dedup without decrypting. */

package/dist/features/pre-orders/api/[slug]/route.js

@@ -23,7 +23,7 @@ export async function GET(request, { params }) {
         const repo = db.getRepository("preorders");
         const result = await repo.findAll({
             filters: `slug==${slug}`,
-            perPage: 1,
+            pageSize: 1,
         });
         if (!result.data[0]) {
             return NextResponse.json({ success: false, error: "Pre-order not found" }, { status: 404 });

package/dist/features/pre-orders/api/admin/route.js

@@ -33,7 +33,7 @@ export async function GET(request) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/pre-orders/api/route.js

@@ -32,7 +32,7 @@ export async function GET(request) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/pre-orders/repository/pre-orders.repository.d.ts

@@ -5,9 +5,9 @@ export declare class PreOrdersRepository {
     constructor(repo: IRepository<PreOrderItem>);
     findAll(query?: SieveQuery): Promise<PagedResult<PreOrderItem>>;
     findById(id: string): Promise<PreOrderItem | null>;
-    findByCustomer(customerId: string, page?: number, perPage?: number): Promise<PagedResult<PreOrderItem>>;
-    findBySeller(sellerId: string, page?: number, perPage?: number): Promise<PagedResult<PreOrderItem>>;
-    findByStatus(status: PreOrderStatus, page?: number, perPage?: number): Promise<PagedResult<PreOrderItem>>;
+    findByCustomer(customerId: string, page?: number, pageSize?: number): Promise<PagedResult<PreOrderItem>>;
+    findBySeller(sellerId: string, page?: number, pageSize?: number): Promise<PagedResult<PreOrderItem>>;
+    findByStatus(status: PreOrderStatus, page?: number, pageSize?: number): Promise<PagedResult<PreOrderItem>>;
     create(data: Omit<PreOrderItem, "id" | "createdAt" | "updatedAt">): Promise<PreOrderItem>;
     updateStatus(id: string, status: PreOrderStatus, adminNote?: string): Promise<PreOrderItem>;
     delete(id: string): Promise<void>;

package/dist/features/pre-orders/repository/pre-orders.repository.js

@@ -8,28 +8,28 @@ export class PreOrdersRepository {
     async findById(id) {
         return this.repo.findById(id);
     }
-    async findByCustomer(customerId, page = 1, perPage = 20) {
+    async findByCustomer(customerId, page = 1, pageSize = 20) {
         return this.repo.findAll({
             filters: `customerId==${customerId}`,
             sort: "-createdAt",
             page,
-            perPage,
+            pageSize,
         });
     }
-    async findBySeller(sellerId, page = 1, perPage = 20) {
+    async findBySeller(sellerId, page = 1, pageSize = 20) {
         return this.repo.findAll({
             filters: `sellerId==${sellerId}`,
             sort: "-createdAt",
             page,
-            perPage,
+            pageSize,
         });
     }
-    async findByStatus(status, page = 1, perPage = 50) {
+    async findByStatus(status, page = 1, pageSize = 50) {
         return this.repo.findAll({
             filters: `status==${status}`,
             sort: "-createdAt",
             page,
-            perPage,
+            pageSize,
         });
     }
     async create(data) {

package/dist/features/products/api/[id]/route.js

@@ -75,7 +75,7 @@ export async function GET(_request, context) {
             // Slug fallback: search by slug==id, status==published
             const slugResult = await repo.findAll({
                 filters: `slug==${id},status==published`,
-                perPage: 1,
+                pageSize: 1,
             });
             item = slugResult.data[0] ?? null;
         }