@mohasinac/appkit 4.53.0 → 4.53.1

package/dist/_internal/server/features/search/scoped-sources.js

@@ -0,0 +1,252 @@
+/*
+ * WHY: A signed-in viewer should be able to find their own orders, offers
+ *      and drafts from the same box — without that box ever being able to
+ *      return somebody else's.
+ * WHAT: Tier 2. Viewer-scoped `SearchSource`s, built per request from the
+ *       session, plus the budget check.
+ *
+ * ## 🛑 Filtered SERVER-side, never in the browser
+ *
+ * The same rule `projectActionIndexForViewer` states for the action index.
+ * Every source below carries an OWNER CLAUSE in its `where`, so the query
+ * itself cannot return another viewer's rows — a client-side filter over a
+ * wider result is one rendering bug away from a disclosure, and the bug is
+ * invisible in review because the UI looks right.
+ *
+ * ## 🛑 A guest makes ZERO authenticated requests
+ *
+ * `scopedSourcesFor(null)` returns `[]`, and the route refuses before
+ * touching Firestore. This is not an optimisation: a signed-out visitor
+ * whose search fires an authenticated request has a session the page does
+ * not know about, and the only honest way to prove the gate works is for
+ * there to be no request at all.
+ *
+ * ## The read budget, which is why the split exists
+ *
+ *   guest    0 sources    0 docs    0 round trips
+ *   buyer    6            ~120      1 (one Promise.all)
+ *   seller   +5           ~220      1
+ *   admin    +5           ~320      1
+ *
+ * Against `SCOPED_SCAN_BUDGET` = 400. Scoped sources use `scanLimit: 20`
+ * rather than the 60 the public tier uses, because an owner clause has
+ * already collapsed the candidate set — a 60-doc window would be 40 reads
+ * spent proving there was nothing else.
+ *
+ * @tag domain:search
+ * @tag layer:server
+ * @tag pattern:none
+ * @tag access:server
+ * @tag consumers:/api/search/scoped
+ * @tag sideEffects:none
+ */
+import { ROUTES } from "../../../../next/routing/route-map.js";
+import { SCOPED_SCAN_BUDGET } from "./search-everything.js";
+/** Scoped sources read a narrow window; the owner clause did the work. */
+const SCOPED_SCAN = 20;
+const str = (v) => typeof v === "string" && v.length > 0 ? v : undefined;
+/**
+ * Every term must appear somewhere in the named fields.
+ *
+ * 🛑 AND, matching the push-down path's `plan.rest.every(...)`. An OR here
+ * would make the two modes disagree about what a two-word query means, on
+ * the same page, in adjacent groups.
+ *
+ * 🛑 Lower-cased comparison only — NOT `normalizeSearchText`. That
+ * normaliser exists to make the WRITE path and the token query agree; this
+ * path has no tokens, and running it here would strip punctuation out of a
+ * tracking number or an order id, which are exactly the strings someone
+ * pastes into a scoped search.
+ */
+function fieldsContain(fields) {
+    return (data, terms) => {
+        if (terms.length === 0)
+            return false;
+        const hay = fields
+            .map((f) => str(data[f]) ?? "")
+            .join(" ")
+            .toLowerCase();
+        return terms.every((t) => hay.includes(t.toLowerCase()));
+    };
+}
+/**
+ * The viewer's own records.
+ *
+ * 🛑 `mode: "bounded-memory"` for everything PII-bearing, and `search-txt`
+ * only where the collection genuinely carries tokens that are safe to have.
+ * `orders` is the interesting case: `buildOrderSearchTxt` already indexes
+ * productTitle / storeName / trackingNumber and already EXCLUDES the
+ * shipping address, so it keeps the push-down. `addresses` has no
+ * `searchTxt` and must never grow one.
+ */
+function selfSources(viewer) {
+    return [
+        {
+            key: "my-orders",
+            label: "Your orders",
+            collection: "orders",
+            // 🛑 `userId`, NOT `buyerId`. The field is `userId` and a query on
+            // `buyerId` returns ZERO while raising nothing — indistinguishable
+            // from "this buyer has no orders", which is a false-finding generator.
+            where: [["userId", viewer.uid]],
+            scanLimit: SCOPED_SCAN,
+            mode: "search-txt",
+            select: ["productTitle", "status", "trackingNumber"],
+            toHit: (id, d) => ({
+                id,
+                title: str(d.productTitle) ?? `Order ${id}`,
+                href: String(ROUTES.USER.ORDER_DETAIL(id)),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.USER.ORDERS),
+        },
+        {
+            key: "my-offers",
+            label: "Your offers",
+            collection: "offers",
+            where: [["buyerId", viewer.uid]],
+            scanLimit: SCOPED_SCAN,
+            mode: "bounded-memory",
+            orderBy: ["createdAt", "desc"],
+            select: ["productTitle", "status", "productSlug"],
+            matches: fieldsContain(["productTitle", "status"]),
+            toHit: (id, d) => ({
+                id,
+                title: str(d.productTitle) ?? "Offer",
+                href: String(ROUTES.USER.OFFERS),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.USER.OFFERS),
+        },
+        {
+            key: "my-catalogue",
+            label: "Your catalogue",
+            collection: "catalogueItems",
+            where: [["ownerId", viewer.uid]],
+            scanLimit: SCOPED_SCAN,
+            mode: "bounded-memory",
+            orderBy: ["createdAt", "desc"],
+            select: ["title", "listingStatus"],
+            matches: fieldsContain(["title"]),
+            toHit: (id, d) => ({
+                id,
+                title: str(d.title) ?? "Catalogue item",
+                href: String(ROUTES.USER.CATALOGUE),
+                detail: str(d.listingStatus),
+            }),
+            moreHref: () => String(ROUTES.USER.CATALOGUE),
+        },
+        {
+            /*
+             * 🛑 `bounded-memory`, and this is the source the mode exists for.
+             *
+             * `addresses` is PII — `fullName`, `phone`, `addressLine1` are all
+             * encrypted at rest and decrypted by the repository on read. It has
+             * no `searchTxt` and must never get one: a prefix-expanded plaintext
+             * token array over a person's name and street is precisely what
+             * § Searching PII refuses. The owner clause already bounds this to
+             * well under 25 rows, so an index would re-derive a bound we have
+             * while adding leak surface for nothing.
+             */
+            key: "my-addresses",
+            label: "Your addresses",
+            collection: "addresses",
+            where: [
+                ["ownerType", "user"],
+                ["ownerId", viewer.uid],
+            ],
+            scanLimit: SCOPED_SCAN,
+            mode: "bounded-memory",
+            select: ["label", "city", "state"],
+            // Only the non-sensitive half is matched AND projected. A label and a
+            // city are enough to pick an address out of a list of four; the name,
+            // phone and street line never leave the server.
+            matches: fieldsContain(["label", "city", "state"]),
+            toHit: (id, d) => ({
+                id,
+                title: str(d.label) ?? "Address",
+                href: String(ROUTES.USER.ADDRESSES),
+                detail: [str(d.city), str(d.state)].filter(Boolean).join(", ") || undefined,
+            }),
+            moreHref: () => String(ROUTES.USER.ADDRESSES),
+        },
+    ];
+}
+/** The viewer's store. Requires a resolved `storeId`, never a uid. */
+function sellerSources(viewer) {
+    if (!viewer.storeId)
+        return [];
+    const storeId = viewer.storeId;
+    return [
+        {
+            /*
+             * The seller's own listings INCLUDING drafts — which is the whole
+             * point, because a published one is already in the public artifact and
+             * the merge dedupes it away. What survives in this group is precisely
+             * "your drafts", and labelling it so is what makes the dedupe legible.
+             */
+            key: "my-listings",
+            label: "Your listings (incl. drafts)",
+            collection: "products",
+            where: [["storeId", storeId]],
+            scanLimit: SCOPED_SCAN,
+            mode: "search-txt",
+            select: ["title", "slug", "status"],
+            toHit: (id, d) => ({
+                id,
+                title: str(d.title) ?? "Listing",
+                href: String(ROUTES.STORE.PRODUCTS_EDIT(str(d.slug) ?? id)),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.STORE.PRODUCTS),
+        },
+        {
+            key: "store-orders",
+            label: "Orders in your store",
+            collection: "orders",
+            where: [["storeId", storeId]],
+            scanLimit: SCOPED_SCAN,
+            mode: "search-txt",
+            select: ["productTitle", "status", "trackingNumber"],
+            toHit: (id, d) => ({
+                id,
+                title: str(d.productTitle) ?? `Order ${id}`,
+                href: String(ROUTES.STORE.ORDER_DETAIL(id)),
+                detail: str(d.status),
+            }),
+            moreHref: () => String(ROUTES.STORE.ORDERS),
+        },
+    ];
+}
+/**
+ * Build the viewer's sources.
+ *
+ * 🛑 Returns `[]` for a guest, which is what makes "zero authenticated
+ * requests when signed out" structural rather than a caller's discipline.
+ */
+export function scopedSourcesFor(viewer) {
+    if (!viewer)
+        return [];
+    const sources = [...selfSources(viewer)];
+    if (viewer.isSeller || viewer.isAdmin)
+        sources.push(...sellerSources(viewer));
+    return sources;
+}
+/**
+ * Σ `scanLimit`, for the budget check.
+ *
+ * Exported so `audit-scoped-search-ownership` R4 can print the arithmetic
+ * rather than just a verdict: "over budget" without the per-source figures
+ * tells you nothing about which source to shrink.
+ */
+export function scopedScanTotal(sources) {
+    return sources.reduce((n, s) => n + (s.scanLimit ?? 60), 0);
+}
+export function assertWithinScopedBudget(sources) {
+    const total = scopedScanTotal(sources);
+    if (total <= SCOPED_SCAN_BUDGET)
+        return;
+    const breakdown = sources.map((s) => `${s.key}=${s.scanLimit ?? 60}`).join(" + ");
+    throw new Error(`Scoped search would read up to ${total} documents, over SCOPED_SCAN_BUDGET ` +
+        `(${SCOPED_SCAN_BUDGET}). ${breakdown} = ${total}.`);
+}

package/dist/_internal/server/features/search/search-everything.d.ts

@@ -43,7 +43,56 @@ export interface SearchSource {
     moreHref: (q: string) => string;
     /** Extra equality narrowing, e.g. `status == published`. */
     where?: ReadonlyArray<readonly [string, unknown]>;
+    /**
+     * The bounded window this source reads before the in-memory refine.
+     *
+     * Defaults to `SCAN` (60). Scoped sources pass 20: an owner clause
+     * (`userId == uid`) has already collapsed the candidate set, so a 60-doc
+     * window is 40 reads spent proving there was nothing else.
+     */
+    scanLimit?: number;
+    /**
+     * How this source FINDS rows. Discriminated so TypeScript forces every
+     * source to answer, which is what makes `audit-scoped-search-ownership`
+     * R2 checkable rather than advisory.
+     *
+     *   `search-txt`      the `array-contains` push-down. Requires the
+     *                     collection to carry `searchTxt`.
+     *   `bounded-memory`  read the owner's bounded window and filter in
+     *                     memory, with no token push-down at all.
+     *
+     * 🛑 A PII-bearing collection must be `bounded-memory`. `searchTxt` is
+     * plaintext, edge-n-gram-expanded and stored on the document — giving
+     * `addresses` a token push-down would write a prefix-expanded index over
+     * a person's name and street, which is the precise thing § Searching PII
+     * refuses (a 1-character prefix has 36 possible values; the frequency
+     * distribution unpicks from there). Decrypting a bounded owner-scoped
+     * window in memory re-derives a bound ownership already gives, and adds
+     * no leak surface.
+     */
+    mode?: "search-txt" | "bounded-memory";
+    /**
+     * For `bounded-memory`: does this row match? Receives the DECRYPTED
+     * document, so a repository that decrypts on read is the intended caller.
+     * Every term must match (AND), consistent with the push-down path.
+     */
+    matches?: (data: SearchDocData, terms: readonly string[]) => boolean;
+    /** Ordering for `bounded-memory`, since there is no token clause to sort by. */
+    orderBy?: readonly [string, "asc" | "desc"];
 }
+/**
+ * 🛑 The ceiling on what ONE viewer's scoped search may read.
+ *
+ * Σ `scanLimit` across the widest role, checked by
+ * `audit-scoped-search-ownership` R4 — which PRINTS THE ARITHMETIC on
+ * failure, because "the budget is exceeded" is useless without knowing by
+ * which source and how much.
+ *
+ * 400 against Rule #6's ~3-round-trip guidance is defensible because the
+ * sources run in ONE `Promise.all`: it is one round trip of fan-out, not
+ * twelve sequential ones. The number that matters is documents read.
+ */
+export declare const SCOPED_SCAN_BUDGET = 400;
 /** A projected Firestore document's fields. */
 export type SearchDocData = Record<string, FirestoreValue>;
 /** A projected document — the only shape this module reads. */
@@ -55,6 +104,14 @@ interface SearchQueryRef {
     where(field: string, op: string, value: unknown): SearchQueryRef;
     select(...fields: string[]): SearchQueryRef;
     limit(n: number): SearchQueryRef;
+    /**
+     * Only `bounded-memory` sources use this. The push-down path deliberately
+     * does not order: an `orderBy` beside an `array-contains` demands a
+     * composite index per source, and a missing one throws
+     * `FAILED_PRECONDITION` into the per-source catch, where it renders as an
+     * empty group — i.e. silently (Root Cause #59).
+     */
+    orderBy(field: string, direction: "asc" | "desc"): SearchQueryRef;
     get(): Promise<{
         docs: SearchDoc[];
     }>;

package/dist/_internal/server/features/search/search-everything.js

@@ -1,11 +1,21 @@
 /**
  * D2 Fix 4 — CROSS-RESOURCE search.
  *
- * 🛑 `/search` is a pure REDIRECT today: it maps each of 15
- * `SearchResourceType` values to a browse route and `redirect()`s, `noindex`.
- * So there is **no cross-resource search at all** — the dropdown picks which
- * single listing page to send you to, and a buyer searching "dranzer" cannot
- * see that we have a product, an auction, a blog post and an FAQ about it.
+ * 🛑 CORRECTED 2026-10-19 — this header asserted the opposite of the truth.
+ *
+ * It read: "`/search` is a pure REDIRECT today … there is no cross-resource
+ * search at all." That described the state this module was WRITTEN to fix,
+ * and it stayed on the file after the fix shipped — so the one document
+ * explaining the feature told every later reader the feature did not exist.
+ *
+ * What is true now: `/search` is a real grouped results page, the header
+ * reaches it, and this module is TIER 2 — the authenticated, server-side
+ * half. The public half is a prebuilt artifact searched in the browser at
+ * zero Firestore reads, and this one is what serves a viewer's OWN records
+ * (`scoped-sources.ts`) and what the kill switch falls back to when the
+ * artifact is unavailable.
+ *
+ * That fallback is the reason this file is not deleted.
  *
  * ── WHY THIS IS AFFORDABLE ─────────────────────────────────────────────────
  *
@@ -30,11 +40,15 @@
  *
  * ── 🛑 WHAT IT DOES NOT REUSE, AND WHY ─────────────────────────────────────
  *
- * NOT `SearchRepository`. That class builds `title_=${q}` — a case-sensitive
+ * NOT `SearchRepository`. That class built `title_=${q}` — a case-sensitive
  * STARTS-WITH on `title` alone — so "dranzer" would not find "Beyblade
- * Original Dranzer S" and "flat" would find nothing at all. It is reachable
- * only through `/api/search`, whose own hook (`useSearch`) has zero consumers
- * outside barrel re-exports. Recorded rather than deleted here; see F1.
+ * Original Dranzer S" and "flat" would find nothing at all. It was reachable
+ * only through `/api/search`, whose own hook (`useSearch`) had zero consumers
+ * outside barrel re-exports. The whole dead subsystem — `SearchRepository`,
+ * `/api/search`, `useSearch`, `SearchView`/`SearchFiltersRow`/
+ * `SearchResultsSection`, the legacy `search-actions.ts`/`data.ts`/
+ * `actions.ts` chain — was deleted in the Wave 10 cleanup, kept only as this
+ * historical note on why `searchEverything` never called it.
  */
 import { planSearchTxt } from "../../../../utils/search-txt-query.js";
 import { parseSearchTxtQuery, SEARCH_TXT_FIELD } from "../../../../utils/search-txt.js";
@@ -44,6 +58,19 @@ import { normalizeError } from "../../../../errors/normalize.js";
 const PER_GROUP = 6;
 /** The bounded window each push-down reads before the in-memory refine. */
 const SCAN = 60;
+/**
+ * 🛑 The ceiling on what ONE viewer's scoped search may read.
+ *
+ * Σ `scanLimit` across the widest role, checked by
+ * `audit-scoped-search-ownership` R4 — which PRINTS THE ARITHMETIC on
+ * failure, because "the budget is exceeded" is useless without knowing by
+ * which source and how much.
+ *
+ * 400 against Rule #6's ~3-round-trip guidance is defensible because the
+ * sources run in ONE `Promise.all`: it is one round trip of fan-out, not
+ * twelve sequential ones. The number that matters is documents read.
+ */
+export const SCOPED_SCAN_BUDGET = 400;
 /**
  * Run every source in parallel and group the results.
  *
@@ -75,20 +102,41 @@ export async function searchEverything(db, q, sources) {
             moreHref: src.moreHref(q),
         };
         try {
+            const scan = src.scanLimit ?? SCAN;
+            const boundedMemory = src.mode === "bounded-memory";
             let ref = db.collection(src.collection);
             for (const [field, value] of src.where ?? [])
                 ref = ref.where(field, "==", value);
-            const snap = await ref
-                .where(SEARCH_TXT_FIELD, "array-contains", plan.head)
-                .select(...src.select, SEARCH_TXT_FIELD)
-                .limit(SCAN)
-                .get();
+            /*
+             * 🛑 The two modes differ in ONE clause and in nothing else.
+             *
+             * `bounded-memory` omits the `array-contains` push-down and does not
+             * project `searchTxt` — because the collections that use it do not
+             * have one, deliberately (see `mode`). Everything downstream —
+             * `toHit`, the PER_GROUP slice, the `truncated` floor — is shared, so
+             * the two paths cannot drift in how they REPORT, only in how they
+             * find.
+             */
+            const snap = boundedMemory
+                ? await (src.orderBy
+                    ? ref.orderBy(src.orderBy[0], src.orderBy[1])
+                    : ref)
+                    .select(...src.select)
+                    .limit(scan)
+                    .get()
+                : await ref
+                    .where(SEARCH_TXT_FIELD, "array-contains", plan.head)
+                    .select(...src.select, SEARCH_TXT_FIELD)
+                    .limit(scan)
+                    .get();
             // AND-refine the remaining terms in memory — one push-down per query is
             // all Firestore gives, so the rest is a filter over a bounded window.
-            const matched = snap.docs.filter((d) => {
-                const txt = d.data()[SEARCH_TXT_FIELD] ?? [];
-                return plan.rest.every((t) => txt.includes(t));
-            });
+            const matched = boundedMemory
+                ? snap.docs.filter((d) => src.matches?.(d.data(), terms) ?? false)
+                : snap.docs.filter((d) => {
+                    const txt = d.data()[SEARCH_TXT_FIELD] ?? [];
+                    return plan.rest.every((t) => txt.includes(t));
+                });
             const hits = matched
                 .map((d) => src.toHit(d.id, d.data()))
                 .filter((h) => h !== null);
@@ -96,8 +144,10 @@ export async function searchEverything(db, q, sources) {
                 ...base,
                 hits: hits.slice(0, PER_GROUP),
                 // Saturated window OR more matches than we show — either way the
-                // count on screen is a floor.
-                truncated: snap.docs.length >= SCAN || hits.length > PER_GROUP,
+                // count on screen is a floor. Compared against THIS source's own
+                // limit, not the module default: a scoped source scanning 20 that
+                // returned 20 is saturated even though 20 < SCAN.
+                truncated: snap.docs.length >= scan || hits.length > PER_GROUP,
             };
         }
         catch (err) {

package/dist/_internal/server/features/seo/sitemap.js

@@ -141,6 +141,12 @@ function staticPages(baseUrl) {
         page(String(ROUTES.PUBLIC.DIGITAL_CODES), "daily", 0.6),
         page(String(ROUTES.PUBLIC.LIVE), "hourly", 0.7),
         page(String(ROUTES.PUBLIC.ART), "weekly", 0.6),
+        /*
+         * `daily`, matching the other one-of-a-kind types rather than `/art`'s
+         * weekly: most spares are quantity 1, so the page turns over as fast as
+         * classifieds do.
+         */
+        page(String(ROUTES.PUBLIC.SPARES), "daily", 0.6),
         page(String(ROUTES.PUBLIC.FEES), "monthly", 0.4),
         page(String(ROUTES.PUBLIC.HOW_AUCTIONS_WORK), "monthly", 0.4),
         page(String(ROUTES.PUBLIC.HOW_PRE_ORDERS_WORK), "monthly", 0.4),

package/dist/_internal/server/features/shared/listing-adapters.js

@@ -1,3 +1,4 @@
+import { productImageUrls } from "../../../../features/products/schemas/firestore.js";
 /** Maps the shared fields from a raw Firestore ProductDocument. */
 export function mapBaseListingFields(doc) {
     return {
@@ -10,8 +11,9 @@ export function mapBaseListingFields(doc) {
         // bypassing <GatedPrice> entirely — and it had zero readers, so it was
         // pure exposure. Clients format from `price` through the gate.
         currency: doc.currency ?? "INR",
-        mainImage: doc.mainImage || doc.images?.[0] || null,
-        images: doc.images ?? [],
+        mainImage: doc.mainImage || doc.images?.[0]?.url || null,
+        // A6: the client listing shape is still `string[]`; project, never mirror.
+        images: productImageUrls(doc.images),
         storeId: doc.storeId,
         storeName: doc.storeName ?? null,
         category: doc.categorySlugs?.[0] ?? doc.category ?? "",

package/dist/_internal/server/features/sticker-trace/adapters.d.ts

@@ -15,6 +15,17 @@ export interface ClientSheetPart {
     areaMm2: number | null;
     /** Whether a full-resolution render exists, NOT where it is. */
     hasAsset: boolean;
+    /**
+     * The PUBLIC `/media/{shortId}` slug, when the part has been promoted.
+     *
+     * 🛑 Public on purpose and NOT a path. A `mediaShortId` is already a public
+     * URL by construction — a `mediaAssets` row IS what mints `/media/{id}`, and
+     * `/api/media/[...slug]` serves it to anyone, watermarked. So the thing it
+     * names is public whether or not this field is projected, and the admin
+     * review UI genuinely needs it to show the marketplace copy beside the clean
+     * one. `assetPath` stays private: that is the unwatermarked original.
+     */
+    mediaShortId?: string;
     duplicateOf?: number;
 }
 export interface ClientStickerSheet {

package/dist/_internal/server/features/sticker-trace/adapters.js

@@ -105,6 +105,7 @@ function toClientPart(part) {
         bboxMm: part.bboxMm,
         areaMm2: part.areaMm2,
         hasAsset: Boolean(part.assetPath),
+        ...(part.mediaShortId !== undefined ? { mediaShortId: part.mediaShortId } : {}),
         ...(part.duplicateOf !== undefined ? { duplicateOf: part.duplicateOf } : {}),
     };
 }

package/dist/_internal/server/features/sticker-trace/promote-to-listings.d.ts

@@ -0,0 +1,26 @@
+export interface PromoteToListingsInput {
+    sheetId: string;
+    /** Owning store. The admin picks it; there is no sensible default. */
+    storeId: string;
+    /**
+     * ONE price for every part, in rupees.
+     *
+     * 🛑 Deliberately flat rather than per-part or area-derived. A cut sticker
+     * costs about the same to print whatever its size, so a size-scaled price
+     * would be a fabricated precision — and a per-part form for a 60-part sheet
+     * is 60 inputs nobody fills in honestly. Each child is an ordinary product
+     * afterwards and repriceable in the normal editor.
+     */
+    partPrice: number;
+    /** The whole sheet's price, in rupees. */
+    sheetPrice: number;
+    /** Auth UID, for the `mediaAssets` row's `uploadedBy`. */
+    actorUid: string;
+}
+export interface PromoteToListingsResult {
+    parentId: string;
+    childIds: string[];
+    /** Parts skipped as confirmed duplicates of another part. */
+    skippedDuplicates: number;
+}
+export declare function promoteStickerSheetToListings(input: PromoteToListingsInput): Promise<PromoteToListingsResult>;