@mohasinac/appkit 2.8.9 → 3.0.0

package/dist/features/auth/consent-otp.d.ts

@@ -1,6 +1,7 @@
 /**
  * Consent OTP - Shared constants, path helpers, and utilities
  */
+import type { FirestoreDocument } from "@mohasinac/appkit";
 import { getAdminDb } from "../../providers/db-firebase";
 /** OTP validity window (10 minutes). */
 export declare const CONSENT_OTP_EXPIRY_MS: number;
@@ -41,11 +42,11 @@ export interface ConsentOtpDoc {
  */
 export declare function enforceConsentOtpRateLimit(uid: string): Promise<void>;
 /** Write (or overwrite) a consent OTP document for a given user + address. */
-export declare function saveConsentOtp(uid: string, addressId: string, data: Record<string, unknown>): Promise<void>;
+export declare function saveConsentOtp(uid: string, addressId: string, data: FirestoreDocument): Promise<void>;
 /** Read a consent OTP document. Returns null when the document does not exist. */
 export declare function readConsentOtp(uid: string, addressId: string): Promise<ConsentOtpDoc | null>;
 /** Partially update a consent OTP document. */
-export declare function patchConsentOtp(uid: string, addressId: string, data: Record<string, unknown>): Promise<void>;
+export declare function patchConsentOtp(uid: string, addressId: string, data: FirestoreDocument): Promise<void>;
 /** Build the consent OTP WhatsApp message body. */
 export declare function buildConsentOtpWhatsApp(recipientName: string, code: string, siteName: string): string;
 /** Build the consent OTP email subject and HTML body. */

package/dist/features/auth/consent-otp.js

@@ -115,13 +115,13 @@ export function buildConsentOtpEmail(recipientName, code, siteName) {
     return {
         subject: `${siteName}: Consent verification code - shipping to ${recipientName}`,
         html: `
-      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
-        <h2 style="margin-bottom:8px">Third-Party Shipping Consent</h2>
-        <p style="color:#555">You are about to place an order that will be shipped to <strong>${escapeHtml(recipientName)}</strong>.</p>
-        <p style="color:#555">Enter this code to confirm your consent:</p>
-        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
-        <p style="color:#888;font-size:12px">This code expires in ${CONSENT_OTP_EXPIRY_MINUTES} minutes. If you did not request this, please ignore this email.</p>
-      </div>
-    `,
+ <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
+ <h2 style="margin-bottom:8px">Third-Party Shipping Consent</h2>
+ <p style="color:#555">You are about to place an order that will be shipped to <strong>${escapeHtml(recipientName)}</strong>.</p>
+ <p style="color:#555">Enter this code to confirm your consent:</p>
+ <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
+ <p style="color:#888;font-size:12px">This code expires in ${CONSENT_OTP_EXPIRY_MINUTES} minutes. If you did not request this, please ignore this email.</p>
+ </div>
+ `,
     };
 }

package/dist/features/auth/hooks/useAuth.d.ts

@@ -1,14 +1,15 @@
+import type { JsonValue } from "@mohasinac/appkit";
 import type { AuthUser } from "../types";
 interface UseCurrentUserOptions {
     initialData?: AuthUser | null;
     enabled?: boolean;
 }
 export declare function useCurrentUser(opts?: UseCurrentUserOptions): {
-    user: AuthUser | null;
+    user: NonNullable<NoInfer<AuthUser | null>> | null;
     isLoading: boolean;
     isAuthenticated: boolean;
     error: Error | null;
-    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<AuthUser | null, Error>>;
+    refetch: (options?: import("@tanstack/query-core").RefetchOptions) => Promise<import("@tanstack/query-core").QueryObserverResult<NoInfer<AuthUser | null>, Error>>;
 };
 export interface LoginCredentials {
     email: string;
@@ -43,46 +44,46 @@ export interface VerifyEmailData {
 }
 export declare function useLogin(options?: {
     onSuccess?: () => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, LoginCredentials, unknown>;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, LoginCredentials, unknown>;
 export declare function useGoogleLogin(options?: {
     onSuccess?: (data: {
         isNewUser: boolean;
         uid: string;
         role: string;
     } | null) => void;
-    onError?: (error: unknown) => void;
+    onError?: (error: Error) => void;
     onSessionSynced?: () => Promise<void> | void;
 }): {
     mutate: () => Promise<void>;
     isLoading: boolean;
 };
 export declare function useRegister(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, RegisterData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, RegisterData, unknown>;
 export declare function useVerifyEmail(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, VerifyEmailData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, VerifyEmailData, unknown>;
 export declare function useResendVerification(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, ResendVerificationData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResendVerificationData, unknown>;
 export declare function useForgotPassword(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, ForgotPasswordData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ForgotPasswordData, unknown>;
 export declare function useResetPassword(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, ResetPasswordData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResetPasswordData, unknown>;
 export declare function useChangePassword(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, ChangePasswordData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ChangePasswordData, unknown>;
 export declare function useChangeEmail(options?: {
-    onSuccess?: (data: unknown) => void;
-    onError?: (error: unknown) => void;
-}): import("@tanstack/react-query").UseMutationResult<unknown, Error, ChangeEmailData, unknown>;
+    onSuccess?: (data: JsonValue) => void;
+    onError?: (error: Error) => void;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ChangeEmailData, unknown>;
 export {};

package/dist/features/auth/hooks/useAuth.js

@@ -1,4 +1,5 @@
 "use client";
+import { normalizeError } from "../../../errors/normalize";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useMutation, useQuery } from "@tanstack/react-query";
 import { getClientAuthProvider } from "../../../contracts/client-auth";
@@ -140,6 +141,7 @@ export function useGoogleLogin(options) {
             }
         }
         catch (err) {
+            void normalizeError(err);
             popup.close();
             setPopupPending(false);
             onErrorRef.current?.(err instanceof Error ? err : new Error("Failed to start sign-in."));
@@ -230,6 +232,7 @@ export function useChangeEmail(options) {
     return useMutation({
         mutationFn: async (data) => {
             await getClientAuthProvider().reauthenticateAndSendEmailUpdateVerification(data.currentPassword, data.newEmail);
+            return null;
         },
         onSuccess: options?.onSuccess,
         onError: options?.onError,

package/dist/features/auth/permissions/constants.d.ts

@@ -11,7 +11,7 @@
  * Permission naming: admin:resource:action
  * Ban action naming: plain verb phrase — write_reviews, place_bids, etc.
  */
-export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write";
+export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
 /**
  * Granular user actions that can be soft-banned individually.
  * A user may have multiple simultaneous soft bans of different types.
@@ -22,7 +22,7 @@ export type BannedAction = "write_reviews" | "write_blog_comments" | "join_event
  * Preset permission bundles. "custom" = no preset, permissions set individually.
  * Used for display and for pre-filling the permissions editor when inviting employees.
  */
-export type EmployeeGroup = "content_moderator" | "review_manager" | "blog_poster" | "community_manager" | "event_handler" | "newsletter_manager" | "seo_manager" | "ad_manager" | "site_manager" | "catalog_manager" | "finance_manager" | "data_analyst" | "customer_support" | "support_agent" | "store_onboarding" | "trust_and_safety" | "auction_monitor" | "scam_moderator" | "custom";
+export type EmployeeGroup = "content_moderator" | "review_manager" | "blog_poster" | "community_manager" | "event_handler" | "newsletter_manager" | "seo_manager" | "ad_manager" | "site_manager" | "catalog_manager" | "finance_manager" | "data_analyst" | "customer_support" | "support_agent" | "store_onboarding" | "trust_and_safety" | "auction_monitor" | "scam_moderator" | "maintenance_employee" | "custom";
 /**
  * Pre-defined permission bundles for each EmployeeGroup.
  * Admin always bypasses; these bundles are only relevant for role=employee.

package/dist/features/auth/permissions/constants.js

@@ -240,6 +240,15 @@ export const PERMISSION_GROUPS = {
         "admin:media:read",
         "admin:media:write",
     ],
+    maintenance_employee: [
+        "admin:dashboard:view",
+        "admin:maintenance:view-server-errors",
+        "admin:maintenance:view-client-errors",
+        "admin:maintenance:view-function-errors",
+        "admin:maintenance:view-cloud-logs",
+        "admin:maintenance:view-payment-rollbacks",
+        "admin:maintenance:run-analysis",
+    ],
 };
 // ============================================================================
 // ROUTE → PERMISSION MAP
@@ -289,6 +298,14 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/feature-flags": "admin:feature-flags:read",
     "/admin/copilot": "admin:copilot:view",
     "/admin/team": "admin:team:read",
+    // Maintenance & Observability (workstream 10)
+    "/admin/maintenance": "admin:maintenance:view-server-errors",
+    "/admin/maintenance/server-errors": "admin:maintenance:view-server-errors",
+    "/admin/maintenance/client-errors": "admin:maintenance:view-client-errors",
+    "/admin/maintenance/function-errors": "admin:maintenance:view-function-errors",
+    "/admin/maintenance/cloud-logs": "admin:maintenance:view-cloud-logs",
+    "/admin/maintenance/payment-rollbacks": "admin:maintenance:view-payment-rollbacks",
+    "/admin/maintenance/analysis": "admin:maintenance:run-analysis",
 };
 /** Default capabilities granted to every new store on creation. */
 export const DEFAULT_STORE_CAPABILITIES = [

package/dist/features/auth/repository/session.repository.js

@@ -1,3 +1,4 @@
+import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { serverLogger } from "../../../monitoring";
 import { BaseRepository, } from "../../../providers/db-firebase";
@@ -37,8 +38,10 @@ export class SessionRepository extends BaseRepository {
         };
         try {
             await this.update(sessionId, updateData);
+            // audit-unknown-ok: error-handler entry point — accepts thrown values of any shape
         }
         catch (err) {
+            void normalizeError(err);
             // The session doc may have been revoked/expired/wiped while the client
             // still holds the cookie. Firestore Admin throws `5 NOT_FOUND` in that
             // case — swallow it so the activity ping is best-effort, not a 500.
@@ -79,6 +82,7 @@ export class SessionRepository extends BaseRepository {
             return snapshot.docs.map((doc) => this.mapDoc(doc));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to find active sessions for user: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }
@@ -92,6 +96,7 @@ export class SessionRepository extends BaseRepository {
             return snapshot.docs.map((doc) => this.mapDoc(doc));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to find all sessions for user: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }
@@ -118,6 +123,7 @@ export class SessionRepository extends BaseRepository {
             return snapshot.docs.map((doc) => this.mapDoc(doc));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to get all active sessions: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }
@@ -136,6 +142,7 @@ export class SessionRepository extends BaseRepository {
             return count;
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to cleanup expired sessions: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }
@@ -168,6 +175,7 @@ export class SessionRepository extends BaseRepository {
             };
         }
         catch (error) {
+            void normalizeError(error);
             serverLogger.error("Error getting session stats", { error });
             return {
                 totalActive: 0,
@@ -224,6 +232,7 @@ export class SessionRepository extends BaseRepository {
             };
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to fetch admin sessions: ${error instanceof Error ? error.message : "Unknown error"}`);
         }
     }

package/dist/features/auth/repository/token.repository.js

@@ -1,3 +1,4 @@
+import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository } from "../../../providers/db-firebase";
 import { TOKEN_PII_FIELDS, TOKEN_PII_INDEX_MAP, addPiiIndices, decryptPiiFields, encryptPiiFields, piiBlindIndex, } from "../../../security";
@@ -11,6 +12,7 @@ export class EmailVerificationTokenRepository extends BaseRepository {
         const raw = super.mapDoc(snap);
         return decryptPiiFields(raw, [
             ...TOKEN_PII_FIELDS,
+            // audit-unknown-ok: TS structural escape — generic param
         ]);
     }
     async create(data) {
@@ -49,6 +51,7 @@ export class EmailVerificationTokenRepository extends BaseRepository {
             return snapshot.size;
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to delete expired tokens", error);
         }
     }
@@ -70,6 +73,7 @@ export class EmailVerificationTokenRepository extends BaseRepository {
             await batch.commit();
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to delete tokens for user: ${userId}`, error);
         }
     }
@@ -82,6 +86,7 @@ export class PasswordResetTokenRepository extends BaseRepository {
         const raw = super.mapDoc(snap);
         return decryptPiiFields(raw, [
             ...TOKEN_PII_FIELDS,
+            // audit-unknown-ok: TS structural escape — generic param
         ]);
     }
     async create(data) {
@@ -120,6 +125,7 @@ export class PasswordResetTokenRepository extends BaseRepository {
             return this.findByIdOrFail(tokenId);
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to mark token as used: ${tokenId}`, error);
         }
     }
@@ -132,6 +138,7 @@ export class PasswordResetTokenRepository extends BaseRepository {
             return snapshot.docs.map((doc) => this.mapDoc(doc));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to find unused tokens for user: ${userId}`, error);
         }
     }
@@ -146,6 +153,7 @@ export class PasswordResetTokenRepository extends BaseRepository {
             return snapshot.size;
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to delete expired tokens", error);
         }
     }
@@ -167,6 +175,7 @@ export class PasswordResetTokenRepository extends BaseRepository {
             await batch.commit();
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to delete tokens for user: ${userId}`, error);
         }
     }

package/dist/features/auth/repository/user.repository.js

@@ -1,3 +1,4 @@
+import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, } from "../../../providers/db-firebase";
 import { USER_PII_FIELDS, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptPiiFields, encryptShippingConfig, piiBlindIndex, } from "../../../security";
@@ -23,18 +24,18 @@ export class UserRepository extends BaseRepository {
         // plaintext `data` back into the result, which would overwrite the encrypted
         // ciphertext with the original plaintext values, defeating the encryption.
         const encrypted = encryptPiiFields(data, [...USER_PII_FIELDS]);
-        if (encrypted.payoutDetails) {
-            encrypted.payoutDetails =
-                encryptPayoutDetails(encrypted.payoutDetails);
+        const access = encrypted;
+        if (access.payoutDetails) {
+            access.payoutDetails = encryptPayoutDetails(access.payoutDetails);
         }
-        if (encrypted.shippingConfig) {
-            encrypted.shippingConfig =
-                encryptShippingConfig(encrypted.shippingConfig);
+        if (access.shippingConfig) {
+            access.shippingConfig = encryptShippingConfig(access.shippingConfig);
         }
         return encrypted;
     }
     mapDoc(snap) {
         const raw = super.mapDoc(snap);
+        // audit-unknown-ok: TS structural escape — generic param
         return this.decryptUser(raw);
     }
     async createWithId(id, data) {
@@ -80,6 +81,7 @@ export class UserRepository extends BaseRepository {
             return snapshot.docs.map((doc) => this.mapDoc(doc));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to fetch verified users", error);
         }
     }
@@ -93,6 +95,7 @@ export class UserRepository extends BaseRepository {
             return snapshot.docs.map((doc) => this.mapDoc(doc));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to fetch active users", error);
         }
     }
@@ -138,6 +141,7 @@ export class UserRepository extends BaseRepository {
             return await getFirestoreCount(this.getCollection().where(USER_FIELDS.ROLE, "==", role));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError(`Failed to count users by role: ${role}`, error);
         }
     }
@@ -146,6 +150,7 @@ export class UserRepository extends BaseRepository {
             return await getFirestoreCount(this.getCollection().where(USER_FIELDS.DISABLED, "==", false));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to count active users", error);
         }
     }
@@ -154,6 +159,7 @@ export class UserRepository extends BaseRepository {
             return await getFirestoreCount(this.getCollection().where(USER_FIELDS.DISABLED, "==", true));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to count disabled users", error);
         }
     }
@@ -162,6 +168,7 @@ export class UserRepository extends BaseRepository {
             return await getFirestoreCount(this.getCollection().where(USER_FIELDS.CREATED_AT, ">=", since));
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to count new users", error);
         }
     }
@@ -183,6 +190,7 @@ export class UserRepository extends BaseRepository {
             });
         }
         catch (error) {
+            void normalizeError(error);
             throw new DatabaseError("Failed to update login metadata", error);
         }
     }

package/dist/features/auth/role-predicates.d.ts

@@ -1,16 +1,20 @@
-import type { UserRole } from "./types";
-export declare const isAdminUser: (input?: {
-    role?: UserRole;
-}) => boolean;
-export declare const isSellerUser: (input?: {
-    role?: UserRole;
-}) => boolean;
-export declare const isModeratorUser: (input?: {
-    role?: UserRole;
-}) => boolean;
-export declare const isEmployeeUser: (input?: {
-    role?: UserRole;
-}) => boolean;
-export declare const isBuyerUser: (input?: {
-    role?: UserRole;
-}) => boolean;
+/**
+ * Canonical user-role predicates — mirror of the listing-type accessors in
+ * `features/products/utils/listing-type.ts`. Read the canonical role
+ * discriminator off any object that carries a string `role` field and return
+ * a boolean. Undefined or null input falls back to `"user"` so legacy payloads
+ * classify safely without a separate guard.
+ *
+ * Input shape is `{ role?: string }` rather than `{ role?: UserRole }` so the
+ * predicates compose with `RouteUser`, `UserDocument`, and the various
+ * `AuthUser`-shaped objects without each callsite having to cast.
+ */
+type RoleCarrier = {
+    role?: string | null;
+} | null | undefined;
+export declare const isAdminUser: (input: RoleCarrier) => boolean;
+export declare const isSellerUser: (input: RoleCarrier) => boolean;
+export declare const isModeratorUser: (input: RoleCarrier) => boolean;
+export declare const isEmployeeUser: (input: RoleCarrier) => boolean;
+export declare const isBuyerUser: (input: RoleCarrier) => boolean;
+export {};

package/dist/features/auth/role-predicates.js

@@ -1,12 +1,5 @@
-/**
- * Canonical user-role predicates — mirror of the listing-type accessors in
- * `features/products/utils/listing-type.ts`. Read the canonical role
- * discriminator off an `AuthUser`/`UserDocument`-shaped object and return a
- * boolean. Undefined input falls back to `"user"` so legacy payloads classify
- * safely without a separate guard. SB-UNI-E 2026-05-13.
- */
 function normalizeRole(input) {
-    return input?.role ?? "user";
+    return (input?.role ?? "user");
 }
 export const isAdminUser = (input) => normalizeRole(input) === "admin";
 export const isSellerUser = (input) => normalizeRole(input) === "seller";

package/dist/features/auth/schemas/index.d.ts

@@ -11,23 +11,23 @@ export declare const loginSchema: z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;
 }, "strip", z.ZodTypeAny, {
-    email: string;
     password: string;
-}, {
     email: string;
+}, {
     password: string;
+    email: string;
 }>;
 export declare const registerSchema: z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;
     displayName: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    email: string;
     password: string;
+    email: string;
     displayName?: string | undefined;
 }, {
-    email: string;
     password: string;
+    email: string;
     displayName?: string | undefined;
 }>;
 export declare const forgotPasswordSchema: z.ZodObject<{
@@ -57,15 +57,15 @@ export declare const authUserSchema: z.ZodObject<{
     isEmailVerified: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     id: string;
-    role?: "user" | "seller" | "moderator" | "employee" | "admin" | undefined;
     email?: string | undefined;
+    role?: "user" | "seller" | "moderator" | "employee" | "admin" | undefined;
     displayName?: string | undefined;
     photoURL?: string | undefined;
     isEmailVerified?: boolean | undefined;
 }, {
     id: string;
-    role?: "user" | "seller" | "moderator" | "employee" | "admin" | undefined;
     email?: string | undefined;
+    role?: "user" | "seller" | "moderator" | "employee" | "admin" | undefined;
     displayName?: string | undefined;
     photoURL?: string | undefined;
     isEmailVerified?: boolean | undefined;

package/dist/features/auth/server/checkSoftBan.js

@@ -1,9 +1,10 @@
+import { isAdminUser, isEmployeeUser } from "../role-predicates";
 /**
  * Returns true when the user has an active (non-expired) soft ban for the
  * given action. Admin and employee roles always bypass soft-ban checks.
  */
 export function isSoftBanned(user, action) {
-    if (user.role === "admin" || user.role === "employee")
+    if (isAdminUser(user) || isEmployeeUser(user))
         return false;
     if (!user.softBans || user.softBans.length === 0)
         return false;

package/dist/features/before-after/api/[id]/route.js

@@ -10,6 +10,7 @@
  */
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../../contracts";
+import { normalizeError } from "../../../../errors/normalize";
 const ERR_DB_NOT_CONFIGURED = "DB not configured";
 const ERR_INTERNAL_SERVER_ERROR = "Internal server error";
 export async function GET(request, { params }) {
@@ -32,6 +33,7 @@ export async function GET(request, { params }) {
         });
     }
     catch (error) {
+        void normalizeError(error);
         return NextResponse.json({
             success: false,
             error: error instanceof Error ? error.message : ERR_INTERNAL_SERVER_ERROR,
@@ -59,6 +61,7 @@ export async function PATCH(request, { params }) {
         });
     }
     catch (error) {
+        void normalizeError(error);
         return NextResponse.json({
             success: false,
             error: error instanceof Error ? error.message : ERR_INTERNAL_SERVER_ERROR,
@@ -82,6 +85,7 @@ export async function DELETE(request, { params }) {
         });
     }
     catch (error) {
+        void normalizeError(error);
         return NextResponse.json({
             success: false,
             error: error instanceof Error ? error.message : ERR_INTERNAL_SERVER_ERROR,

package/dist/features/before-after/api/route.js

@@ -10,6 +10,7 @@
  */
 import { NextResponse } from "next/server.js";
 import { getProviders } from "../../../contracts";
+import { normalizeError } from "../../../errors/normalize";
 function numParam(url, key, fallback) {
     const v = url.searchParams.get(key);
     const n = v !== null ? Number(v) : NaN;
@@ -48,6 +49,7 @@ export async function GET(request) {
         });
     }
     catch (error) {
+        void normalizeError(error);
         return NextResponse.json({
             success: false,
             error: error instanceof Error ? error.message : "Internal server error",
@@ -71,6 +73,7 @@ export async function POST(request) {
         }, { status: 201 });
     }
     catch (error) {
+        void normalizeError(error);
         return NextResponse.json({
             success: false,
             error: error instanceof Error ? error.message : "Internal server error",

package/dist/features/before-after/components/BeforeAfterGallery.js

@@ -1,8 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { BeforeAfterSlider } from "./BeforeAfterSlider";
-import { Div, Text } from "../../../ui";
+import { Div, Stack, Text } from "../../../ui";
 export function BeforeAfterGallery({ items, className = "", }) {
     if (items.length === 0)
         return null;
-    return (_jsx(Div, { className: `grid grid-cols-1 gap-6 sm:grid-cols-2 lg:grid-cols-3 ${className}`, children: items.map((item) => (_jsxs(Div, { className: "flex flex-col gap-2", children: [_jsx(BeforeAfterSlider, { item: item }), (item.title || item.description) && (_jsxs(Div, { className: "text-center", children: [item.title && (_jsx(Text, { className: "text-sm font-semibold text-zinc-900 dark:text-zinc-100", children: item.title })), item.description && (_jsx(Text, { className: "mt-0.5 text-xs text-zinc-500 dark:text-zinc-400", children: item.description }))] }))] }, item.id))) }));
+    return (_jsx(Div, { layout: "grid", gap: "6", className: `grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 ${className}`, children: items.map((item) => (_jsxs(Stack, { gap: "sm", children: [_jsx(BeforeAfterSlider, { item: item }), (item.title || item.description) && (_jsxs(Div, { className: "text-center", children: [item.title && (_jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: item.title })), item.description && (_jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: item.description }))] }))] }, item.id))) }));
 }

package/dist/features/before-after/components/BeforeAfterSlider.js

@@ -1,7 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useRef, useState } from "react";
-import { Div, Span } from "../../../ui";
+import { Div, Span, Stack } from "../../../ui";
 export function BeforeAfterSlider({ item, className = "", }) {
     const [position, setPosition] = useState(50);
     const containerRef = useRef(null);
@@ -20,8 +20,8 @@ export function BeforeAfterSlider({ item, className = "", }) {
         const x = Math.max(0, Math.min(clientX - rect.left, rect.width));
         setPosition((x / rect.width) * 100);
     }
-    return (_jsxs(Div, { ref: containerRef, className: `relative aspect-square select-none overflow-hidden rounded-xl ${className}`, onPointerMove: handlePointerMove, onTouchMove: handleTouchMove, children: [_jsx(Div, { role: "img", "aria-label": "After", className: "absolute inset-0 h-full w-full bg-center bg-cover", style: { backgroundImage: `url(${item.afterImageUrl})` } }), _jsx(Div, { className: "absolute inset-0 overflow-hidden", style: { width: `${position}%` }, children: _jsx(Div, { role: "img", "aria-label": "Before", className: "h-full w-full bg-center bg-cover", style: {
+    return (_jsxs(Div, { ref: containerRef, className: `relative aspect-square select-none overflow-hidden ${className}`, rounded: "xl", onPointerMove: handlePointerMove, onTouchMove: handleTouchMove, children: [_jsx(Div, { role: "img", "aria-label": "After", className: "absolute inset-0 h-full w-full bg-center bg-cover", style: { backgroundImage: `url(${item.afterImageUrl})` } }), _jsx(Div, { className: "absolute inset-0 overflow-hidden", style: { width: `${position}%` }, children: _jsx(Div, { role: "img", "aria-label": "Before", className: "h-full w-full bg-center bg-cover", style: {
                         width: containerRef.current?.offsetWidth ?? "100%",
                         backgroundImage: `url(${item.beforeImageUrl})`,
-                    } }) }), _jsxs(Div, { className: "absolute inset-y-0 flex w-1 -translate-x-1/2 cursor-ew-resize flex-col items-center justify-center", style: { left: `${position}%` }, children: [_jsx(Div, { className: "h-full w-0.5 bg-white/80 shadow" }), _jsx(Div, { className: "absolute h-8 w-8 rounded-full border-2 border-white bg-white/80 shadow-md" })] }), _jsx(Span, { size: "xs", weight: "medium", className: "absolute left-2 top-2 rounded bg-black/40 px-2 py-0.5 text-white", children: "Before" }), _jsx(Span, { size: "xs", weight: "medium", className: "absolute right-2 top-2 rounded bg-black/40 px-2 py-0.5 text-white", children: "After" }), item.durationWeeks && (_jsxs(Span, { size: "xs", weight: "medium", className: "absolute bottom-2 left-1/2 -translate-x-1/2 rounded bg-black/50 px-3 py-1 text-white", children: [item.durationWeeks, " weeks"] }))] }));
+                    } }) }), _jsxs(Stack, { justify: "center", className: "absolute inset-y-0 w-1 -translate-x-1/2 cursor-ew-resize", align: "center", style: { left: `${position}%` }, children: [_jsx(Div, { className: "h-full w-0.5 shadow", surface: "default" }), _jsx(Div, { className: "absolute h-8 w-8 border-2 border-white", surface: "default", rounded: "full", shadow: "md" })] }), _jsx(Span, { surface: "overlay-xs", color: "inverse", size: "xs", weight: "medium", className: "absolute left-2 top-2", rounded: "default", padding: "pill-xs", children: "Before" }), _jsx(Span, { surface: "overlay-xs", color: "inverse", size: "xs", weight: "medium", className: "absolute right-2 top-2", rounded: "default", padding: "pill-xs", children: "After" }), item.durationWeeks && (_jsxs(Span, { surface: "overlay-sm", color: "inverse", size: "xs", weight: "medium", className: "absolute bottom-2 left-1/2 -translate-x-1/2", rounded: "default", padding: "pill-md", children: [item.durationWeeks, " weeks"] }))] }));
 }