@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/features/messages/components/ConversationThreadView.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useEffect, useRef, useState } from "react";
+import { useSearchParams } from "next/navigation.js";
 import { useAuth } from "../../../react/contexts/SessionContext.js";
 import { useConversationThread, useSendMessage, useMarkConversationRead, useBlockConversation, } from "../hooks/useMessages.js";
 import { Div } from "../../../ui/components/Div.js";
@@ -10,6 +11,10 @@ import { Button } from "../../../ui/components/Button.js";
 import { FieldTextarea } from "../../../ui/forms/FieldTextarea.js";
 import { EmptyState } from "../../../ui/components/EmptyState.js";
 import { MediaImage } from "../../media/MediaImage.js";
+import { TextLink } from "../../../ui/components/TextLink.js";
+import { pluginFor } from "../../../_internal/shared/listing-types/_registry.js";
+import { isListingType } from "../../../_internal/shared/listing-types/feature-flags.js";
+import { formatCurrency } from "../../../utils/number.formatter.js";
 function newClientMessageId() {
     // crypto.randomUUID is available in every browser this app targets; a
     // retry reuses the SAME id generated at compose time, not a fresh one per
@@ -22,7 +27,32 @@ function MessageBubble({ message, isSelf }) {
     if (message.deletedAt) {
         return (_jsx(Row, { justify: isSelf ? "end" : "start", children: _jsx(Text, { size: "sm", color: "muted", className: "italic", children: "Message deleted" }) }));
     }
-    return (_jsx(Row, { justify: isSelf ? "end" : "start", children: _jsxs(Stack, { gap: "xs", surface: isSelf ? "interactive" : "muted", padding: "sm", rounded: "lg", className: "max-w-[75%]", children: [message.productRef && (_jsxs(Row, { gap: "sm", surface: "card", padding: "xs", rounded: "md", children: [message.productRef.image && (_jsx(Div, { className: "relative h-10 w-10 flex-shrink-0", rounded: "default", overflow: "hidden", children: _jsx(MediaImage, { src: message.productRef.image, alt: message.productRef.title, size: "thumbnail" }) })), _jsx(Text, { size: "xs", weight: "semibold", className: "truncate", children: message.productRef.title })] })), _jsx(Text, { size: "sm", className: "whitespace-pre-wrap break-words", children: message.body })] }) }));
+    return (_jsx(Row, { justify: isSelf ? "end" : "start", children: _jsxs(Stack, { gap: "xs", surface: isSelf ? "interactive" : "muted", padding: "sm", rounded: "lg", className: "max-w-[75%]", children: [message.productRef && (
+                /*
+                 * A LINK, and it shows the price.
+                 *
+                 * `MessageProductRef` captures `price` and this block ignored it —
+                 * a declared field with no reader (Root Cause #51's shape) — and the
+                 * card was not clickable, so the one thing a buyer and seller both
+                 * want from it (open the item) was missing. The snapshot is taken at
+                 * send time on purpose, so it keeps reading correctly after the
+                 * listing changes or is deleted.
+                 *
+                 * No `GatedPrice` here: chat requires auth, so there is no signed-out
+                 * viewer to gate, and the price shown is the one the buyer was
+                 * looking at when they asked.
+                 */
+                _jsx(TextLink, { variant: "inherit", href: String(
+                    /*
+                     * Narrowed, not cast. The snapshot stores `listingType` as a
+                     * plain `string` (a message written before the field existed has
+                     * none), and anything unrecognised falls back to the `standard`
+                     * route — the correct reading for those older rows and for a type
+                     * that has since been removed.
+                     */
+                    pluginFor(isListingType(message.productRef.listingType)
+                        ? message.productRef.listingType
+                        : "standard").detailRoute(message.productRef.productId)), layout: "flex-col", rounded: "md", children: _jsxs(Row, { gap: "sm", surface: "card", padding: "xs", rounded: "md", align: "center", children: [message.productRef.image && (_jsx(Div, { className: "relative h-10 w-10 flex-shrink-0", rounded: "default", overflow: "hidden", children: _jsx(MediaImage, { src: message.productRef.image, alt: message.productRef.title, size: "thumbnail" }) })), _jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsx(Text, { size: "xs", weight: "semibold", className: "truncate", children: message.productRef.title }), typeof message.productRef.price === "number" && (_jsx(Text, { size: "xs", color: "muted", children: formatCurrency(message.productRef.price, "INR") }))] })] }) })), _jsx(Text, { size: "sm", className: "whitespace-pre-wrap break-words", children: message.body })] }) }));
 }
 export function ConversationThreadView({ conversationId }) {
     const { user, loading } = useAuth();
@@ -31,6 +61,17 @@ export function ConversationThreadView({ conversationId }) {
     const markRead = useMarkConversationRead();
     const block = useBlockConversation();
     const [draft, setDraft] = useState("");
+    /*
+     * The listing the buyer arrived from, attached to the NEXT message and then
+     * cleared — so the card appears once, on the message that asked about it,
+     * rather than on every subsequent reply in the thread.
+     *
+     * Read from `?product=` rather than held on the conversation because the
+     * schema is explicit that a product belongs to a message: one thread per
+     * pair of people, however many items they discuss.
+     */
+    const searchParams = useSearchParams();
+    const [attachedProductId, setAttachedProductId] = useState(() => searchParams.get("product") ?? undefined);
     const markedRef = useRef(false);
     const bottomRef = useRef(null);
     useEffect(() => {
@@ -57,8 +98,10 @@ export function ConversationThreadView({ conversationId }) {
         if (!trimmed)
             return;
         const clientMessageId = newClientMessageId();
-        send({ body: trimmed, clientMessageId });
+        send({ body: trimmed, clientMessageId, productId: attachedProductId });
         setDraft("");
+        // Once attached, it is spent — the next message is a plain reply.
+        setAttachedProductId(undefined);
     };
     // Newest-first from the API, so reverse for display (oldest at top).
     const items = data ? [...data.items].reverse() : [];

package/dist/features/messages/components/MessageSellerButton.d.ts

@@ -1,5 +1,19 @@
 export interface MessageSellerButtonProps {
     storeId: string;
+    /**
+     * The listing this button was clicked from, carried into the thread so the
+     * buyer's first message renders as a PRODUCT CARD.
+     *
+     * 🛑 Without it the whole card pipeline is unreachable. `sendMessage` builds
+     * a `MessageProductRef` from a `productId`, `MessageBubble` renders it, and
+     * `POST /api/messages/[conversationId]` accepts it — but the ONLY caller of
+     * this button is the product detail page, which had the id right there and
+     * never passed it. So a buyer landed in a bare thread and had to TYPE which
+     * item they meant: a block of words where a card belongs. Root Cause #103's
+     * shape — a feature complete in every direction except the one that puts
+     * data in.
+     */
+    productId?: string;
     /** Render nothing when the viewer owns this store — comparing storeId
      * client-side is an optional convenience; the server refuses it either way. */
     isOwnStore?: boolean;
@@ -14,4 +28,4 @@ export interface MessageSellerButtonProps {
  * Absent entirely when chat is off or the viewer is the store's own owner —
  * never rendered-but-disabled, same discipline as the nav icon.
  */
-export declare function MessageSellerButton({ storeId, isOwnStore, className }: MessageSellerButtonProps): import("react").JSX.Element | null;
+export declare function MessageSellerButton({ storeId, productId, isOwnStore, className }: MessageSellerButtonProps): import("react").JSX.Element | null;

package/dist/features/messages/components/MessageSellerButton.js

@@ -16,7 +16,7 @@ import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
  * Absent entirely when chat is off or the viewer is the store's own owner —
  * never rendered-but-disabled, same discipline as the nav icon.
  */
-export function MessageSellerButton({ storeId, isOwnStore, className }) {
+export function MessageSellerButton({ storeId, productId, isOwnStore, className }) {
     const router = useRouter();
     const { user } = useAuth();
     const { data: settings } = useSiteSettings();
@@ -26,7 +26,15 @@ export function MessageSellerButton({ storeId, isOwnStore, className }) {
     return (_jsx(Button, { action: ACTIONS.PRODUCT["message-seller"], size: "sm", isLoading: isPending, className: className, onClick: () => {
             mutate({ storeId }, {
                 onSuccess: (conversation) => {
-                    router.push(String(ROUTES.USER.MESSAGE_THREAD(conversation.id)));
+                    /*
+                     * `?product=` rather than a new conversation per listing. The
+                     * schema is explicit that a product attaches to a MESSAGE, never
+                     * to the thread — "a buyer with three questions about three items
+                     * wants one thread, not three" — so the id rides in the URL and
+                     * the composer attaches it to the next message sent.
+                     */
+                    const href = String(ROUTES.USER.MESSAGE_THREAD(conversation.id));
+                    router.push(productId ? `${href}?product=${encodeURIComponent(productId)}` : href);
                 },
             });
         } }));

package/dist/features/messages/schemas/firestore.d.ts

@@ -44,6 +44,21 @@ export interface MessageProductRef {
     productId: string;
     title: string;
     image?: string;
+    /**
+     * 🛑 Required for the card to LINK anywhere correct.
+     *
+     * Nine listing types have five different detail routes
+     * (`/auctions/…`, `/pre-orders/…`, `/prize-draws/…`, `/classified/…`, …) and
+     * `pluginFor(type).detailRoute()` is the only thing that knows which. A card
+     * that hardcodes `/products/{slug}` sends an auction to the standard product
+     * page — which is Root Cause #48 exactly: a doc→card mapper dropping
+     * `listingType` and the link going wrong because of the one field it lost.
+     *
+     * Optional only because a message sent before this field existed has none;
+     * `normalizeListingType` resolves an absent value to `"standard"`, which is
+     * the correct reading for those rows.
+     */
+    listingType?: string;
     /** Omitted for a guest-gated listing snapshot taken while signed out is not
      * possible here — chat requires auth — but still optional: a product can be
      * archived/deleted between send and render. */

package/dist/features/orders/hooks/useOrders.js

@@ -18,8 +18,10 @@ export function useOrders(params = {}, opts) {
         sp.set("sort", params.sort);
     if (params.page)
         sp.set("page", String(params.page));
-    if (params.perPage)
-        sp.set("perPage", String(params.perPage));
+    // `pageSize` is what the route prefers; it keeps reading `perPage` only for
+    // links built before the rename, so there is no reason to emit the old name.
+    if (params.pageSize)
+        sp.set("pageSize", String(params.pageSize));
     const qs = sp.toString();
     // ORDER_ENDPOINTS.LIST ("/api/orders") has no GET route handler — every
     // real caller of this hook wants the current user's own orders, served by

package/dist/features/orders/repository/orders.repository.d.ts

@@ -2,7 +2,7 @@ import type { JsonValue } from "../../../schemas/types";
 import type { DocumentReference, WriteBatch } from "firebase-admin/firestore";
 import type { FirebaseSieveResult, SieveModel } from "../../../providers/db-firebase";
 import { BaseRepository, parseSieveDateValue } from "../../../providers/db-firebase";
-import { type OrderCreateInput, type OrderDocument, type OrderRefundEvent } from "../schemas";
+import { type OrderCreateInput, type OrderDocument, type OrderPlain, type OrderRefundEvent } from "../schemas";
 import { type HistoryActor, type FieldChange } from "../../../_internal/shared/history/index";
 import type { OrderStatus, PaymentStatus } from "../types";
 import { type PaymentReviewQueueMode } from "../constants/payment-window";
@@ -26,7 +26,6 @@ export interface OrderWriteContext {
 }
 declare class OrderRepository extends BaseRepository<OrderDocument> {
     constructor();
-    private decryptOrder;
     /**
      * Declared, not hand-rolled.
      *
@@ -39,8 +38,20 @@ declare class OrderRepository extends BaseRepository<OrderDocument> {
      * call.
      */
     protected piiFields: readonly ["userName", "userEmail", "sellerEmail"];
-    protected mapDoc<D = OrderDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
-    create(input: OrderCreateInput): Promise<OrderDocument>;
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealOrder(doc: OrderDocument): OrderPlain;
+    /** As `revealOrder`, for a list read. */
+    revealOrders(docs: readonly OrderDocument[]): OrderPlain[];
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedOrder(doc: OrderDocument): OrderPlain;
+    /** As `maskedOrder`, for a list read. */
+    maskedOrders(docs: readonly OrderDocument[]): OrderPlain[];
+    createOrder(input: OrderCreateInput): Promise<OrderPlain>;
     findByUser(userId: string): Promise<OrderDocument[]>;
     findByProduct(productId: string): Promise<OrderDocument[]>;
     findByStatus(status: OrderStatus): Promise<OrderDocument[]>;

package/dist/features/orders/repository/orders.repository.js

@@ -3,7 +3,7 @@ import { planSearchTxt, beginSearchWindow, emptySearchResult, } from "../../../u
 import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError, NotFoundError } from "../../../errors/index.js";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase/index.js";
-import { decryptPiiFields, ORDER_PII_FIELDS, } from "../../../security/index.js";
+import { maskPii, revealPii, ORDER_PII_FIELDS, } from "../../../security/index.js";
 import { serverTimestamp, arrayUnion } from "../../../contracts/field-ops.js";
 import { createOrderId, ORDER_COLLECTION, ORDER_TRACKED_FIELDS, OrderStatusValues, } from "../schemas/index.js";
 import { withHistory } from "../../../_internal/shared/history/index.js";
@@ -37,18 +37,49 @@ class OrderRepository extends BaseRepository {
          */
         this.piiFields = ORDER_PII_FIELDS;
     }
-    decryptOrder(doc) {
-        return decryptPiiFields(doc, [
-            ...ORDER_PII_FIELDS,
-        ]);
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `OrderDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealOrder(doc) {
+        return revealPii(doc, ORDER_PII_FIELDS);
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return this.decryptOrder(raw);
+    /** As `revealOrder`, for a list read. */
+    revealOrders(docs) {
+        return docs.map((d) => this.revealOrder(d));
     }
-    async create(input) {
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedOrder(doc) {
+        return maskPii(doc, ORDER_PII_FIELDS);
+    }
+    /** As `maskedOrder`, for a list read. */
+    maskedOrders(docs) {
+        return docs.map((d) => this.maskedOrder(d));
+    }
+    /*
+     * 🛑 NOT an `override`. It returns the plaintext it was handed rather than
+     * re-reading (a read-after-write costs a Firestore read per order), so the
+     * return is `OrderPlain` — not assignable to the base's `Promise<T>`, and
+     * correctly so, because the two differ.
+     */
+    async createOrder(input) {
         const orderDate = new Date();
         const id = createOrderId(input.quantity, orderDate);
+        // Plain in, ciphertext out — `applyWriteHooks` encrypts below.
         const orderData = {
             ...input,
             orderDate,
@@ -116,6 +147,7 @@ class OrderRepository extends BaseRepository {
         });
         // `null` means no tracked field actually changed — write the patch as-is
         // so an untracked update never grows the array.
+        // Plain: this is a write payload and `update` encrypts.
         return this.update(orderId, (withEntry ?? patch));
     }
     async updateStatus(orderId, status, additionalData, ctx) {
@@ -172,7 +204,7 @@ class OrderRepository extends BaseRepository {
             .orderBy(ORDER_FIELDS.CREATED_AT, "asc")
             .limit(200)
             .get();
-        return snap.docs.map((doc) => this.decryptOrder({ id: doc.id, ...doc.data() }));
+        return snap.docs.map((doc) => ({ id: doc.id, ...doc.data() }));
     }
     async updatePaymentStatus(orderId, paymentStatus, paymentId, ctx) {
         return this.updateWithHistory(orderId, {
@@ -202,7 +234,7 @@ class OrderRepository extends BaseRepository {
             .where(ORDER_FIELDS.ORDER_DATE, ">=", new Date(now.getTime() - 90 * 24 * 60 * 60 * 1000))
             .orderBy(ORDER_FIELDS.ORDER_DATE, "desc")
             .get();
-        return snapshot.docs.map((doc) => this.decryptOrder({
+        return snapshot.docs.map((doc) => ({
             id: doc.id,
             ...doc.data(),
         }));
@@ -412,7 +444,7 @@ class OrderRepository extends BaseRepository {
             .where("paymentBatchId", "==", batchId)
             .limit(20)
             .get();
-        return snap.docs.map((d) => this.decryptOrder({ id: d.id, ...d.data() }));
+        return snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     }
     /**
      * Fetch every order recorded against a single gateway payment id (e.g. a
@@ -428,7 +460,7 @@ class OrderRepository extends BaseRepository {
             .where(ORDER_FIELDS.PAYMENT_ID, "==", paymentId)
             .limit(20)
             .get();
-        return snap.docs.map((d) => this.decryptOrder({ id: d.id, ...d.data() }));
+        return snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     }
     /**
      * Cloud Functions: find pending orders created before a timeout threshold.
@@ -447,7 +479,7 @@ class OrderRepository extends BaseRepository {
         return snap.docs.map((d) => ({
             id: d.id,
             ref: d.ref,
-            data: this.decryptOrder({ id: d.id, ...d.data() }),
+            data: { id: d.id, ...d.data() },
         }));
     }
     /**
@@ -470,7 +502,7 @@ class OrderRepository extends BaseRepository {
             .map((d) => ({
             id: d.id,
             ref: d.ref,
-            data: this.decryptOrder({ id: d.id, ...d.data() }),
+            data: { id: d.id, ...d.data() },
         }))
             .filter((entry) => !entry.data.paymentProofUrl);
     }
@@ -495,7 +527,7 @@ class OrderRepository extends BaseRepository {
             .map((d) => ({
             id: d.id,
             ref: d.ref,
-            data: this.decryptOrder({ id: d.id, ...d.data() }),
+            data: { id: d.id, ...d.data() },
         }))
             .filter((entry) => !!entry.data.paymentProofUrl && !entry.data.paymentReviewOutcome);
     }
@@ -537,7 +569,7 @@ class OrderRepository extends BaseRepository {
             .limit(PAYMENT_REVIEW_QUEUE_SCAN_LIMIT)
             .get();
         const matches = snap.docs
-            .map((d) => this.decryptOrder({ id: d.id, ...d.data() }))
+            .map((d) => ({ id: d.id, ...d.data() }))
             .filter((order) => MANUAL_PAYMENT_METHODS.includes(order.paymentMethod ?? ""))
             .filter((order) => mode === "awaiting_proof"
             ? !order.paymentProofUrl
@@ -573,7 +605,7 @@ class OrderRepository extends BaseRepository {
             .map((d) => ({
             id: d.id,
             ref: d.ref,
-            data: this.decryptOrder({ id: d.id, ...d.data() }),
+            data: { id: d.id, ...d.data() },
         }))
             .filter((o) => !o.data.emiEnabled || o.data.emiComplete);
     }
@@ -596,7 +628,7 @@ class OrderRepository extends BaseRepository {
             .map((d) => ({
             id: d.id,
             ref: d.ref,
-            data: this.decryptOrder({ id: d.id, ...d.data() }),
+            data: { id: d.id, ...d.data() },
         }))
             .filter((o) => !o.data.emiEnabled || o.data.emiComplete);
     }
@@ -616,7 +648,7 @@ class OrderRepository extends BaseRepository {
         return snap.docs.map((d) => ({
             id: d.id,
             ref: d.ref,
-            data: this.decryptOrder({ id: d.id, ...d.data() }),
+            data: { id: d.id, ...d.data() },
         }));
     }
     /**

package/dist/features/orders/schemas/firestore.d.ts

@@ -8,6 +8,7 @@ import type { ListingType } from "../../products/types";
 import type { StatusChangeEntry } from "../../../_internal/shared/history/index";
 import type { ReturnReason } from "../../../_internal/shared/features/orders/return-reasons";
 import type { ReturnCustodyState } from "../../../_internal/shared/features/returns/custody";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export interface OrderSourceStandard {
     path: "standard";
     listPrice: number;
@@ -320,14 +321,24 @@ export interface AppliedOrderDiscount {
     scope?: "admin" | "seller";
     storeId?: string;
 }
+/**
+ * `OrderDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type OrderPlain = Plaintext<OrderDocument>;
 export interface OrderDocument extends BaseDocument {
     /** Word-prefix search tokens. Derived on write; never fed by a PII field. */
     searchTxt?: string[];
     productId: string;
     productTitle: string;
     userId: string;
-    userName: string;
-    userEmail: string;
+    userName: Encrypted<string>;
+    userEmail: Encrypted<string>;
     storeId?: string;
     storeName?: string;
     items?: OrderDocumentItem[];
@@ -778,9 +789,9 @@ export declare const ORDER_UPDATABLE_FIELDS: readonly ["notes", "shippingAddress
  * which is every single write — and exhaust the FIFO cap within days.
  */
 export declare const ORDER_TRACKED_FIELDS: readonly ["status", "paymentStatus", "paymentReviewOutcome", "trackingNumber", "cancellationReason"];
-export type OrderCreateInput = Omit<OrderDocument, "id" | "createdAt" | "updatedAt" | "orderDate">;
+export type OrderCreateInput = Omit<OrderPlain, "id" | "createdAt" | "updatedAt" | "orderDate">;
 export type OrderUpdateInput = Partial<Pick<OrderDocument, (typeof ORDER_UPDATABLE_FIELDS)[number]>>;
-export type OrderAdminUpdateInput = Partial<Omit<OrderDocument, "id" | "createdAt">>;
+export type OrderAdminUpdateInput = Partial<Omit<OrderPlain, "id" | "createdAt">>;
 export declare const orderQueryHelpers: {
     readonly byUser: (userId: string) => readonly ["userId", "==", string];
     readonly byStore: (storeId: string) => readonly ["storeId", "==", string];

package/dist/features/orders/schemas/index.d.ts

@@ -59,10 +59,10 @@ export declare const emiInstallmentSchema: z.ZodObject<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
     transactionId?: string | undefined;
+    proofUrl?: string | undefined;
     paidAt?: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
-    proofUrl?: string | undefined;
     reminderSentAt?: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -74,10 +74,10 @@ export declare const emiInstallmentSchema: z.ZodObject<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
     transactionId?: string | undefined;
+    proofUrl?: string | undefined;
     paidAt?: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
-    proofUrl?: string | undefined;
     reminderSentAt?: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -380,10 +380,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -395,10 +395,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -640,10 +640,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectOutputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -788,10 +788,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough">;
         transactionId?: string | undefined;
+        proofUrl?: string | undefined;
         paidAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
-        proofUrl?: string | undefined;
         reminderSentAt?: string | Date | z.objectInputType<{
             toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -1041,15 +1041,15 @@ export declare const orderListParamsSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     sort?: string | undefined;
     page?: number | undefined;
-    perPage?: number | undefined;
     userId?: string | undefined;
     paymentStatus?: string | undefined;
+    perPage?: number | undefined;
     orderStatus?: "pending" | "delivered" | "confirmed" | "shipped" | "processing" | "return_requested" | "cancelled" | "refunded" | "returned" | undefined;
 }, {
     sort?: string | undefined;
     page?: number | undefined;
-    perPage?: number | undefined;
     userId?: string | undefined;
     paymentStatus?: string | undefined;
+    perPage?: number | undefined;
     orderStatus?: "pending" | "delivered" | "confirmed" | "shipped" | "processing" | "return_requested" | "cancelled" | "refunded" | "returned" | undefined;
 }>;

package/dist/features/orders/types/index.d.ts

@@ -312,7 +312,7 @@ export interface OrderListResponse {
     items: Order[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
     totalPages: number;
 }
 export interface OrderListParams {
@@ -321,5 +321,5 @@ export interface OrderListParams {
     paymentStatus?: PaymentStatus;
     sort?: string;
     page?: number;
-    perPage?: number;
+    pageSize?: number;
 }

package/dist/features/parts/components/PartDetailPageView.d.ts

@@ -41,8 +41,21 @@ export interface PartDetailPageViewProps {
     listingsTruncated?: boolean;
     /** Where "see all listings" goes — a real search, not a fabricated filter. */
     allListingsHref: string;
+    /**
+     * Listings naming THIS exact glossary entry, via `partGlossaryId` — spares
+     * and any other individually-sold component carrying it.
+     *
+     * 🛑 A SEPARATE section from `listings` above, not a narrower version of it.
+     * `listings` is a fuzzy name search across the GENERAL catalogue
+     * (`GENERIC_PRODUCT_LISTING_TYPES`), which `spares` is deliberately excluded
+     * from (`inGeneralCatalogue: false`) — so a spare of this exact part could
+     * never appear there no matter how precisely it was titled. This section is
+     * the one place that gap is closed.
+     */
+    exactListings?: readonly PartListingRow[];
+    exactListingsTruncated?: boolean;
     /** A model's own page, when the composition resolved to a category. */
     hrefForModel: (categoryId: string) => string;
     hrefForClassification: (slot: string) => string;
 }
-export declare function PartDetailPageView({ part, usedBy, listings, listingsTruncated, allListingsHref, hrefForModel, hrefForClassification, }: PartDetailPageViewProps): React.JSX.Element;
+export declare function PartDetailPageView({ part, usedBy, listings, listingsTruncated, allListingsHref, exactListings, exactListingsTruncated, hrefForModel, hrefForClassification, }: PartDetailPageViewProps): React.JSX.Element;

package/dist/features/parts/components/PartDetailPageView.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Section, Container, Stack, Row, Div, Heading, Text, Span, TextLink, Badge, } from "../../../ui/index.js";
 import { PART_SLOT_LABEL, } from "../schemas/firestore.js";
-export function PartDetailPageView({ part, usedBy, listings, listingsTruncated, allListingsHref, hrefForModel, hrefForClassification, }) {
+export function PartDetailPageView({ part, usedBy, listings, listingsTruncated, allListingsHref, exactListings = [], exactListingsTruncated, hrefForModel, hrefForClassification, }) {
     const classification = PART_SLOT_LABEL[part.slot] ?? part.classification ?? part.slot;
     /*
      * 🛑 Only 23 of 753 parts carry a code, and that is a fact about the sources
@@ -16,5 +16,5 @@ export function PartDetailPageView({ part, usedBy, listings, listingsTruncated,
                                                 /* 49 of 259 compositions did not join to a category.
                                                    A link to a page that does not exist is worse than
                                                    plain text, so the name renders unlinked. */
-                                                _jsx(Text, { color: "primary", children: m.name })), m.system && (_jsxs(Span, { size: "xs", color: "muted", children: [" ", "\u00B7 ", m.system] }))] }), m.productCode && (_jsx(Text, { size: "xs", color: "faint", className: "flex-shrink-0", children: m.productCode }))] }, m.id))) }))] }), _jsxs(Stack, { gap: "sm", className: "min-w-0", children: [_jsxs(Row, { justify: "between", align: "center", wrap: true, gap: "sm", className: "min-w-0", children: [_jsxs(Heading, { level: 2, size: "lg", children: ["Listings", listingsTruncated && (_jsxs(Span, { size: "sm", color: "muted", children: [" ", "(", listings.length, "+)"] }))] }), listings.length > 0 && (_jsx(TextLink, { href: allListingsHref, children: "See all listings \u2192" }))] }), listings.length === 0 ? (_jsxs(Stack, { gap: "xs", className: "min-w-0", children: [_jsx(Text, { color: "muted", size: "sm", children: "Nobody is selling this part right now." }), _jsx(TextLink, { href: allListingsHref, children: "Search the catalogue \u2192" })] })) : (_jsx(Stack, { gap: "xs", className: "min-w-0", children: listings.map((l) => (_jsxs(Div, { surface: "card", padding: "sm", rounded: "md", border: "subtle", className: "min-w-0", children: [_jsx(TextLink, { href: l.href, children: l.title }), l.condition && (_jsx(Text, { size: "xs", color: "muted", children: l.condition }))] }, l.id))) }))] }), part.source && (_jsxs(Text, { size: "xs", color: "faint", children: ["Source: ", part.source] }))] }) }) }));
+                                                _jsx(Text, { color: "primary", children: m.name })), m.system && (_jsxs(Span, { size: "xs", color: "muted", children: [" ", "\u00B7 ", m.system] }))] }), m.productCode && (_jsx(Text, { size: "xs", color: "faint", className: "flex-shrink-0", children: m.productCode }))] }, m.id))) }))] }), exactListings.length > 0 && (_jsxs(Stack, { gap: "sm", className: "min-w-0", children: [_jsxs(Heading, { level: 2, size: "lg", children: ["Buy this part", exactListingsTruncated && (_jsxs(Span, { size: "sm", color: "muted", children: [" ", "(", exactListings.length, "+)"] }))] }), _jsx(Stack, { gap: "xs", className: "min-w-0", children: exactListings.map((l) => (_jsxs(Div, { surface: "card", padding: "sm", rounded: "md", border: "subtle", className: "min-w-0", children: [_jsx(TextLink, { href: l.href, children: l.title }), l.condition && (_jsx(Text, { size: "xs", color: "muted", children: l.condition }))] }, l.id))) })] })), _jsxs(Stack, { gap: "sm", className: "min-w-0", children: [_jsxs(Row, { justify: "between", align: "center", wrap: true, gap: "sm", className: "min-w-0", children: [_jsxs(Heading, { level: 2, size: "lg", children: ["Listings", listingsTruncated && (_jsxs(Span, { size: "sm", color: "muted", children: [" ", "(", listings.length, "+)"] }))] }), listings.length > 0 && (_jsx(TextLink, { href: allListingsHref, children: "See all listings \u2192" }))] }), listings.length === 0 ? (_jsxs(Stack, { gap: "xs", className: "min-w-0", children: [_jsx(Text, { color: "muted", size: "sm", children: "Nobody is selling this part right now." }), _jsx(TextLink, { href: allListingsHref, children: "Search the catalogue \u2192" })] })) : (_jsx(Stack, { gap: "xs", className: "min-w-0", children: listings.map((l) => (_jsxs(Div, { surface: "card", padding: "sm", rounded: "md", border: "subtle", className: "min-w-0", children: [_jsx(TextLink, { href: l.href, children: l.title }), l.condition && (_jsx(Text, { size: "xs", color: "muted", children: l.condition }))] }, l.id))) }))] }), part.source && (_jsxs(Text, { size: "xs", color: "faint", children: ["Source: ", part.source] }))] }) }) }));
 }

package/dist/features/parts/components/PartsIndexPageView.d.ts

@@ -1,5 +1,5 @@
 /**
- * D12 — the parts database index, and one classification's listing.
+ * D12 — the Beyblade parts gallery index, and one classification's listing.
  *
  * ── 🛑 THE INDEX COSTS ZERO FIRESTORE READS ────────────────────────────────
  *
@@ -20,8 +20,17 @@ import React from "react";
 import { type PartGlossaryDocument, type PartSlot } from "../schemas/firestore";
 export interface PartsIndexPageViewProps {
     hrefForClassification: (slot: string) => string;
+    /**
+     * The search box, as a SLOT.
+     *
+     * 🛑 Not rendered directly, because this view is a Server Component and
+     * the box is a Client Component that fetches. Keeping it a slot also keeps
+     * the page's "ZERO Firestore reads" property literally true — the box
+     * reads a CDN object, never Firestore, and the index page stays static.
+     */
+    renderSearch?: () => React.ReactNode;
 }
-export declare function PartsIndexPageView({ hrefForClassification }: PartsIndexPageViewProps): React.JSX.Element;
+export declare function PartsIndexPageView({ hrefForClassification, renderSearch, }: PartsIndexPageViewProps): React.JSX.Element;
 export interface PartClassificationPageViewProps {
     slot: PartSlot;
     parts: readonly PartGlossaryDocument[];

package/dist/features/parts/components/PartsIndexPageView.js

@@ -1,8 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Section, Container, Stack, Row, Div, Grid, Heading, Text, Span, TextLink, Badge, } from "../../../ui/index.js";
 import { ALL_PART_SLOTS, PART_SLOT_LABEL, } from "../schemas/firestore.js";
-export function PartsIndexPageView({ hrefForClassification }) {
-    return (_jsx(Section, { padding: "y-lg", children: _jsx(Container, { size: "lg", children: _jsxs(Stack, { gap: "lg", className: "min-w-0", children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, children: "Parts database" }), _jsxs(Text, { color: "muted", children: ["Every component we have a record of, by what it is. A code like", " ", _jsx(Span, { weight: "semibold", children: "RF" }), " or ", _jsx(Span, { weight: "semibold", children: "105" }), " means different things in different generations, so parts are grouped by their classification rather than by code."] })] }), _jsx(Grid, { cols: "navTiles", gap: "sm", className: "min-w-0", children: ALL_PART_SLOTS.map((slot) => (_jsx(Div, { surface: "card", padding: "sm", rounded: "md", border: "subtle", className: "min-w-0", children: _jsx(TextLink, { href: hrefForClassification(slot), children: PART_SLOT_LABEL[slot] }) }, slot))) })] }) }) }));
+export function PartsIndexPageView({ hrefForClassification, renderSearch, }) {
+    return (_jsx(Section, { padding: "y-lg", children: _jsx(Container, { size: "lg", children: _jsxs(Stack, { gap: "lg", className: "min-w-0", children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, children: "Beyblade parts gallery" }), _jsxs(Text, { color: "muted", children: ["Every component we have a record of, by what it is. A code like", " ", _jsx(Span, { weight: "semibold", children: "RF" }), " or ", _jsx(Span, { weight: "semibold", children: "105" }), " means different things in different generations, so parts are grouped by their classification rather than by code."] })] }), renderSearch?.(), _jsx(Grid, { cols: "navTiles", gap: "sm", className: "min-w-0", children: ALL_PART_SLOTS.map((slot) => (_jsx(Div, { surface: "card", padding: "sm", rounded: "md", border: "subtle", className: "min-w-0", children: _jsx(TextLink, { href: hrefForClassification(slot), children: PART_SLOT_LABEL[slot] }) }, slot))) })] }) }) }));
 }
 /** `performance-tip--rf` → `rf`. The id's tail IS the URL segment. */
 function tailOf(partId) {

package/dist/features/parts/components/PartsSearchBox.d.ts

@@ -0,0 +1,9 @@
+import React from "react";
+export interface PartsSearchBoxProps {
+    /** `siteSettings.search?.indexEnabled`. Read as `!== false`. */
+    indexEnabled?: boolean;
+    placeholder?: string;
+    /** Rows shown. A part search is a lookup, not a browse. */
+    limit?: number;
+}
+export declare function PartsSearchBox({ indexEnabled, placeholder, limit, }: PartsSearchBoxProps): React.JSX.Element;