@mohasinac/appkit 2.6.0 → 2.6.2

package/dist/_internal/server/features/checkout/actions.js

@@ -8,19 +8,64 @@
  */
 import { ApiError, ValidationError, NotFoundError, ERROR_MESSAGES } from "../../../../errors";
 import { serverLogger } from "../../../../monitoring";
-import { unitOfWork, siteSettingsRepository, userRepository, storeRepository, couponsRepository, } from "../../../../repositories";
+import { unitOfWork, siteSettingsRepository, userRepository, storeRepository, couponsRepository, notificationRepository, } from "../../../../repositories";
 import { failedCheckoutRepository } from "../../../../features/checkout/repository/failed-checkout.repository";
 import { sendOrderConfirmationEmail } from "../../../../features/contact/server";
 import { splitCartIntoOrderGroups } from "../../../../features/orders/index";
 import { resolveDate } from "../../../../utils";
-import { getAdminDb } from "../../../../providers/db-firebase";
+import { getAdminDb, getAdminRealtimeDb, RTDB_PATHS, } from "../../../../providers/db-firebase";
 import { PRODUCT_COLLECTION, ProductStatusValues } from "../../../../features/products/schemas/firestore";
 import { CART_COLLECTION } from "../../../../features/cart/schemas/index";
 import { consentOtpRef, consentOtpRateLimitRef, CONSENT_OTP_MAX_BYPASS_CREDITS, } from "../../../../features/auth/server";
-import { OrderStatusValues, PaymentStatusValues } from "../../../../features/orders/schemas/index";
+import { OrderStatusValues, PaymentStatusValues, PaymentMethodValues, } from "../../../../features/orders/schemas/index";
 import { getDefaultCurrency } from "../../../../core/index";
+import { verifyPaymentSignatureWithKeys, fetchRazorpayOrder, paiseToRupees, } from "../../../../providers/payment-razorpay/index";
 import { CHECKOUT_DEFAULT_COMMISSIONS } from "../../../shared/features/checkout/config";
 import { formatShippingAddress } from "./data";
+import { enforceMaxPerUserForCart, enforcePrizePoolCap, computePrizeRevealDeadline, } from "./prize-bundle-gates";
+/**
+ * Fire-and-forget in-app notifications when an order is created.
+ *
+ * The Cloud Function `onOrderStatusChange` only fires on status transitions
+ * (not on creates), so a brand-new order never produces an in-app row for
+ * either party. We emit the buyer + seller rows here at the create boundary.
+ */
+function emitOrderPlacedNotifications(args) {
+    const { orderId, buyerUid, buyerName, storeOwnerId, productLabel, paid } = args;
+    const buyerNotif = notificationRepository
+        .create({
+        userId: buyerUid,
+        type: "order_placed",
+        priority: "normal",
+        title: "Order placed",
+        message: `Your order for ${productLabel} has been placed.`,
+        relatedId: orderId,
+        relatedType: "order",
+        actionUrl: `/user/orders/view/${orderId}`,
+    })
+        .catch((err) => serverLogger.warn("Failed to create buyer order_placed notification", {
+        err,
+        orderId,
+    }));
+    const sellerNotif = storeOwnerId
+        ? notificationRepository
+            .create({
+            userId: storeOwnerId,
+            type: "order_placed",
+            priority: "high",
+            title: "New order received",
+            message: `${paid ? "New paid order" : "New order"} from ${buyerName || "a buyer"} for ${productLabel}.`,
+            relatedId: orderId,
+            relatedType: "order",
+            actionUrl: `/store/orders/${orderId}/view`,
+        })
+            .catch((err) => serverLogger.warn("Failed to create seller order_placed notification", {
+            err,
+            orderId,
+        }))
+        : Promise.resolve();
+    void Promise.all([buyerNotif, sellerNotif]);
+}
 /**
  * Place order(s) from the user's cart in a single Firestore transaction.
  *
@@ -54,6 +99,22 @@ export async function createCheckoutOrderAction(input) {
     const shippingAddress = formatShippingAddress(address);
     const db = getAdminDb();
     const otpRef = consentOtpRef(db, uid, addressId);
+    // SB6-C — pre-tx fetch products so we can run the maxPerUser cap check
+    // (count queries can't run inside a Firestore transaction). The same
+    // product docs are re-read inside the transaction below for stock + prize
+    // pool checks; this is intentional (the tx is the source of truth for the
+    // counts we actually mutate).
+    const preTxProductRefs = cartItems.map((item) => db.collection(PRODUCT_COLLECTION).doc(item.productId));
+    const preTxProductSnaps = await Promise.all(preTxProductRefs.map((r) => r.get()));
+    const preTxPairs = cartItems
+        .map((item, i) => {
+        const data = preTxProductSnaps[i].exists
+            ? preTxProductSnaps[i].data()
+            : undefined;
+        return data ? { item, product: data } : null;
+    })
+        .filter((pair) => pair !== null);
+    await enforceMaxPerUserForCart({ userId: uid, items: preTxPairs });
     let stockResult;
     try {
         stockResult = await db.runTransaction(async (tx) => {
@@ -88,10 +149,20 @@ export async function createCheckoutOrderAction(input) {
                     });
                 }
                 else {
-                    tx.update(productRefs[i], {
+                    // SB6-C — prize-draw pool cap (in-tx, atomic with availableQuantity).
+                    enforcePrizePoolCap({
+                        productSnapshot: productData,
+                        requestedQuantity: item.quantity,
+                    });
+                    const productUpdate = {
                         availableQuantity: productData.availableQuantity - item.quantity,
                         updatedAt: new Date(),
-                    });
+                    };
+                    if (productData.listingType === "prize-draw") {
+                        productUpdate.prizeCurrentEntries =
+                            (productData.prizeCurrentEntries ?? 0) + item.quantity;
+                    }
+                    tx.update(productRefs[i], productUpdate);
                     availableItems.push({ item, product: productData });
                 }
             }
@@ -146,19 +217,38 @@ export async function createCheckoutOrderAction(input) {
         const firstItem = group[0].item;
         const groupTotal = group.reduce((sum, { item }) => sum + item.price * item.quantity, 0);
         total += groupTotal;
-        const orderItems = group.map(({ item }) => ({
-            productId: item.productId,
-            productTitle: item.productTitle,
-            quantity: item.quantity,
-            unitPrice: item.price,
-            totalPrice: item.price * item.quantity,
-        }));
+        // SB8-F — when a line is a prize-draw entry, stamp the listingType +
+        // reveal status + deadline so the user-orders surface can render the
+        // reveals-remaining badge immediately after order creation.
+        const groupRevealDeadline = orderType === "prize-draw"
+            ? computePrizeRevealDeadline(group[0].product)
+            : undefined;
+        const orderItems = group.map(({ item, product }) => {
+            const isPrizeDrawLine = product.listingType === "prize-draw";
+            return {
+                productId: item.productId,
+                productTitle: item.productTitle,
+                quantity: item.quantity,
+                unitPrice: item.price,
+                totalPrice: item.price * item.quantity,
+                ...(isPrizeDrawLine
+                    ? {
+                        listingType: "prize-draw",
+                        prizeRevealStatus: product.prizeRevealStatus === "open" ? "open" : "pending",
+                        prizeRevealDeadline: groupRevealDeadline?.toISOString(),
+                    }
+                    : product.listingType
+                        ? { listingType: product.listingType }
+                        : {}),
+            };
+        });
         const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
         let shippingFee = 0;
+        let storeOwnerId;
         const storeId = firstItem.storeId;
         if (storeId) {
             const store = await storeRepository.findById(storeId);
-            const storeOwnerId = store?.ownerId;
+            storeOwnerId = store?.ownerId;
             if (storeOwnerId) {
                 const sellerUser = await userRepository.findById(storeOwnerId);
                 const shippingConfig = sellerUser?.shippingConfig;
@@ -237,6 +327,17 @@ export async function createCheckoutOrderAction(input) {
                 .map(({ product }) => product.mainImage)
                 .filter((url) => typeof url === "string" && url.length > 0)),
         ];
+        // SB-UNI-D — "bundle" order-type removed; bundle cart lines will expand
+        // to N product order lines at checkout (forward-looking feature, not
+        // wired yet). Prize-draw fields only.
+        const isPrizeDrawOrder = orderType === "prize-draw";
+        const prizeDrawFields = isPrizeDrawOrder
+            ? {
+                prizeDrawProductId: group[0].product.id,
+                isNonRefundable: true,
+                prizeRevealDeadline: computePrizeRevealDeadline(group[0].product),
+            }
+            : {};
         const order = await unitOfWork.orders.create({
             productId: firstItem.productId,
             productTitle: firstItem.productTitle,
@@ -264,6 +365,7 @@ export async function createCheckoutOrderAction(input) {
             couponDiscount: couponDiscount > 0 ? couponDiscount : undefined,
             appliedDiscounts: appliedDiscounts.length > 0 ? appliedDiscounts : undefined,
             imageUrls: imageUrls.length > 0 ? imageUrls : undefined,
+            ...prizeDrawFields,
         });
         orderIds.push(order.id);
         for (const code of groupCouponCodes) {
@@ -285,6 +387,14 @@ export async function createCheckoutOrderAction(input) {
                 items: orderItems,
             });
         }
+        emitOrderPlacedNotifications({
+            orderId: order.id,
+            buyerUid: uid,
+            buyerName: userName,
+            storeOwnerId,
+            productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
+            paid: false,
+        });
     }
     if (couponUsageAccumulator.size > 0) {
         Promise.all([...couponUsageAccumulator.values()].map(({ couponId, code, orderIds: ids, totalDiscount }) => couponsRepository.applyCoupon(couponId, code, uid, ids, totalDiscount))).catch((err) => serverLogger.error("Failed to record coupon usage:", err));
@@ -325,3 +435,322 @@ export async function attachPaymentAction(input) {
         updatedAt: new Date(),
     });
 }
+/**
+ * Place order(s) from the user's cart after a Razorpay payment is verified.
+ * Mirrors the existing /api/payment/verify route handler.
+ *
+ * Consumers must authenticate the user before calling. The action performs:
+ *   1. HMAC signature verification (rejects forged callbacks)
+ *   2. Cart re-validation against current product prices/stock
+ *   3. Amount cross-check against the Razorpay order record
+ *   4. Atomic stock decrement + cart clear via unitOfWork batch
+ *   5. Multi-coupon pro-rating per order group
+ *   6. order_placed notifications (buyer + seller)
+ *   7. Confirmation email + RTDB success signal (both fire-and-forget)
+ */
+export async function verifyAndPlaceRazorpayOrderAction(input) {
+    const { userId: uid, userName, userEmail, razorpay_order_id, razorpay_payment_id, razorpay_signature, addressId, notes, } = input;
+    const siteSettings = await siteSettingsRepository.getSingleton();
+    const razorpayFeePercent = siteSettings?.commissions?.razorpayFeePercent ?? 5;
+    const commissions = siteSettings?.commissions ?? CHECKOUT_DEFAULT_COMMISSIONS;
+    const isValid = await verifyPaymentSignatureWithKeys({
+        razorpay_order_id,
+        razorpay_payment_id,
+        razorpay_signature,
+    });
+    if (!isValid) {
+        serverLogger.warn(`Payment signature verification failed for user ${uid}`);
+        failedCheckoutRepository
+            .logPayment(uid, "signature_mismatch", "HMAC signature invalid", {
+            gatewayOrderId: razorpay_order_id,
+            gatewayPaymentId: razorpay_payment_id,
+            addressId,
+        })
+            .catch(() => { });
+        throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
+    }
+    const cart = await unitOfWork.carts.getOrCreate(uid);
+    if (!cart.items || cart.items.length === 0) {
+        throw new ValidationError(ERROR_MESSAGES.CHECKOUT.CART_EMPTY);
+    }
+    const address = await unitOfWork.addresses.findById(uid, addressId);
+    if (!address) {
+        throw new NotFoundError(ERROR_MESSAGES.CHECKOUT.ADDRESS_REQUIRED);
+    }
+    const shippingAddress = formatShippingAddress(address);
+    const db = getAdminDb();
+    const otpRef = consentOtpRef(db, uid, addressId);
+    {
+        const otpSnap = await otpRef.get();
+        const otpData = otpSnap.exists
+            ? otpSnap.data()
+            : null;
+        const isConsentValid = otpData?.verified === true &&
+            otpData.expiresAt &&
+            (resolveDate(otpData.expiresAt)?.getTime() ?? 0) > Date.now();
+        if (!isConsentValid) {
+            const reason = !otpData ? "otp_not_verified" : "consent_expired";
+            failedCheckoutRepository
+                .logPayment(uid, reason, "Consent OTP missing or expired at payment verify time", {
+                gatewayOrderId: razorpay_order_id,
+                gatewayPaymentId: razorpay_payment_id,
+                addressId,
+            })
+                .catch(() => { });
+            throw new ApiError(403, "Order verification required. Please complete OTP verification and retry.");
+        }
+    }
+    const productChecks = await Promise.all(cart.items.map(async (item) => {
+        const product = await unitOfWork.products.findById(item.productId);
+        return { item, product };
+    }));
+    // SB6-C — maxPerUser cap check before we touch any state.
+    await enforceMaxPerUserForCart({
+        userId: uid,
+        items: productChecks
+            .filter((p) => p.product !== null && p.product !== undefined)
+            .map(({ item, product }) => ({ item, product })),
+    });
+    // SB6-C — prize-pool cap. Runs against the freshly-read product snapshots.
+    for (const { item, product } of productChecks) {
+        if (!product)
+            continue;
+        enforcePrizePoolCap({
+            productSnapshot: product,
+            requestedQuantity: item.quantity,
+        });
+    }
+    for (const { item, product } of productChecks) {
+        if (!product || product.status !== ProductStatusValues.PUBLISHED) {
+            failedCheckoutRepository
+                .logPayment(uid, "product_unavailable", `Product ${item.productId} not published`, {
+                gatewayOrderId: razorpay_order_id,
+                gatewayPaymentId: razorpay_payment_id,
+                addressId,
+            })
+                .catch(() => { });
+            throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PRODUCT_UNAVAILABLE);
+        }
+        if (product.availableQuantity < item.quantity) {
+            failedCheckoutRepository
+                .logPayment(uid, "stock_insufficient", `Product ${item.productId} has ${product.availableQuantity} left, requested ${item.quantity}`, {
+                gatewayOrderId: razorpay_order_id,
+                gatewayPaymentId: razorpay_payment_id,
+                addressId,
+            })
+                .catch(() => { });
+            throw new ValidationError(ERROR_MESSAGES.CHECKOUT.INSUFFICIENT_STOCK);
+        }
+    }
+    {
+        const cartSubtotalRs = productChecks.reduce((sum, { item, product }) => sum + product.price * item.quantity, 0);
+        const expectedPlatformFee = Math.round(cartSubtotalRs * (razorpayFeePercent / 100) * 100) / 100;
+        const expectedPaymentAmountRs = cartSubtotalRs + expectedPlatformFee;
+        const rzpOrderRecord = await fetchRazorpayOrder(razorpay_order_id);
+        const paidAmountRs = paiseToRupees(rzpOrderRecord.amount);
+        if (paidAmountRs < expectedPaymentAmountRs - 1) {
+            serverLogger.warn(`Payment amount mismatch for user ${uid}: paid ₹${paidAmountRs}, expected ≥ ₹${expectedPaymentAmountRs}`);
+            failedCheckoutRepository
+                .logPayment(uid, "amount_mismatch", `Paid ₹${paidAmountRs}, expected ≥ ₹${expectedPaymentAmountRs}`, {
+                gatewayOrderId: razorpay_order_id,
+                gatewayPaymentId: razorpay_payment_id,
+                amountRs: paidAmountRs,
+                addressId,
+            })
+                .catch(() => { });
+            throw new ValidationError(ERROR_MESSAGES.CHECKOUT.PAYMENT_FAILED);
+        }
+    }
+    const appliedCoupons = cart.appliedCoupons ?? [];
+    const orderGroups = splitCartIntoOrderGroups(productChecks);
+    const orderIds = [];
+    let total = 0;
+    const emailsToSend = [];
+    const cartSubtotal = orderGroups.reduce((s, { items: g }) => s +
+        g.reduce((gs, { item, product }) => gs + product.price * item.quantity, 0), 0);
+    for (const { items: group, orderType } of orderGroups) {
+        const firstItem = group[0].item;
+        const groupTotal = group.reduce((sum, { item, product }) => sum + product.price * item.quantity, 0);
+        let shippingFee = 0;
+        let storeOwnerId;
+        const storeId = firstItem.storeId;
+        if (storeId) {
+            const store = await storeRepository.findById(storeId);
+            storeOwnerId = store?.ownerId;
+            const sellerUser = storeOwnerId ? await userRepository.findById(storeOwnerId) : null;
+            const shippingConfig = sellerUser?.shippingConfig;
+            if (shippingConfig?.isConfigured) {
+                if (shippingConfig.method === "custom") {
+                    shippingFee = shippingConfig.customShippingPrice ?? 0;
+                }
+                else if (shippingConfig.method === "shiprocket") {
+                    const percentFee = groupTotal * (commissions.platformShippingPercent / 100);
+                    shippingFee = Math.max(percentFee, commissions.platformShippingFixedMin);
+                }
+            }
+        }
+        let couponDiscount = 0;
+        const appliedDiscounts = [];
+        for (const coupon of appliedCoupons) {
+            let couponGroupDiscount = 0;
+            const isSellerScoped = coupon.scope === "seller" && coupon.storeId;
+            if (isSellerScoped) {
+                if (coupon.storeId !== firstItem.storeId)
+                    continue;
+                if (coupon.applicableItemIds?.length) {
+                    const eligibleTotal = group
+                        .filter(({ item }) => coupon.applicableItemIds.includes(item.itemId))
+                        .reduce((s, { item, product }) => s + product.price * item.quantity, 0);
+                    couponGroupDiscount =
+                        eligibleTotal > 0
+                            ? Math.min(Math.round((eligibleTotal / groupTotal) * coupon.discountAmount * 100) / 100, eligibleTotal)
+                            : 0;
+                }
+                else {
+                    couponGroupDiscount = Math.min(coupon.discountAmount, groupTotal);
+                }
+            }
+            else if (cartSubtotal > 0) {
+                couponGroupDiscount = Math.min(Math.round((groupTotal / cartSubtotal) * coupon.discountAmount * 100) / 100, groupTotal);
+            }
+            if (couponGroupDiscount > 0) {
+                couponDiscount += couponGroupDiscount;
+                appliedDiscounts.push({
+                    code: coupon.code,
+                    couponId: coupon.couponId,
+                    type: "coupon",
+                    discountAmount: couponGroupDiscount,
+                    scope: coupon.scope,
+                    storeId: coupon.storeId,
+                });
+            }
+        }
+        couponDiscount = Math.min(couponDiscount, groupTotal);
+        const platformFee = Math.round(groupTotal * (razorpayFeePercent / 100) * 100) / 100;
+        const orderTotal = Math.max(0, groupTotal - couponDiscount) + shippingFee;
+        total += orderTotal;
+        // SB8-F — stamp listingType + reveal-status + deadline for prize-draw lines.
+        const groupRevealDeadlineRzp = orderType === "prize-draw" && group[0].product
+            ? computePrizeRevealDeadline(group[0].product)
+            : undefined;
+        const orderItems = group.map(({ item, product }) => {
+            const isPrizeDrawLine = product?.listingType === "prize-draw";
+            return {
+                productId: item.productId,
+                productTitle: item.productTitle,
+                quantity: item.quantity,
+                unitPrice: product.price,
+                totalPrice: product.price * item.quantity,
+                ...(isPrizeDrawLine
+                    ? {
+                        listingType: "prize-draw",
+                        prizeRevealStatus: product?.prizeRevealStatus === "open"
+                            ? "open"
+                            : "pending",
+                        prizeRevealDeadline: groupRevealDeadlineRzp?.toISOString(),
+                    }
+                    : product?.listingType
+                        ? { listingType: product.listingType }
+                        : {}),
+            };
+        });
+        const totalQuantity = group.reduce((sum, { item }) => sum + item.quantity, 0);
+        const imageUrls = [
+            ...new Set(group
+                .map(({ product }) => product?.mainImage)
+                .filter((url) => typeof url === "string" && url.length > 0)),
+        ];
+        // SB-UNI-D — "bundle" order-type removed; bundle cart lines will expand
+        // to N product order lines at checkout (forward-looking, not wired).
+        const isPrizeDrawOrder = orderType === "prize-draw";
+        const prizeDrawFields = isPrizeDrawOrder && group[0].product
+            ? {
+                prizeDrawProductId: group[0].product.id,
+                isNonRefundable: true,
+                prizeRevealDeadline: computePrizeRevealDeadline(group[0].product),
+            }
+            : {};
+        const order = await unitOfWork.orders.create({
+            productId: firstItem.productId,
+            productTitle: firstItem.productTitle,
+            userId: uid,
+            userName,
+            userEmail,
+            quantity: totalQuantity,
+            unitPrice: group[0].product.price,
+            totalPrice: orderTotal,
+            currency: firstItem.currency ?? getDefaultCurrency(),
+            storeId: firstItem.storeId || undefined,
+            storeName: firstItem.storeName || undefined,
+            items: orderItems,
+            orderType,
+            offerId: firstItem.offerId ?? undefined,
+            status: OrderStatusValues.CONFIRMED,
+            paymentStatus: PaymentStatusValues.PAID,
+            paymentMethod: PaymentMethodValues.ONLINE,
+            paymentId: razorpay_payment_id,
+            shippingAddress,
+            notes,
+            platformFee,
+            shippingFee: shippingFee > 0 ? shippingFee : undefined,
+            couponCode: appliedDiscounts[0]?.code,
+            couponDiscount: couponDiscount > 0 ? couponDiscount : undefined,
+            appliedDiscounts: appliedDiscounts.length > 0 ? appliedDiscounts : undefined,
+            imageUrls: imageUrls.length > 0 ? imageUrls : undefined,
+            ...prizeDrawFields,
+        });
+        orderIds.push(order.id);
+        if (userEmail) {
+            emailsToSend.push({
+                to: userEmail,
+                userName,
+                orderId: order.id,
+                productTitle: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
+                quantity: totalQuantity,
+                totalPrice: orderTotal,
+                currency: firstItem.currency ?? getDefaultCurrency(),
+                shippingAddress,
+                paymentMethod: PaymentMethodValues.ONLINE,
+                items: orderItems,
+            });
+        }
+        emitOrderPlacedNotifications({
+            orderId: order.id,
+            buyerUid: uid,
+            buyerName: userName,
+            storeOwnerId,
+            productLabel: orderItems.length > 1 ? `${orderItems.length} items` : firstItem.productTitle,
+            paid: true,
+        });
+    }
+    await unitOfWork.runBatch((batch) => {
+        for (const { item, product } of productChecks) {
+            if (!product)
+                continue;
+            const prizeBump = product.listingType === "prize-draw"
+                ? {
+                    prizeCurrentEntries: (product.prizeCurrentEntries ?? 0) + item.quantity,
+                }
+                : {};
+            unitOfWork.products.updateInBatch(batch, item.productId, {
+                availableQuantity: product.availableQuantity - item.quantity,
+                ...prizeBump,
+            });
+        }
+        unitOfWork.carts.updateInBatch(batch, uid, {
+            items: [],
+            appliedCoupons: [],
+            selectedItemIds: null,
+        });
+    });
+    otpRef.delete().catch(() => { });
+    if (emailsToSend.length > 0) {
+        Promise.all(emailsToSend.map((e) => sendOrderConfirmationEmail(e))).catch((err) => serverLogger.error("Order confirmation email error:", err));
+    }
+    serverLogger.info(`verifyAndPlaceRazorpayOrderAction: ${orderIds.length} order(s) placed for uid=${uid} — payment ${razorpay_payment_id}`);
+    getAdminRealtimeDb()
+        .ref(`${RTDB_PATHS.PAYMENT_EVENTS}/${razorpay_order_id}`)
+        .update({ status: "success", orderIds, updatedAt: Date.now() })
+        .catch((err) => serverLogger.warn("Payment event RTDB signal failed (non-critical)", { err }));
+    return { orderIds, total, itemCount: orderIds.length };
+}

package/dist/_internal/server/features/checkout/index.d.ts

@@ -1,3 +1,3 @@
-export { createCheckoutOrderAction, attachPaymentAction, type CreateCheckoutOrderInput, } from "./actions";
+export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlaceRazorpayOrderAction, type CreateCheckoutOrderInput, type VerifyAndPlaceRazorpayOrderInput, } from "./actions";
 export { formatShippingAddress, type CheckoutOrderResult, } from "./data";
 export { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, type CheckoutPaymentMethod, } from "../../../shared/features/checkout/config";

package/dist/_internal/server/features/checkout/index.js

@@ -1,3 +1,3 @@
-export { createCheckoutOrderAction, attachPaymentAction, } from "./actions";
+export { createCheckoutOrderAction, attachPaymentAction, verifyAndPlaceRazorpayOrderAction, } from "./actions";
 export { formatShippingAddress, } from "./data";
 export { CHECKOUT_DEFAULT_COMMISSIONS, CHECKOUT_PAYMENT_METHODS, } from "../../../shared/features/checkout/config";

package/dist/_internal/server/features/checkout/prize-bundle-gates.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Prize-draw + bundle + maxPerUser gates for the checkout pipeline (SB6-C, SB8-A).
+ *
+ * Shared helper used by both `createCheckoutOrderAction` (COD/UPI-manual path)
+ * and `verifyAndPlaceRazorpayOrderAction` (Razorpay path). Pulled out here so
+ * the two transactional flows enforce the same rules.
+ */
+import type { ProductDocument } from "../../../../features/products/schemas/firestore";
+import type { CartItemDocument } from "../../../../features/cart/schemas/firestore";
+export interface PerUserCapViolation {
+    productId: string;
+    productTitle: string;
+    allowance: number;
+    alreadyPurchased: number;
+    requested: number;
+}
+/**
+ * Pre-transaction read: for every cart item whose product has `maxPerUser`
+ * set, count the user's existing active orders and reject the checkout if
+ * the new request would push them over the cap.
+ *
+ * Active = pending / confirmed / processing / shipped / delivered. Cancelled
+ * + refunded orders do NOT count (stock was returned to circulation).
+ *
+ * Throws ValidationError with code `MAX_PER_USER` listing every violating
+ * product. The check is informational-rich on purpose — the UI surfaces all
+ * blocked items at once instead of revealing them one at a time.
+ */
+export declare function enforceMaxPerUserForCart(args: {
+    userId: string;
+    items: Array<{
+        item: CartItemDocument;
+        product: ProductDocument;
+    }>;
+}): Promise<void>;
+/**
+ * SB8-A — compute the deadline by which the buyer must claim their prize
+ * via the reveal API.
+ *
+ * Rules:
+ *   - If the reveal window has not yet opened:
+ *       deadline = min(revealWindowStart + revealDeadlineDays, revealWindowEnd)
+ *   - If the window is already open:
+ *       deadline = min(now + revealDeadlineDays, revealWindowEnd)
+ *
+ * Returns `undefined` if the product lacks the prize-draw fields.
+ */
+export declare function computePrizeRevealDeadline(product: Pick<ProductDocument, "prizeRevealWindowStart" | "prizeRevealWindowEnd" | "prizeRevealDeadlineDays">, now?: Date): Date | undefined;
+/**
+ * Inside the existing checkout transaction, validate the prize-pool cap for
+ * each prize-draw line. Caller must pass the fresh product snapshot read
+ * within the transaction (so `prizeCurrentEntries` is up-to-date).
+ *
+ * Throws ValidationError if any item would overflow the pool.
+ */
+export declare function enforcePrizePoolCap(args: {
+    productSnapshot: ProductDocument;
+    requestedQuantity: number;
+}): void;