@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/features/payments/repository/payout.repository.js

@@ -4,10 +4,11 @@
  * Data access layer for payout documents in Firestore.
  * Handles seller payout requests and admin payout processing.
  */
+import { buildTokensIndex } from "../../../security/blind-index-tokens.js";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase/index.js";
 import { PAYOUT_COLLECTION, PAYOUT_FIELDS, PAYOUT_TRACKED_FIELDS, createPayoutId } from "../schemas/index.js";
 import { withHistory } from "../../../_internal/shared/history/index.js";
-import { decryptPiiFields, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, encryptPayoutBankAccount, decryptPayoutBankAccount, } from "../../../security/index.js";
+import { maskPii, revealPii, PAYOUT_PII_FIELDS, PAYOUT_PII_INDEX_MAP, } from "../../../security/index.js";
 export class PayoutRepository extends BaseRepository {
     constructor() {
         super(PAYOUT_COLLECTION);
@@ -26,12 +27,68 @@ export class PayoutRepository extends BaseRepository {
         this.piiIndexMap = PAYOUT_PII_INDEX_MAP;
     }
     /** Decrypt PII fields on a payout document after Firestore read */
-    decryptPayout(doc) {
-        const decrypted = decryptPiiFields(doc, [...PAYOUT_PII_FIELDS]);
-        if (decrypted.bankAccount) {
-            decrypted.bankAccount = decryptPayoutBankAccount(decrypted.bankAccount);
+    /*
+     * 🛑 `mapDoc` no longer decrypts — reads return what Firestore holds.
+     *
+     * `bankAccount` is handled here rather than by `revealPii`, because it is
+     * encrypted by its OWN scheme (`decryptPayoutBankAccount`) and not by the
+     * `PAYOUT_PII_FIELDS` path list. A named accessor that silently skipped it
+     * would hand a caller an account number it could not read, which is worse
+     * than refusing: the value looks present.
+     */
+    /**
+     * Plaintext PII. **Opt-in and named** — for the payout run that has to
+     * actually pay someone, and for the remittance email.
+     */
+    revealPayout(doc) {
+        // `bankAccount` needs no unwrap: its four members are masked or public
+        // bank identifiers, never encrypted. See the tombstone in pii-encrypt.ts.
+        return revealPii(doc, PAYOUT_PII_FIELDS);
+    }
+    /** As `revealPayout`, for a list read. */
+    revealPayouts(docs) {
+        return docs.map((d) => this.revealPayout(d));
+    }
+    /**
+     * Masked PII — **the default for the admin and seller payout lists**, which
+     * need to identify a payee rather than pay them.
+     *
+     * `bankAccount.accountHolderName` is masked too — it is a person's name, and
+     * a payout list only needs to identify the payee. The other three members
+     * (`accountNumberMasked`, `ifscCode`, `bankName`) are already non-revealing,
+     * so they pass through: masking a bank name would make the row useless
+     * without protecting anything.
+     */
+    maskedPayout(doc) {
+        const masked = maskPii(doc, PAYOUT_PII_FIELDS);
+        if (masked.bankAccount) {
+            masked.bankAccount = maskPii(masked.bankAccount, ["accountHolderName"]);
         }
-        return decrypted;
+        return masked;
+    }
+    /** As `maskedPayout`, for a list read. */
+    maskedPayouts(docs) {
+        return docs.map((d) => this.maskedPayout(d));
+    }
+    /**
+     * Admin search by seller name/email, without decryption.
+     *
+     * 🛑 THIS IS THE ONE THAT MATTERS FOR THE TESTER HARNESS. `payouts` is
+     * SEED_TRANSACTIONAL: it cascades on `storeId` whenever its store is
+     * wiped, then gets RE-SEEDED from `appkit/src/seed/payouts-seed-data.ts`.
+     * The seed file has no `sellerTokensIndex` field — only this hook produces
+     * one — so a one-shot backfill script would have been silently undone by
+     * the very next tester run. Routing through `applyWriteHooks` means the
+     * reseed writes through `createWithId`, which calls this hook, which
+     * regenerates the index — so the field is never actually "missing after a
+     * wipe", because the wipe is always followed by the write that restores it.
+     */
+    buildTokensIndexFor(data) {
+        const sellerName = typeof data.sellerName === "string" ? data.sellerName : undefined;
+        const sellerEmail = typeof data.sellerEmail === "string" ? data.sellerEmail : undefined;
+        if (!sellerName && !sellerEmail)
+            return null;
+        return { sellerTokensIndex: buildTokensIndex(sellerName, sellerEmail) };
     }
     /**
      * The base hook, plus the nested objects it cannot see.
@@ -41,24 +98,28 @@ export class PayoutRepository extends BaseRepository {
      * encryption path with one extra step on top, rather than two parallel paths
      * that have to agree — which is what the hand-rolled override was.
      */
-    applyWriteHooks(data) {
-        const out = super.applyWriteHooks(data);
-        const access = out;
-        if (access.bankAccount)
-            access.bankAccount = encryptPayoutBankAccount(access.bankAccount);
-        return out;
-    }
+    /*
+     * No `bankAccount` hook any more. It called `encryptPayoutBankAccount`,
+     * which was `encryptPiiFields(bank, [])` — a no-op — and
+     * `PayoutBankAccount` carries no secret field to encrypt. See the tombstone
+     * in `security/pii-encrypt.ts`.
+     */
     /** Override mapDoc to auto-decrypt PII on every Firestore read */
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return this.decryptPayout(raw);
-    }
     /**
      * Create a new payout request
      */
-    async create(input) {
+    /*
+     * 🛑 NOT an `override`. It returns the plaintext it was handed (no
+     * read-after-write, which would cost a Firestore read per payout), and
+     * `PayoutPlain` is not assignable to the base's `Promise<T>` — correctly,
+     * because the two genuinely differ. The declaration used to say
+     * `PayoutDocument` directly above a line commented "return plaintext to
+     * caller".
+     */
+    async createPayout(input) {
         const now = new Date();
         const id = createPayoutId({ sellerName: input.sellerName, date: now });
+        // Plain in, ciphertext out — the write hook encrypts below.
         const data = {
             ...input,
             status: "pending",
@@ -72,7 +133,7 @@ export class PayoutRepository extends BaseRepository {
             .collection(this.collection)
             .doc(id)
             .set(prepareForFirestore(encrypted));
-        return { id, ...data }; // return plaintext to caller
+        return { id, ...data };
     }
     /** Override base update to preserve encryption/indexing for changed PII fields. */
     async update(payoutId, data) {
@@ -88,7 +149,7 @@ export class PayoutRepository extends BaseRepository {
             .where(PAYOUT_FIELDS.STORE_ID, "==", storeId)
             .orderBy(PAYOUT_FIELDS.CREATED_AT, "desc")
             .get();
-        return snapshot.docs.map((doc) => this.decryptPayout({
+        return snapshot.docs.map((doc) => ({
             id: doc.id,
             ...doc.data(),
         }));
@@ -103,7 +164,7 @@ export class PayoutRepository extends BaseRepository {
             .where(PAYOUT_FIELDS.STATUS, "==", status)
             .orderBy(PAYOUT_FIELDS.CREATED_AT, "desc")
             .get();
-        return snapshot.docs.map((doc) => this.decryptPayout({
+        return snapshot.docs.map((doc) => ({
             id: doc.id,
             ...doc.data(),
         }));
@@ -197,7 +258,7 @@ export class PayoutRepository extends BaseRepository {
             .get();
         if (snapshot.empty)
             return null;
-        return this.decryptPayout({ id: snapshot.docs[0].id, ...snapshot.docs[0].data() });
+        return { id: snapshot.docs[0].id, ...snapshot.docs[0].data() };
     }
     /**
      * Atomically append a refund deduction and recalculate netAmount.
@@ -227,7 +288,7 @@ export class PayoutRepository extends BaseRepository {
             });
             return { ...doc, refundDeductions: newDeductions, netAmount, updatedAt: new Date() };
         });
-        return this.decryptPayout(updated);
+        return (updated);
     }
     /**
      * Paginated, Firestore-native payout list (admin use).

package/dist/features/payments/repository/saved-payment-methods.repository.d.ts

@@ -8,15 +8,26 @@
  * to clients. `identifierHash` is unencrypted SHA-256 for cross-account
  * dedup queries. `displayLabel` is pre-masked and safe to display.
  */
-import { BaseRepository, type DocumentSnapshot } from "../../../providers/db-firebase";
-import { type SavedPaymentMethodBanStatus, type SavedPaymentMethodCreateInput, type SavedPaymentMethodDocument } from "../schemas/saved-methods-firestore";
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type SavedPaymentMethodBanStatus, type SavedPaymentMethodCreateInput, type SavedPaymentMethodDocument, type SavedPaymentMethodPlain } from "../schemas/saved-methods-firestore";
 export declare class SavedPaymentMethodsRepository extends BaseRepository<SavedPaymentMethodDocument> {
     constructor();
-    private decrypt;
     private encrypt;
-    protected mapDoc<D = SavedPaymentMethodDocument>(snap: DocumentSnapshot): D;
-    createWithId(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
-    update(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealMethod(doc: SavedPaymentMethodDocument): SavedPaymentMethodPlain;
+    /** As `revealMethod`, for a list read. */
+    revealMethods(docs: readonly SavedPaymentMethodDocument[]): SavedPaymentMethodPlain[];
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedMethod(doc: SavedPaymentMethodDocument): SavedPaymentMethodPlain;
+    /** As `maskedMethod`, for a list read. */
+    maskedMethods(docs: readonly SavedPaymentMethodDocument[]): SavedPaymentMethodPlain[];
+    createWithId(id: string, data: Partial<SavedPaymentMethodPlain>): Promise<SavedPaymentMethodDocument>;
+    update(id: string, data: Partial<SavedPaymentMethodPlain>): Promise<SavedPaymentMethodDocument>;
     /** List all saved methods for a user. Never returns raw `identifier` — only `displayLabel`. */
     listByUser(userId: string): Promise<SavedPaymentMethodDocument[]>;
     /**

package/dist/features/payments/repository/saved-payment-methods.repository.js

@@ -13,7 +13,8 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { serverLogger } from "../../../monitoring/index.js";
 import { BaseRepository, prepareForFirestore, } from "../../../providers/db-firebase/index.js";
-import { PAYMENT_METHOD_PII_FIELDS, decryptPiiFields, encryptPiiFields, } from "../../../security/index.js";
+import { PAYMENT_METHOD_PII_FIELDS, encryptPiiFields, maskPii, revealPii, } from "../../../security/index.js";
+import { asEncrypted } from "../../../security/encrypted.js";
 import { SAVED_PAYMENT_METHOD_FIELDS, SAVED_PAYMENT_METHODS_COLLECTION, } from "../schemas/saved-methods-firestore.js";
 function normaliseIdentifier(s) {
     return s.toLowerCase().replace(/\s+/g, "").trim();
@@ -27,19 +28,53 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
     constructor() {
         super(SAVED_PAYMENT_METHODS_COLLECTION);
     }
-    decrypt(doc) {
-        return decryptPiiFields(doc, [...PAYMENT_METHOD_PII_FIELDS]);
-    }
     encrypt(data) {
         return encryptPiiFields(data, [...PAYMENT_METHOD_PII_FIELDS]);
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return this.decrypt(raw);
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `SavedPaymentMethodDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealMethod(doc) {
+        return revealPii(doc, PAYMENT_METHOD_PII_FIELDS);
+    }
+    /** As `revealMethod`, for a list read. */
+    revealMethods(docs) {
+        return docs.map((d) => this.revealMethod(d));
     }
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedMethod(doc) {
+        return maskPii(doc, PAYMENT_METHOD_PII_FIELDS);
+    }
+    /** As `maskedMethod`, for a list read. */
+    maskedMethods(docs) {
+        return docs.map((d) => this.maskedMethod(d));
+    }
+    /*
+     * Takes PLAINTEXT, like the base it overrides — this method is what
+     * encrypts, so demanding ciphertext from callers inverted its own contract.
+     */
     async createWithId(id, data) {
         return super.createWithId(id, this.encrypt(data));
     }
+    /*
+     * Takes PLAINTEXT, like the base it overrides — this method is what
+     * encrypts, so demanding ciphertext from callers inverted its own contract.
+     */
     async update(id, data) {
         return super.update(id, this.encrypt(data));
     }
@@ -52,7 +87,18 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => {
                 const doc = this.mapDoc(d);
-                doc.identifier = ""; // never expose decrypted PII to caller
+                /*
+                 * Dropped, not decrypted-then-dropped.
+                 *
+                 * This read "never expose decrypted PII to caller" — true, because
+                 * `mapDoc` decrypted every identifier and this threw it away
+                 * immediately. The decryption was pure waste plus a window in which
+                 * plaintext existed. `mapDoc` no longer decrypts, so what arrives here
+                 * is ciphertext; the field is still blanked because these list reads
+                 * are display-only, and ciphertext a caller cannot use is ciphertext
+                 * it should not receive.
+                 */
+                doc.identifier = asEncrypted("");
                 return doc;
             });
         }
@@ -81,6 +127,8 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 return this.update(docId, { lastUsedAt: now, displayLabel: input.displayLabel });
             }
             const docRef = this.getCollection().doc();
+            // PLAINTEXT in, ciphertext out: `this.encrypt(data)` below is what makes
+            // the document type true, so the payload is typed as the plain shape.
             const data = {
                 userId,
                 type: input.type,
@@ -97,7 +145,7 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
             const refetched = await this.findById(docRef.id);
             if (!refetched)
                 throw new DatabaseError("Payment method not readable after create");
-            refetched.identifier = "";
+            refetched.identifier = asEncrypted(""); // display-only — see listByUser
             return refetched;
         }
         catch (error) {
@@ -113,7 +161,7 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => {
                 const doc = this.mapDoc(d);
-                doc.identifier = "";
+                doc.identifier = asEncrypted(""); // display-only — see listByUser
                 return doc;
             });
         }
@@ -190,7 +238,7 @@ export class SavedPaymentMethodsRepository extends BaseRepository {
                 .get();
             return snap.docs.map((d) => {
                 const doc = this.mapDoc(d);
-                doc.identifier = "";
+                doc.identifier = asEncrypted(""); // display-only — see listByUser
                 return doc;
             });
         }

package/dist/features/payments/schemas/firestore.d.ts

@@ -4,6 +4,7 @@
 import { type GeneratePayoutIdInput } from "../../../utils/id-generators";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export interface PayoutBankAccount {
     accountHolderName: string;
     accountNumberMasked: string;
@@ -34,10 +35,20 @@ export declare const PayoutStatusValues: {
     readonly FAILED: "failed";
 };
 export type PayoutPaymentMethod = "bank_transfer" | "upi";
+/**
+ * `PayoutDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type PayoutPlain = Plaintext<PayoutDocument>;
 export interface PayoutDocument extends BaseDocument {
     storeId: string;
     sellerName: string;
-    sellerEmail: string;
+    sellerEmail: Encrypted<string>;
     amount: number;
     grossAmount: number;
     platformFee: number;
@@ -46,7 +57,7 @@ export interface PayoutDocument extends BaseDocument {
     status: PayoutStatus;
     paymentMethod: PayoutPaymentMethod;
     bankAccount?: PayoutBankAccount;
-    upiId?: string;
+    upiId?: Encrypted<string>;
     notes?: string;
     adminNote?: string;
     orderIds: string[];
@@ -119,7 +130,7 @@ export declare const PAYOUT_PUBLIC_FIELDS: readonly ["id", "storeId", "amount",
 export declare const PAYOUT_ADMIN_UPDATEABLE_FIELDS: readonly ["status", "adminNote", "processedAt", "transactionId"];
 /** The only field a seller may write on their own payout doc. */
 export declare const PAYOUT_SELLER_UPDATEABLE_FIELDS: readonly ["sellerReminderFlag"];
-export type PayoutCreateInput = Omit<PayoutDocument, "id" | "createdAt" | "updatedAt" | "status" | "requestedAt">;
+export type PayoutCreateInput = Omit<PayoutPlain, "id" | "createdAt" | "updatedAt" | "status" | "requestedAt">;
 export type PayoutUpdateInput = Partial<Pick<PayoutDocument, (typeof PAYOUT_ADMIN_UPDATEABLE_FIELDS)[number]>>;
 export declare const payoutQueryHelpers: {
     readonly byStore: (storeId: string) => readonly ["storeId", "==", string];

package/dist/features/payments/schemas/saved-methods-firestore.d.ts

@@ -10,13 +10,24 @@
  * `displayLabel` is a pre-masked string and never contains full PII.
  */
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export type SavedPaymentMethodType = "upi" | "card" | "bank_account" | "wallet";
 export type SavedPaymentMethodBanStatus = "banned" | "suspicious" | "unban_requested";
+/**
+ * `SavedPaymentMethodDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type SavedPaymentMethodPlain = Plaintext<SavedPaymentMethodDocument>;
 export interface SavedPaymentMethodDocument extends BaseDocument {
     userId: string;
     type: SavedPaymentMethodType;
     /** Full UPI VPA / card PAN / account number — ENCRYPTED at rest. */
-    identifier: string;
+    identifier: Encrypted<string>;
     /** Pre-masked display string, never contains full PII. e.g. "9876...@paytm", "XXXX 4321 (HDFC)" */
     displayLabel: string;
     /** SHA-256(type|normalised(identifier)) — unencrypted; enables cross-account dedup without decrypting. */

package/dist/features/pre-orders/api/[slug]/route.js

@@ -23,7 +23,7 @@ export async function GET(request, { params }) {
         const repo = db.getRepository("preorders");
         const result = await repo.findAll({
             filters: `slug==${slug}`,
-            perPage: 1,
+            pageSize: 1,
         });
         if (!result.data[0]) {
             return NextResponse.json({ success: false, error: "Pre-order not found" }, { status: 404 });

package/dist/features/pre-orders/api/admin/route.js

@@ -33,7 +33,7 @@ export async function GET(request) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/pre-orders/api/route.js

@@ -32,7 +32,7 @@ export async function GET(request) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/pre-orders/components/PreOrderDetailPageView.js

@@ -8,7 +8,7 @@ const __P = {
 const __O = {
     hidden: "overflow-hidden",
 };
-const CLS_BREADCRUMB_LINK = "hover:text-primary-600 transition-colors";
+const CLS_BREADCRUMB_LINK = "hover:text-primary-600 dark:hover:text-primary-400 transition-colors";
 const CLS_PREORDER_BADGE = "inline-block rounded-full bg-indigo-100 dark:bg-indigo-900/30 px-[var(--appkit-space-2-5)] py-[var(--appkit-space-0-5)] text-indigo-700 dark:text-indigo-300";
 const CLS_STATUS_BADGE = "inline-block rounded-full bg-warning-surface dark:bg-warning-surface px-[var(--appkit-space-2-5)] py-[var(--appkit-space-0-5)] text-warning dark:text-warning";
 import { ROUTES } from "../../../next/routing/route-map.js";
@@ -17,11 +17,11 @@ import { formatCurrency, roundRupees } from "../../../utils/number.formatter.js"
 import { normalizeRichTextHtml } from "../../../utils/string.formatter.js";
 import { safeDisplayName } from "../../../security/index.js";
 import { ProgressBarFill } from "../../../ui/components/ProgressBarFill.js";
-import { Button, Container, Div, GatedPrice, PricesOnly, Heading, Main, Nav, RichText, Row, Section, Span, Stack, Text, Ul, Li, Dl, Dt, Dd, } from "../../../ui/index.js";
+import { Button, Container, Div, GatedPrice, PricesOnly, Heading, Main, Nav, RichText, Row, Section, Span, Stack, Text, Ul, Li, SpecTable, } from "../../../ui/index.js";
 import { PreOrderDetailView } from "../../products/components/PreOrderDetailView.js";
 import { PreOrderBottomActions } from "./PreOrderBottomActions.js";
 import { ProductTabsShell } from "../../products/components/ProductTabsShell.js";
-import { CustomSectionTabContent } from "../../products/components/CustomSectionTabContent.js";
+import { toCustomSectionTabs } from "../../products/components/CustomSectionTabContent.js";
 import { PreOrderActionsClient } from "./PreOrderActionsClient.js";
 import { ProductGalleryClient } from "../../products/components/ProductGalleryClient.js";
 import { ProductFeatureBadges } from "../../products/components/ProductFeatureBadges.js";
@@ -142,9 +142,6 @@ export async function PreOrderDetailPageView({ id, initialPreOrder, onReserveNow
     const specs = Array.isArray(p.specifications)
         ? p.specifications
         : [];
-    const customSections = Array.isArray(p.customSections)
-        ? p.customSections
-        : [];
     const descriptionHtml = toDescriptionHtml(p.description);
     const sublistingCategoryId = typeof p.sublistingCategoryId === "string" ? p.sublistingCategoryId : null;
     const groupId = typeof p.groupId === "string" ? p.groupId : null;
@@ -168,9 +165,5 @@ export async function PreOrderDetailPageView({ id, initialPreOrder, onReserveNow
                             ? () => (_jsx(SublistingCarouselSection, { sublistingCategoryId: sublistingCategoryId, currentListingId: String(product.id) }))
                             : undefined, renderGroupSection: groupId
                             ? () => (_jsx(ShowGroupSection, { groupId: groupId, currentSlug: String(p.slug ?? product.id), isParent: isGroupParent, groupTitle: groupTitle }))
-                            : undefined, renderTabs: () => (_jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(Dl, { divide: "subtle", rounded: "xl", border: "subtle", className: "overflow-hidden", children: specs.map((s, i) => (_jsxs(Row, { gap: "md", oddEven: "zebra", surface: "default", padding: "inline", children: [_jsx(Dt, { className: "w-36 flex-shrink-0", color: "primary", weight: "medium", children: s.name }), _jsxs(Dd, { className: "flex-1", color: "muted", children: [s.value, s.unit ? ` ${s.unit}` : ""] })] }, i))) })) : undefined, customTabs: customSections.map((s) => ({
-                                id: s.id,
-                                label: s.title,
-                                content: _jsx(CustomSectionTabContent, { section: s }),
-                            })) })), renderBuyBar: () => (_jsx(PreOrderBuyBarPanel, { reserveTarget: reserveTarget, reservedCount: reservedCount, progressPct: progressPct, productId: String(product.id), price: price, currency: currency, depositAmount: depositAmount, depositPercent: depositPercent, isCancellable: isCancellable, tags: tags, onReserveNow: onReserveNow })), renderRelated: () => (_jsxs(Stack, { gap: "xl", children: [_jsx(GroupedListingsCarousel, { groups: groups }), _jsx(RelatedItemsSection, { relatedItems: relatedItems, relatedByBrand: relatedByBrand, relatedByTags: relatedByTags, relatedByStore: relatedByStore, categoryLabel: categoryName || category || undefined, brandLabel: brand || undefined, storeLabel: storeName || undefined })] })) }), _jsx(PreOrderBottomActions, { price: price, currency: currency })] })] }));
+                            : undefined, renderTabs: () => (_jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(SpecTable, { rows: specs })) : undefined, customTabs: toCustomSectionTabs(p.customSections) })), renderBuyBar: () => (_jsx(PreOrderBuyBarPanel, { reserveTarget: reserveTarget, reservedCount: reservedCount, progressPct: progressPct, productId: String(product.id), price: price, currency: currency, depositAmount: depositAmount, depositPercent: depositPercent, isCancellable: isCancellable, tags: tags, onReserveNow: onReserveNow })), renderRelated: () => (_jsxs(Stack, { gap: "xl", children: [_jsx(GroupedListingsCarousel, { groups: groups }), _jsx(RelatedItemsSection, { relatedItems: relatedItems, relatedByBrand: relatedByBrand, relatedByTags: relatedByTags, relatedByStore: relatedByStore, categoryLabel: categoryName || category || undefined, brandLabel: brand || undefined, storeLabel: storeName || undefined })] })) }), _jsx(PreOrderBottomActions, { price: price, currency: currency })] })] }));
 }

package/dist/features/pre-orders/components/PreOrdersIndexListing.js

@@ -232,5 +232,5 @@ export function PreOrdersIndexListing({ initialData, categorySlug, brandName })
                 ] }), totalPages > 1 && (_jsx(StickyToolbar, { offset: "header+pagination", tone: "translucent", border: true, padding: "toolbar", children: _jsx(Row, { justify: "center", children: _jsx(Pagination, { currentPage: page, totalPages: totalPages, onPageChange: (p) => table.setPage(p) }) }) })), _jsx(Div, { padding: "y-lg", children: isLoading ? (_jsx(Grid, { cols: "cards", gap: "md", children: Array.from({ length: 10 }).map((_, i) => (_jsxs(Div, { className: `${__O.hidden} animate-pulse`, border: "subtle", rounded: "xl", children: [_jsx(Div, { className: "aspect-square", surface: "subtle" }), _jsxs(Stack, { className: `${__P.p3}`, gap: "sm", children: [_jsx(Div, { className: "h-3 w-3/4", surface: "subtle", rounded: "default" }), _jsx(Div, { className: "h-3 w-1/2", surface: "subtle", rounded: "default" }), _jsx(Div, { className: "h-4 w-1/3", surface: "subtle", rounded: "default" }), _jsx(Div, { className: "h-8", surface: "subtle", rounded: "default" })] })] }, i))) })) : preOrders.length === 0 ? (_jsx(Text, { paddingY: "3xl", color: "muted", size: "sm", align: "start", children: "No pre-orders found." })) : view === "list" ? (_jsx(Stack, { className: "divide-y divide-zinc-100 divide-[var(--appkit-color-border-subtle)]", border: "subtle", rounded: "xl", children: preOrders.map((product) => (_jsx(MarketplacePreorderCard, { product: product, variant: "list", hrefBuilder: (p) => String(ROUTES.PUBLIC.PRE_ORDER_DETAIL(p.id)), onAddToCart: handleAddToCart, wishlistActions: wishlistActions, selectable: selection.isSelecting, isSelected: selection.isSelected(product.id), onSelect: (id) => selection.toggle(id) }, product.id))) })) : (_jsx(Grid, { cols: "cards", gap: "md", children: preOrders.map((product) => (_jsx(MarketplacePreorderCard, { product: product, variant: "grid", hrefBuilder: (p) => String(ROUTES.PUBLIC.PRE_ORDER_DETAIL(p.id)), onAddToCart: handleAddToCart, wishlistActions: wishlistActions, selectable: selection.isSelecting, isSelected: selection.isSelected(product.id), onSelect: (id) => selection.toggle(id) }, product.id))) })) }), _jsx(CompareOverlay, { isOpen: compareIds.length > 0, productIds: compareIds, productType: "preorder", onClose: () => {
                     setCompareIds([]);
                     selection.clearSelection();
-                }, onRemove: (id) => setCompareIds((ids) => ids.filter((i) => i !== id)) }), _jsx(FilterDrawer, { open: filterOpen, onOpen: openFilters, onClose: () => setFilterOpen(false), onApply: applyFilters, onReset: onFilterClear, activeCount: filterActiveCount, hideTrigger: true, children: _jsx(PreOrderFilters, { table: pendingTable, currencyPrefix: "\u20B9", categoryOptions: categoryOptions, brandOptions: brandOptions }) }), _jsx(LoginRequiredModal, { isOpen: modalOpen, onClose: closeModal, message: modalMessage })] }));
+                }, onRemove: (id) => setCompareIds((ids) => ids.filter((i) => i !== id)), onAdd: (id) => setCompareIds((ids) => (ids.includes(id) ? ids : [...ids, id])) }), _jsx(FilterDrawer, { open: filterOpen, onOpen: openFilters, onClose: () => setFilterOpen(false), onApply: applyFilters, onReset: onFilterClear, activeCount: filterActiveCount, hideTrigger: true, children: _jsx(PreOrderFilters, { table: pendingTable, currencyPrefix: "\u20B9", categoryOptions: categoryOptions, brandOptions: brandOptions }) }), _jsx(LoginRequiredModal, { isOpen: modalOpen, onClose: closeModal, message: modalMessage })] }));
 }

package/dist/features/pre-orders/repository/pre-orders.repository.d.ts

@@ -5,9 +5,9 @@ export declare class PreOrdersRepository {
     constructor(repo: IRepository<PreOrderItem>);
     findAll(query?: SieveQuery): Promise<PagedResult<PreOrderItem>>;
     findById(id: string): Promise<PreOrderItem | null>;
-    findByCustomer(customerId: string, page?: number, perPage?: number): Promise<PagedResult<PreOrderItem>>;
-    findBySeller(sellerId: string, page?: number, perPage?: number): Promise<PagedResult<PreOrderItem>>;
-    findByStatus(status: PreOrderStatus, page?: number, perPage?: number): Promise<PagedResult<PreOrderItem>>;
+    findByCustomer(customerId: string, page?: number, pageSize?: number): Promise<PagedResult<PreOrderItem>>;
+    findBySeller(sellerId: string, page?: number, pageSize?: number): Promise<PagedResult<PreOrderItem>>;
+    findByStatus(status: PreOrderStatus, page?: number, pageSize?: number): Promise<PagedResult<PreOrderItem>>;
     create(data: Omit<PreOrderItem, "id" | "createdAt" | "updatedAt">): Promise<PreOrderItem>;
     updateStatus(id: string, status: PreOrderStatus, adminNote?: string): Promise<PreOrderItem>;
     delete(id: string): Promise<void>;

package/dist/features/pre-orders/repository/pre-orders.repository.js

@@ -8,28 +8,28 @@ export class PreOrdersRepository {
     async findById(id) {
         return this.repo.findById(id);
     }
-    async findByCustomer(customerId, page = 1, perPage = 20) {
+    async findByCustomer(customerId, page = 1, pageSize = 20) {
         return this.repo.findAll({
             filters: `customerId==${customerId}`,
             sort: "-createdAt",
             page,
-            perPage,
+            pageSize,
         });
     }
-    async findBySeller(sellerId, page = 1, perPage = 20) {
+    async findBySeller(sellerId, page = 1, pageSize = 20) {
         return this.repo.findAll({
             filters: `sellerId==${sellerId}`,
             sort: "-createdAt",
             page,
-            perPage,
+            pageSize,
         });
     }
-    async findByStatus(status, page = 1, perPage = 50) {
+    async findByStatus(status, page = 1, pageSize = 50) {
         return this.repo.findAll({
             filters: `status==${status}`,
             sort: "-createdAt",
             page,
-            perPage,
+            pageSize,
         });
     }
     async create(data) {

package/dist/features/price-index/components/PriceIndexToolView.d.ts

@@ -83,5 +83,7 @@ export interface PriceIndexToolViewProps {
     /** Seeded from `?q=` so a shared link reproduces the lookup. */
     initialQuery?: string;
     initialData?: PriceIndexToolResponse | null;
+    /** `siteSettings.search?.indexEnabled`. Read as `!== false`. */
+    searchIndexEnabled?: boolean;
 }
-export declare function PriceIndexToolView({ initialQuery, initialData }: PriceIndexToolViewProps): React.JSX.Element;
+export declare function PriceIndexToolView({ initialQuery, initialData, searchIndexEnabled, }: PriceIndexToolViewProps): React.JSX.Element;