@mohasinac/appkit 4.52.5 → 4.53.0

package/dist/features/reviews/repository/reviews.repository.js

@@ -1,7 +1,7 @@
 import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase/index.js";
 import { NotFoundError } from "../../../errors/index.js";
 import { REVIEW_MAX_RATING, REVIEW_MIN_RATING } from "../../../_internal/shared/features/reviews/config.js";
-import { decryptPiiFields, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, } from "../../../security/index.js";
+import { maskPii, revealPii, REVIEW_PII_FIELDS, REVIEW_PII_INDEX_MAP, } from "../../../security/index.js";
 import { createReviewId, REVIEW_COLLECTION, } from "../schemas/index.js";
 import { buildReviewSearchTxt } from "../../../utils/search-txt-builders.js";
 import { planSearchTxt, beginSearchWindow, emptySearchResult, } from "../../../utils/search-txt-query.js";
@@ -35,12 +35,23 @@ class ReviewRepository extends BaseRepository {
         this.piiFields = REVIEW_PII_FIELDS;
         this.piiIndexMap = REVIEW_PII_INDEX_MAP;
     }
-    decryptSieveResult(result) {
+    /*
+     * 🛑 Was `decryptSieveResult`, an UNCONDITIONAL decrypt on the list path.
+     *
+     * Same defect as the `mapDoc` one and invisible to R3, which only looks at
+     * `mapDoc` — a repository can leak plaintext through any read path, and this
+     * one did it for all three list methods. Renamed rather than deleted because
+     * these three callers are public-facing and genuinely need a displayable
+     * name, so they now take the MASKED form: "R*** K***" rather than the full
+     * name a scraper could harvest alongside every purchase it describes.
+     *
+     * A caller that needs the real name calls `revealReview` on the row it
+     * actually needs, which is one row rather than a page of fifty.
+     */
+    maskSieveResult(result) {
         return {
             ...result,
-            items: result.items.map((item) => decryptPiiFields(item, [
-                ...REVIEW_PII_FIELDS,
-            ])),
+            items: this.maskedReviews(result.items),
         };
     }
     mapDoc(snap) {
@@ -52,13 +63,53 @@ class ReviewRepository extends BaseRepository {
         // forgotten call site away from a leak. `voteHelpful` reads the raw snapshot
         // inside its transaction and is unaffected.
         const { helpfulVoterIds: _voters, ...rest } = raw;
-        return decryptPiiFields(rest, [
-            ...REVIEW_PII_FIELDS,
-        ]);
+        /*
+         * 🛑 The DECRYPT is gone; the STRIP stays, and the distinction matters.
+         *
+         * This is the one R3 subject whose `mapDoc` did something besides decrypt,
+         * so the override survives — which is also why the audit's rule had to be
+         * scoped to mapDoc's own body rather than "a decrypt call anywhere in this
+         * file": the named accessors below call one, and a file-level test would
+         * report this correctly-converted repository as unconverted forever.
+         *
+         * `userName` is now ciphertext to every caller. `maskPublicReview` masks
+         * it for the public list, and it refuses ciphertext by design — so that
+         * path goes through `maskedReview` instead, which decrypts first.
+         */
+        return rest;
     }
-    async create(input) {
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealReview(doc) {
+        return revealPii(doc, REVIEW_PII_FIELDS);
+    }
+    /** As `revealReview`, for a list read. */
+    revealReviews(docs) {
+        return docs.map((d) => this.revealReview(d));
+    }
+    /**
+     * Masked PII — **the default for any public surface.** Decrypts first, then
+     * masks: `maskName` returns "Anonymous" for a ciphertext input by design, so
+     * handing it a stored `userName` would anonymise every reviewer.
+     */
+    maskedReview(doc) {
+        return maskPii(doc, REVIEW_PII_FIELDS);
+    }
+    /** As `maskedReview`, for a list read. */
+    maskedReviews(docs) {
+        return docs.map((d) => this.maskedReview(d));
+    }
+    /*
+     * 🛑 NOT an `override`. `BaseRepository.create` promises to accept the
+     * CIPHERTEXT shape; this accepts PLAINTEXT and encrypts, and `string` vs
+     * `Encrypted<string>` is incompatible in both directions, so an override is a
+     * TS2416 either way — correctly, because the signatures disagree about what
+     * the caller holds. Returns `ReviewPlain`: it echoes the input rather than
+     * re-reading.
+     */
+    async createReview(input) {
         const firstName = input.userName.split(" ")[0] || input.userName;
         const id = createReviewId(input.productTitle, firstName, new Date());
+        // Plain in, ciphertext out — the write hook encrypts below.
         const reviewData = {
             ...input,
             helpfulCount: 0,
@@ -334,7 +385,7 @@ class ReviewRepository extends BaseRepository {
             defaultPageSize: 10,
             maxPageSize: 50,
         });
-        return this.decryptSieveResult(result);
+        return this.maskSieveResult(result);
     }
     async listForStore(storeId, model) {
         const baseQuery = this.getCollection().where(REVIEW_FIELDS.STORE_ID, "==", storeId);
@@ -343,7 +394,7 @@ class ReviewRepository extends BaseRepository {
             defaultPageSize: 10,
             maxPageSize: 100,
         });
-        return this.decryptSieveResult(result);
+        return this.maskSieveResult(result);
     }
     /**
      * Derived on every write path via `applyWriteHooks`.
@@ -376,7 +427,7 @@ class ReviewRepository extends BaseRepository {
         });
         // Refine BEFORE decrypting: the refine reads `searchTxt`, which is never
         // encrypted, and decrypting rows that are about to be dropped is waste.
-        return this.decryptSieveResult(win.finish(result));
+        return this.maskSieveResult(win.finish(result));
     }
 }
 ReviewRepository.SIEVE_FIELDS = {

package/dist/features/reviews/schemas/firestore.d.ts

@@ -4,6 +4,7 @@
 import type { ReviewStatus } from "../types";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { ListingType } from "../../products/types/index";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 /** Runtime-accessible review status values — use instead of bare string literals. */
 export declare const ReviewStatusValues: {
     readonly PENDING: "pending";
@@ -17,6 +18,16 @@ export interface ReviewVideoField {
     trimStart?: number;
     trimEnd?: number;
 }
+/**
+ * `ReviewDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type ReviewPlain = Plaintext<ReviewDocument>;
 export interface ReviewDocument extends BaseDocument {
     /** Normalized edge-n-gram search field — see appkit/src/utils/search-txt.ts. */
     searchTxt?: string[];
@@ -29,7 +40,7 @@ export interface ReviewDocument extends BaseDocument {
     userId: string;
     /** Firestore document ID of the reviewer (slug like `user-mohsin-c`). Populated on create; used to build profile links. */
     userSlug?: string;
-    userName: string;
+    userName: Encrypted<string>;
     userAvatar?: string;
     rating: number;
     title: string;
@@ -67,7 +78,7 @@ export declare const REVIEW_INDEXED_FIELDS: readonly ["searchTxt", "productId",
 export declare const DEFAULT_REVIEW_DATA: Partial<ReviewDocument>;
 export declare const REVIEW_PUBLIC_FIELDS: readonly ["id", "productId", "userName", "userAvatar", "rating", "title", "comment", "helpfulCount", "verified", "images", "createdAt"];
 export declare const REVIEW_UPDATABLE_FIELDS: readonly ["rating", "title", "comment", "images"];
-export type ReviewCreateInput = Omit<ReviewDocument, "id" | "createdAt" | "updatedAt" | "helpfulCount" | "reportCount" | "moderatorId" | "moderatorNote" | "approvedAt" | "rejectedAt">;
+export type ReviewCreateInput = Omit<ReviewPlain, "id" | "createdAt" | "updatedAt" | "helpfulCount" | "reportCount" | "moderatorId" | "moderatorNote" | "approvedAt" | "rejectedAt">;
 export type ReviewUpdateInput = Partial<Pick<ReviewDocument, (typeof REVIEW_UPDATABLE_FIELDS)[number]>>;
 export type ReviewModerationInput = {
     status: ReviewStatus;

package/dist/features/reviews/schemas/index.d.ts

@@ -367,20 +367,20 @@ export declare const reviewListParamsSchema: z.ZodObject<{
     sort?: string | undefined;
     status?: "pending" | "approved" | "rejected" | undefined;
     page?: number | undefined;
-    perPage?: number | undefined;
     storeId?: string | undefined;
     rating?: number | undefined;
     featured?: boolean | undefined;
     productId?: string | undefined;
     userId?: string | undefined;
+    perPage?: number | undefined;
 }, {
     sort?: string | undefined;
     status?: "pending" | "approved" | "rejected" | undefined;
     page?: number | undefined;
-    perPage?: number | undefined;
     storeId?: string | undefined;
     rating?: number | undefined;
     featured?: boolean | undefined;
     productId?: string | undefined;
     userId?: string | undefined;
+    perPage?: number | undefined;
 }>;

package/dist/features/scams/actions/scam-actions.js

@@ -119,13 +119,25 @@ export async function getSellerTrustStatus(storeId) {
     if (!owner.value)
         return TRUST_STATUS_CLEAR;
     const ownerDoc = owner.value;
+    /*
+     * 🛑 REVEALED — without this, THIS SECURITY CONTROL SILENTLY ALWAYS PASSES.
+     *
+     * `userRepository` is ciphertext-by-default, while the scam registry's
+     * `phones`/`emails` are PLAINTEXT on purpose (decision D1: a victim googles a
+     * UPI id before paying, so SEO is the feature). Comparing ciphertext against
+     * plaintext never matches, so every lookup returned zero rows and
+     * `sellerTrustStatus` answered CLEAR for every seller — including ones
+     * already in the registry. No error, no log, and the one check a buyer
+     * relies on degraded to a constant.
+     */
+    const ownerPlain = userRepository.revealUser(ownerDoc);
     const lookups = [];
-    if (ownerDoc.phoneNumber) {
-        const phone = ownerDoc.phoneNumber;
+    if (ownerPlain.phoneNumber) {
+        const phone = ownerPlain.phoneNumber;
         lookups.push(() => scammerRepository.findByContactField("phones", phone));
     }
-    if (ownerDoc.email) {
-        const email = ownerDoc.email;
+    if (ownerPlain.email) {
+        const email = ownerPlain.email;
         lookups.push(() => scammerRepository.findByContactField("emails", email));
     }
     if (lookups.length === 0)

package/dist/features/search/components/SearchResultsPageView.js

@@ -1,4 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { Section, Container, Stack, Row, Div, Heading, Text, Span, TextLink } from "../../../ui/index.js";
 export function SearchResultsPageView({ result, renderSearchInput, }) {
     const { q, terms, groups, totalHits } = result;
@@ -17,5 +18,5 @@ export function SearchResultsPageView({ result, renderSearchInput, }) {
     const normalisedAway = hasQuery && terms.length === 0;
     return (_jsx(Section, { padding: "page", children: _jsx(Container, { children: _jsxs(Stack, { gap: "loose", children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, children: hasQuery ? `Search: ${q}` : "Search" }), hasQuery && !normalisedAway && (_jsx(Text, { color: "muted", size: "sm", children: totalHits === 0
                                     ? "Nothing matched."
-                                    : `${totalHits}${groups.some((g) => g.truncated) ? "+" : ""} result${totalHits === 1 ? "" : "s"} across ${groups.length} section${groups.length === 1 ? "" : "s"}.` }))] }), renderSearchInput?.(), !hasQuery && (_jsx(Text, { color: "muted", children: "Search listings, categories, brands, stores, articles and help pages at once." })), normalisedAway && (_jsx(Text, { color: "muted", children: "That search had no searchable words in it. Try a product, part or category name." })), groups.map((group) => (_jsxs(Stack, { gap: "sm", children: [_jsxs(Row, { justify: "between", align: "center", wrap: true, gap: "sm", children: [_jsxs(Heading, { level: 2, size: "lg", children: [group.label, group.truncated && (_jsxs(Span, { size: "sm", color: "muted", children: [" ", "(", group.hits.length, "+)"] }))] }), _jsxs(TextLink, { href: group.moreHref, children: ["See all ", group.label.toLowerCase(), " \u2192"] })] }), _jsx(Stack, { gap: "xs", children: group.hits.map((hit) => (_jsxs(Div, { surface: "card", padding: "sm", rounded: "md", children: [_jsx(TextLink, { href: hit.href, children: hit.title }), hit.detail && (_jsx(Text, { size: "xs", color: "muted", children: hit.detail }))] }, `${group.key}-${hit.id}`))) })] }, group.key))), hasQuery && !normalisedAway && totalHits === 0 && (_jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { color: "muted", children: ["No listings, categories, brands, stores, articles or help pages matched \u201C", q, "\u201D."] }), _jsx(TextLink, { href: "/products", children: "Browse all listings \u2192" })] }))] }) }) }));
+                                    : `${totalHits}${groups.some((g) => g.truncated) ? "+" : ""} result${totalHits === 1 ? "" : "s"} across ${groups.length} section${groups.length === 1 ? "" : "s"}.` }))] }), renderSearchInput?.(), !hasQuery && (_jsx(Text, { color: "muted", children: "Search listings, categories, brands, stores, articles and help pages at once." })), normalisedAway && (_jsx(Text, { color: "muted", children: "That search had no searchable words in it. Try a product, part or category name." })), groups.map((group) => (_jsxs(Stack, { gap: "sm", children: [_jsxs(Row, { justify: "between", align: "center", wrap: true, gap: "sm", children: [_jsxs(Heading, { level: 2, size: "lg", children: [group.label, group.truncated && (_jsxs(Span, { size: "sm", color: "muted", children: [" ", "(", group.hits.length, "+)"] }))] }), _jsxs(TextLink, { href: group.moreHref, children: ["See all ", group.label.toLowerCase(), " \u2192"] })] }), _jsx(Stack, { gap: "xs", children: group.hits.map((hit) => (_jsxs(Div, { surface: "card", padding: "sm", rounded: "md", children: [_jsx(TextLink, { href: hit.href, children: hit.title }), hit.detail && (_jsx(Text, { size: "xs", color: "muted", children: hit.detail }))] }, `${group.key}-${hit.id}`))) })] }, group.key))), hasQuery && !normalisedAway && totalHits === 0 && (_jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { color: "muted", children: ["No listings, categories, brands, stores, articles or help pages matched \u201C", q, "\u201D."] }), _jsx(TextLink, { href: ROUTES.PUBLIC.PRODUCTS, children: "Browse all listings \u2192" })] }))] }) }) }));
 }

package/dist/features/search/hooks/useSearchIndex.d.ts

@@ -0,0 +1,34 @@
+import { type SearchIndexArtifact } from "../../../_internal/shared/search/index-record";
+import { type PreparedIndex } from "../../../_internal/shared/search/match";
+export type SearchIndexStatus = "idle" | "loading" | "ready" | "failed" | "disabled";
+export interface LoadedSearchIndex {
+    readonly artifact: SearchIndexArtifact;
+    readonly prepared: PreparedIndex[];
+    readonly version: number;
+    readonly builtAt: string;
+}
+export interface SearchIndexState {
+    readonly status: SearchIndexStatus;
+    readonly index: LoadedSearchIndex | null;
+    /** Present on `failed`. Short, for a log line — never rendered to a user. */
+    readonly reason: string | null;
+}
+/** Reset hook, for the verify script and for a kill-switch flip mid-session. */
+export declare function __resetSearchIndexForTests(): void;
+/** Start the load if it has not started. Idempotent; safe to call per render. */
+export declare function ensureSearchIndex(): Promise<LoadedSearchIndex | null>;
+export interface UseSearchIndexOptions {
+    /**
+     * Flip true when the user shows intent — focus, or the first keypress.
+     * False keeps the hook in `idle` and issues no request at all.
+     */
+    active: boolean;
+    /**
+     * `siteSettings.search?.indexEnabled`. 🛑 Read as `!== false`, so an
+     * undefined settings object — a failed fetch, a stale cached response from
+     * before the field existed — leaves search WORKING. Only an explicit
+     * `false` disables it.
+     */
+    indexEnabled?: boolean;
+}
+export declare function useSearchIndex({ active, indexEnabled, }: UseSearchIndexOptions): SearchIndexState;

package/dist/features/search/hooks/useSearchIndex.js

@@ -0,0 +1,172 @@
+"use client";
+/*
+ * WHY: Fetch the public search artifact exactly once per page session and
+ *      hand every caller the SAME prepared copy, so typing costs nothing.
+ * WHAT: A module-level singleton loader plus the hook that exposes its state.
+ *
+ * ## 🛑 ONE fetch and ONE `prepareIndex`, per page session, shared
+ *
+ * The artifact is ~420 KB and `prepareIndex` normalises ~3,700 titles and
+ * details. Both are cheap once and ruinous per component: the header
+ * dropdown, `/search`, `/parts` and two `/tools` surfaces all want the same
+ * index, and a hook that loaded per mount would download it five times and
+ * re-normalise 18,500 strings. The singleton lives at module scope — not in a
+ * React context — because a context would make every one of those consumers
+ * require a provider they cannot guarantee (Root Cause #20), and the data is
+ * immutable so there is nothing for a provider to coordinate.
+ *
+ * ## 🛑 Nothing loads until somebody intends to search
+ *
+ * `active` gates the fetch, and callers flip it on first focus or first
+ * keypress — never on mount. The action-index route states the rule this
+ * follows: one request per session, never per keystroke. Firing on mount
+ * would put 420 KB on the critical path of every page view for a feature
+ * most visits never touch, which is the opposite of the trade this whole
+ * design exists to make.
+ *
+ * ## 🛑 It NEVER stores the artifact in localStorage
+ *
+ * The service worker holds the bytes, against an `immutable` version-addressed
+ * URL. localStorage is synchronous, ~5 MB, shared with everything else the app
+ * keeps, and would have to be invalidated by hand on every build. The plan
+ * called for keeping the version integer there to skip the manifest hop; that
+ * is dropped deliberately, because the manifest is a ~100-byte 60s-cached
+ * document and a remembered version is wrong exactly when it matters — after
+ * a rebuild — at which point it costs a WASTED 420 KB download instead of
+ * saving a tiny one.
+ *
+ * ## Four states, and `loading` is not `empty`
+ *
+ * Same discipline as `GatedPrice`'s three: a caller must be able to tell "no
+ * matches" from "we have not loaded the haystack yet". Rendering an empty
+ * state while the index is in flight says "nothing matched" about a question
+ * nobody has asked yet.
+ *
+ * `failed` and `disabled` are also distinct, and both mean *fall back to the
+ * server path* rather than *show nothing*.
+ *
+ * @tag domain:search
+ * @tag layer:feature
+ * @tag pattern:hook
+ * @tag access:client
+ * @tag consumers:Search,SearchResultsPageView,/parts,/tools/price-index
+ * @tag sideEffects:network
+ */
+import * as React from "react";
+import { SEARCH_INDEX_SCHEMA_VERSION, } from "../../../_internal/shared/search/index-record.js";
+import { searchArtifactUrl, searchManifestUrl, } from "../../../_internal/shared/search/artifact-url.js";
+import { prepareIndex } from "../../../_internal/shared/search/match.js";
+import { normalizeError } from "../../../errors/normalize.js";
+/**
+ * Read at module scope, exactly as `utils/media-url.ts` does for the same
+ * variable. Next inlines `NEXT_PUBLIC_*` at build time, so this is a constant
+ * in the bundle rather than a runtime lookup.
+ */
+const BUCKET = process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET ?? "";
+/**
+ * The singleton. `undefined` until the first caller asks; thereafter the same
+ * promise forever, resolving to `null` on any failure.
+ *
+ * 🛑 Resolving to `null` rather than rejecting is deliberate: a rejected
+ * module-scope promise with no attached handler is an unhandled rejection in
+ * every tab where nothing happens to be awaiting it yet.
+ */
+let inflight;
+let failureReason = null;
+/** Reset hook, for the verify script and for a kill-switch flip mid-session. */
+export function __resetSearchIndexForTests() {
+    inflight = undefined;
+    failureReason = null;
+}
+async function fetchJson(url, label) {
+    /*
+     * 🛑 `mode: "cors"`, explicitly, and never `no-cors`.
+     *
+     * A `no-cors` fetch of a cross-origin object yields an OPAQUE response: the
+     * body cannot be read, the status reads as 0, and a 404 is indistinguishable
+     * from a successful empty index — which is this feature's single favourite
+     * failure mode. The bucket carries a CORS entry for the app origins
+     * precisely so this can be `cors` and the status can be real.
+     */
+    const res = await fetch(url, { mode: "cors", credentials: "omit" });
+    if (!res.ok)
+        throw new Error(`${label}: HTTP ${res.status}`);
+    return (await res.json());
+}
+async function load() {
+    try {
+        if (!BUCKET)
+            throw new Error("NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET is unset");
+        const manifest = await fetchJson(searchManifestUrl(BUCKET), "manifest");
+        /*
+         * 🛑 Refuse a schema this build does not understand, rather than render a
+         * half-understood artifact.
+         *
+         * The tuple is positional. A future `[typeIdx, title, detail, slug,
+         * facets, badge]` would parse without error in this build and simply be
+         * read wrong — wrong slugs, wrong hrefs, confidently. The version lives
+         * in the ENVELOPE and not in the URL for exactly this check; falling back
+         * to the server path is always better than being quietly wrong.
+         */
+        if (manifest.schema !== SEARCH_INDEX_SCHEMA_VERSION) {
+            throw new Error(`schema ${manifest.schema} != client ${SEARCH_INDEX_SCHEMA_VERSION}`);
+        }
+        const artifact = await fetchJson(searchArtifactUrl(BUCKET, manifest.version), "artifact");
+        if (artifact.schema !== SEARCH_INDEX_SCHEMA_VERSION) {
+            throw new Error(`artifact schema ${artifact.schema} disagrees with its manifest`);
+        }
+        return {
+            artifact,
+            // Once, here. See the header, and `prepareIndex`'s own 🛑.
+            prepared: [...prepareIndex(artifact)],
+            version: artifact.version,
+            builtAt: artifact.builtAt,
+        };
+    }
+    catch (err) {
+        const n = normalizeError(err);
+        /*
+         * normalizeError FIRST, before the body touches the value — the project-wide
+         * rule, and what audit-catch-normalize is strict-zero about. It also removes
+         * the hand-rolled `err instanceof Error ? … : String(err)` narrowing that
+         * every catch otherwise reinvents slightly differently, which is the whole
+         * reason the helper exists (Root Cause #31).
+         */
+        failureReason = n.message;
+        return null;
+    }
+}
+/** Start the load if it has not started. Idempotent; safe to call per render. */
+export function ensureSearchIndex() {
+    inflight ?? (inflight = load());
+    return inflight;
+}
+export function useSearchIndex({ active, indexEnabled, }) {
+    const enabled = indexEnabled !== false;
+    const [index, setIndex] = React.useState(null);
+    const [settled, setSettled] = React.useState(false);
+    React.useEffect(() => {
+        if (!active || !enabled || settled)
+            return;
+        let alive = true;
+        void ensureSearchIndex().then((loaded) => {
+            if (!alive)
+                return;
+            setIndex(loaded);
+            setSettled(true);
+        });
+        return () => {
+            alive = false;
+        };
+    }, [active, enabled, settled]);
+    const status = !enabled
+        ? "disabled"
+        : !active
+            ? "idle"
+            : !settled
+                ? "loading"
+                : index
+                    ? "ready"
+                    : "failed";
+    return { status, index, reason: status === "failed" ? failureReason : null };
+}

package/dist/features/search/repository/search.repository.js

@@ -43,7 +43,7 @@ export class SearchRepository {
                 : "createdAt",
             order: query.sort?.startsWith("-") ? "desc" : "asc",
             page: query.page ?? 1,
-            perPage: query.pageSize ?? 24,
+            pageSize: query.pageSize ?? 24,
         };
         const result = await this.repo.findAll(sieveQuery);
         return {
@@ -51,7 +51,7 @@ export class SearchRepository {
             q: query.q ?? "",
             total: result.total,
             page: result.page,
-            pageSize: result.perPage,
+            pageSize: result.pageSize,
             totalPages: result.totalPages,
             hasMore: result.page < result.totalPages,
         };

package/dist/features/seller/actions/offer-actions.d.ts

@@ -4,7 +4,7 @@
  * Business logic for the Make-an-Offer feature lifecycle.
  * Auth, rate-limiting, and input validation are handled by the calling server action.
  */
-import type { OfferDocument } from "../schemas";
+import type { OfferDocument, OfferPlain } from "../schemas";
 /**
  * How long an accepted offer stays claimable at its locked price. Shared by the
  * seller-accept path, the buyer-accepts-counter path, and the expiry sweep so
@@ -28,11 +28,11 @@ export interface BuyerCounterInput {
     counterAmount: number;
     buyerNote?: string;
 }
-export declare function makeOffer(userId: string, userEmail: string, input: MakeOfferInput): Promise<OfferDocument>;
+export declare function makeOffer(userId: string, userEmail: string, input: MakeOfferInput): Promise<OfferPlain>;
 export declare function respondToOffer(userId: string, input: RespondToOfferInput): Promise<OfferDocument>;
 export declare function acceptCounterOffer(userId: string, offerId: string): Promise<OfferDocument>;
-export declare function counterOfferByBuyer(userId: string, userEmail: string, input: BuyerCounterInput): Promise<OfferDocument>;
+export declare function counterOfferByBuyer(userId: string, userEmail: string, input: BuyerCounterInput): Promise<OfferPlain>;
 export declare function withdrawOffer(userId: string, offerId: string): Promise<void>;
-export declare function listBuyerOffers(userId: string): Promise<OfferDocument[]>;
-export declare function listSellerOffers(userId: string): Promise<OfferDocument[]>;
+export declare function listBuyerOffers(userId: string): Promise<OfferPlain[]>;
+export declare function listSellerOffers(userId: string): Promise<OfferPlain[]>;
 export declare function checkoutOffer(userId: string, offerId: string): Promise<CartDocument>;

package/dist/features/seller/actions/offer-actions.js

@@ -12,7 +12,6 @@ import { sendNotification } from "../../admin/actions/notification-actions.js";
 import { userRepository } from "../../auth/repository/user.repository.js";
 import { storeRepository } from "../../stores/repository/store.repository.js";
 import { cartRepository } from "../../cart/repository/cart.repository.js";
-import { maskOfferForSeller } from "../../../security/index.js";
 import { ERROR_MESSAGES, AuthorizationError, ValidationError, NotFoundError, OFFER_ERROR_CODES, } from "../../../errors/index.js";
 import { canMakeOffer } from "../../../_internal/shared/listing-types/capabilities.js";
 import { normalizeListingType } from "../../products/utils/listing-type.js";
@@ -122,17 +121,27 @@ export async function makeOffer(userId, userEmail, input) {
     if (alreadyActive)
         throw new ValidationError(ERROR_MESSAGES.OFFER.ACTIVE_OFFER_EXISTS);
     const profile = await userRepository.findById(userId);
+    /*
+     * 🛑 REVEALED. `createOffer` encrypts `buyerEmail` (`OFFER_PII_FIELDS`), so
+     * the ciphertext this read returns would have been encrypted a second time
+     * and become permanently unreadable — the seller could never see who made
+     * the offer. The sibling `bid-actions.ts:223,481` was fixed for exactly this;
+     * this line is the same shape, missed.
+     *
+     * `userEmail` (the parameter) is already plaintext, so it needs no unwrap.
+     */
+    const profilePlain = profile ? userRepository.revealUser(profile) : null;
     const buyerDisplayName = profile?.displayName ?? "Buyer";
     if (!product.storeId)
         throw new ValidationError("Product is not associated with a store.");
-    const offer = await offerRepository.create({
+    const offer = await offerRepository.createOffer({
         productId,
         productTitle: product.title,
         productSlug: product.slug,
         productImageUrl: product.mainImage,
         buyerUid: userId,
         buyerName: buyerDisplayName,
-        buyerEmail: profile?.email ?? userEmail ?? "",
+        buyerEmail: profilePlain?.email ?? userEmail ?? "",
         storeId: product.storeId,
         storeName: product.storeName ?? "",
         offerAmount,
@@ -284,14 +293,24 @@ export async function counterOfferByBuyer(userId, userEmail, input) {
     // single-field equality served by the automatic index.
     const chainRoot = offer.chainRootOfferId ?? offer.id;
     const nextRound = (offer.counterRound ?? 1) + 1;
-    const newOffer = await offerRepository.create({
+    /*
+     * 🛑 A NINTH double-encryption site, found by the nominal brand.
+     *
+     * A buyer counter creates a NEW offer document carrying the previous round's
+     * buyer identity forward. `offer` came from a read, so those two fields are
+     * ciphertext — and `createOffer` encrypts `buyerName`/`buyerEmail` again
+     * (`OFFER_PII_FIELDS`), so round 2 onward stored a permanently unreadable
+     * buyer. Rounds 1 was fine, which is why nothing looked wrong.
+     */
+    const offerPlain = offerRepository.revealOffer(offer);
+    const newOffer = await offerRepository.createOffer({
         productId: offer.productId,
         productTitle: offer.productTitle,
         productSlug: offer.productSlug,
         productImageUrl: offer.productImageUrl,
         buyerUid: userId,
-        buyerName: offer.buyerName,
-        buyerEmail: offer.buyerEmail,
+        buyerName: offerPlain.buyerName,
+        buyerEmail: offerPlain.buyerEmail,
         storeId: offer.storeId,
         storeName: offer.storeName,
         offerAmount: counterAmount,
@@ -349,14 +368,25 @@ export async function withdrawOffer(userId, offerId) {
 // --- Read ------------------------------------------------------------------
 export async function listBuyerOffers(userId) {
     const result = await offerRepository.findByBuyer(userId);
-    return result.items;
+    /*
+     * REVEALED: these are the buyer's OWN offers, so showing them their own name
+     * and email in full is the canonical legitimate plaintext read. The seller's
+     * view of the same documents goes through `maskedOffer` instead.
+     */
+    return result.items.map((o) => offerRepository.revealOffer(o));
 }
 export async function listSellerOffers(userId) {
     const store = await storeRepository.findByOwnerId(userId);
     if (!store)
         return [];
     const result = await offerRepository.findByStore(store.id);
-    return result.items.map(maskOfferForSeller);
+    /*
+     * `maskedOffer`, not `maskOfferForSeller`. The latter calls `maskName`,
+     * which refuses ciphertext by design and answers "Anonymous" — and
+     * `findByStore` returns raw documents. So the seller's own offers list
+     * showed every buyer as Anonymous. `maskedOffer` decrypts first, then masks.
+     */
+    return result.items.map((o) => offerRepository.maskedOffer(o));
 }
 // --- Buyer: Checkout accepted offer ----------------------------------------
 export async function checkoutOffer(userId, offerId) {

package/dist/features/seller/actions/seller-actions.js

@@ -257,7 +257,7 @@ export async function requestPayout(userId, userName, userEmail, input) {
     const earnings = await computeSellerEarnings(userId);
     if (earnings.netAmount <= 0 || earnings.eligibleOrders.length === 0)
         throw new ValidationError("No eligible earnings available for payout.");
-    const payout = await payoutRepository.create({
+    const payout = await payoutRepository.createPayout({
         storeId: userId,
         sellerName: userName,
         sellerEmail: userEmail,
@@ -288,6 +288,16 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
     const userDoc = await userRepository.findById(userId);
     if (!userDoc)
         throw new AuthorizationError("User not found");
+    /*
+     * 🛑 REVEALED before building a payout — the same active corruption the two
+     * payout crons had. `findById` is ciphertext-by-default and `createPayout`
+     * encrypts `upiId` again (`PAYOUT_PII_FIELDS`), so the seller-initiated path
+     * wrote a permanently unreadable payee address too.
+     *
+     * `payoutDetails` is encrypted by `encryptPayoutDetails`, a separate scheme
+     * from the `piiFields` path, which is why `revealUser` unwraps it explicitly.
+     */
+    const userPlain = userRepository.revealUser(userDoc);
     if (!userDoc.payoutDetails?.isConfigured) {
         throw new ValidationError("Payout details are not set up. Please configure your payout method before requesting a payout.");
     }
@@ -337,7 +347,7 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
     const grossAmount = ordersTaxableValue(eligible);
     const bulkSiteSettings = await siteSettingsRepository.getSingleton();
     const bulkDeduction = computePayoutDeduction(grossAmount, bulkSiteSettings.commissions);
-    const payoutDoc = await payoutRepository.create({
+    const payoutDoc = await payoutRepository.createPayout({
         storeId: userId,
         sellerName: userDisplayName,
         sellerEmail: userEmail,
@@ -351,14 +361,31 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
         gstAmount: bulkDeduction.gstOnFee,
         gstRate: bulkSiteSettings.commissions.gstPercent / 100,
         currency: getDefaultCurrency(),
-        paymentMethod: userDoc.payoutDetails.method === "upi"
+        paymentMethod: userPlain.payoutDetails?.method === "upi"
             ? "upi"
             : "bank_transfer",
-        upiId: userDoc.payoutDetails.method === "upi"
-            ? userDoc.payoutDetails.upiId
+        upiId: userPlain.payoutDetails?.method === "upi"
+            ? userPlain.payoutDetails.upiId
             : undefined,
-        bankAccount: userDoc.payoutDetails.method === "bank_transfer"
-            ? userDoc.payoutDetails.bankAccount
+        /*
+         * 🛑 Only the MASKED subset, matching both payout crons.
+         *
+         * This used to copy the whole `bankAccount`, including the real
+         * `accountNumber` that `encryptPayoutDetails` had encrypted on the user
+         * document. `PAYOUT_PII_FIELDS` does not list it and
+         * `encryptPayoutBankAccount` is a no-op, so the ciphertext was stored
+         * verbatim on the payout where nothing would ever unwrap it — and
+         * revealing it instead would store a real account number in the clear.
+         * A payout does not need the full number; it needs to identify the account.
+         */
+        bankAccount: userPlain.payoutDetails?.method === "bank_transfer" &&
+            userPlain.payoutDetails.bankAccount
+            ? {
+                accountHolderName: userPlain.payoutDetails.bankAccount.accountHolderName,
+                accountNumberMasked: userPlain.payoutDetails.bankAccount.accountNumberMasked,
+                ifscCode: userPlain.payoutDetails.bankAccount.ifscCode,
+                bankName: userPlain.payoutDetails.bankAccount.bankName,
+            }
             : undefined,
         notes: `Payout request for ${eligible.length} custom-shipped delivered order(s)`,
     });