@mohasinac/appkit 2.8.9 → 3.0.0

package/dist/_internal/server/features/products/actions.d.ts

@@ -1,7 +1,8 @@
-export declare function createProductAction(input: unknown): Promise<import("../../../..").ProductDocument>;
-export declare function createAuctionAction(input: unknown): Promise<import("../../../..").ProductDocument>;
-export declare function createPreOrderAction(input: unknown): Promise<import("../../../..").ProductDocument>;
-export declare function updateProductAction(productId: string, input: unknown): Promise<import("../../../..").ProductDocument>;
-export declare function deleteProductAction(productId: string): Promise<void>;
-export declare function setProductStatusAction(input: unknown): Promise<import("../../../..").ProductDocument>;
-export declare function setProductFeaturedAction(input: unknown): Promise<import("../../../..").ProductDocument>;
+import { type ActionResult } from "@mohasinac/appkit/server";
+export declare function createProductAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function createAuctionAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function createPreOrderAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function updateProductAction(productId: string, input: unknown): Promise<ActionResult<unknown>>;
+export declare function deleteProductAction(productId: string): Promise<ActionResult<unknown>>;
+export declare function setProductStatusAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function setProductFeaturedAction(input: unknown): Promise<ActionResult<unknown>>;

package/dist/_internal/server/features/products/actions.js

@@ -1,81 +1,103 @@
 "use server";
+import { wrapAction } from "@mohasinac/appkit/server";
 import { productRepository } from "../../../../repositories";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
+import { isAdminUser } from "../../../../features/auth/role-predicates";
 import { productInputSchema, productUpdateSchema, auctionInputSchema, preOrderInputSchema, setFeaturedSchema, setStatusSchema, } from "../../../shared/features/products/schema";
 import { assertProductOwnership, assertStatusTransition } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function createProductAction(input) {
-    const user = await requireRoleUser(["seller", "admin"]);
-    const parsed = productInputSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-    return productRepository.create({
-        ...parsed.data,
-        storeId: user.uid,
-        status: "draft",
-        listingType: "standard",
-        featured: false,
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["seller", "admin"]);
+        const parsed = productInputSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
+        return productRepository.create({
+            ...parsed.data,
+            storeId: user.uid,
+            status: "draft",
+            listingType: "standard",
+            featured: false,
+        });
     });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function createAuctionAction(input) {
-    const user = await requireRoleUser(["seller", "admin"]);
-    const parsed = auctionInputSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-    return productRepository.create({
-        ...parsed.data,
-        storeId: user.uid,
-        status: "draft",
-        listingType: "auction",
-        featured: false,
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["seller", "admin"]);
+        const parsed = auctionInputSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
+        return productRepository.create({
+            ...parsed.data,
+            storeId: user.uid,
+            status: "draft",
+            listingType: "auction",
+            featured: false,
+        });
     });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function createPreOrderAction(input) {
-    const user = await requireRoleUser(["seller", "admin"]);
-    const parsed = preOrderInputSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-    return productRepository.create({
-        ...parsed.data,
-        storeId: user.uid,
-        status: "draft",
-        listingType: "pre-order",
-        featured: false,
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["seller", "admin"]);
+        const parsed = preOrderInputSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
+        return productRepository.create({
+            ...parsed.data,
+            storeId: user.uid,
+            status: "draft",
+            listingType: "pre-order",
+            featured: false,
+        });
     });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function updateProductAction(productId, input) {
-    const user = await requireRoleUser(["seller", "admin"]);
-    await assertProductOwnership(productId, user.uid);
-    const parsed = productUpdateSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-    return productRepository.update(productId, parsed.data);
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["seller", "admin"]);
+        await assertProductOwnership(productId, user.uid);
+        const parsed = productUpdateSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
+        return productRepository.update(productId, parsed.data);
+    });
 }
 export async function deleteProductAction(productId) {
-    const user = await requireRoleUser(["seller", "admin"]);
-    await assertProductOwnership(productId, user.uid);
-    return productRepository.delete(productId);
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["seller", "admin"]);
+        await assertProductOwnership(productId, user.uid);
+        return productRepository.delete(productId);
+    });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function setProductStatusAction(input) {
-    const user = await requireRoleUser(["seller", "admin"]);
-    const parsed = setStatusSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-    const product = await assertProductOwnership(parsed.data.productId, user.uid);
-    assertStatusTransition(product.status, parsed.data.status);
-    // SB-UNI-O — live listings must be admin-verified before a seller can publish them.
-    if (parsed.data.status === "published" &&
-        (product.listingType ?? "standard") === "live" &&
-        !product.liveItem?.vendorVerified &&
-        user.role !== "admin") {
-        throw new ValidationError("Live listings require admin verification before publishing. Contact support to request verification.");
-    }
-    return productRepository.update(parsed.data.productId, { status: parsed.data.status });
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["seller", "admin"]);
+        const parsed = setStatusSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
+        const product = await assertProductOwnership(parsed.data.productId, user.uid);
+        assertStatusTransition(product.status, parsed.data.status);
+        // SB-UNI-O — live listings must be admin-verified before a seller can publish them.
+        if (parsed.data.status === "published" &&
+            (product.listingType ?? "standard") === "live" &&
+            !product.liveItem?.vendorVerified &&
+            !isAdminUser(user)) {
+            throw new ValidationError("Live listings require admin verification before publishing. Contact support to request verification.");
+        }
+        return productRepository.update(parsed.data.productId, { status: parsed.data.status });
+    });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function setProductFeaturedAction(input) {
-    await requireRoleUser("admin");
-    const parsed = setFeaturedSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-    return productRepository.update(parsed.data.productId, { featured: parsed.data.featured });
+    return wrapAction(async () => {
+        await requireRoleUser("admin");
+        const parsed = setFeaturedSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
+        return productRepository.update(parsed.data.productId, { featured: parsed.data.featured });
+    });
 }

package/dist/_internal/server/features/products/service.js

@@ -46,6 +46,7 @@ export function isAvailableForPurchase(product) {
     if (isAuctionListing(product)) {
         const endDate = product.auctionEndDate instanceof Date
             ? product.auctionEndDate
+            // audit-unknown-ok: TS structural escape — primitive cast
             : product.auctionEndDate ? new Date(product.auctionEndDate) : null;
         return endDate ? endDate.getTime() > Date.now() : false;
     }

package/dist/_internal/server/features/promotions/actions.d.ts

@@ -1,9 +1,5 @@
-export declare function applyCouponAction(input: unknown): Promise<{
-    couponId: string;
-    code: string;
-    discount: number;
-    type: import("../../../..").CouponType;
-}>;
-export declare function createCouponAction(input: unknown): Promise<import("../../../..").CouponDocument>;
-export declare function updateCouponAction(couponId: string, input: unknown): Promise<import("../../../..").CouponDocument>;
-export declare function deactivateCouponAction(couponId: string): Promise<import("../../../..").CouponDocument>;
+import { type ActionResult } from "@mohasinac/appkit/server";
+export declare function applyCouponAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function createCouponAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function updateCouponAction(couponId: string, input: unknown): Promise<ActionResult<unknown>>;
+export declare function deactivateCouponAction(couponId: string): Promise<ActionResult<unknown>>;

package/dist/_internal/server/features/promotions/actions.js

@@ -1,4 +1,5 @@
 "use server";
+import { wrapAction } from "@mohasinac/appkit/server";
 import { couponsRepository } from "../../../../repositories";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { applyCouponSchema, createCouponSchema, updateCouponSchema, } from "../../../shared/features/promotions/schema";
@@ -6,36 +7,47 @@ import { validateCoupon, computeDiscount } from "./service";
 import { CouponNotFoundError } from "../../../shared/features/promotions/errors";
 import { ValidationError } from "../../../shared/errors/index";
 const ERR_INVALID_COUPON_INPUT = "Invalid coupon input";
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function applyCouponAction(input) {
-    const user = await requireRoleUser(["buyer", "seller", "admin"]);
-    const parsed = applyCouponSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);
-    const coupon = await validateCoupon(parsed.data, user.uid);
-    const discount = computeDiscount(coupon, parsed.data.cartTotal);
-    // Coupon usage is recorded ONLY after order confirmation
-    // (see `_internal/server/features/checkout/actions.ts`). Validating /
-    // applying a coupon to a cart must never consume a redemption.
-    return { couponId: coupon.id, code: coupon.code, discount, type: coupon.type };
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        const parsed = applyCouponSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);
+        const coupon = await validateCoupon(parsed.data, user.uid);
+        const discount = computeDiscount(coupon, parsed.data.cartTotal);
+        // Coupon usage is recorded ONLY after order confirmation
+        // (see `_internal/server/features/checkout/actions.ts`). Validating /
+        // applying a coupon to a cart must never consume a redemption.
+        return { couponId: coupon.id, code: coupon.code, discount, type: coupon.type };
+    });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function createCouponAction(input) {
-    const user = await requireRoleUser(["admin", "seller"]);
-    const parsed = createCouponSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);
-    return couponsRepository.createWithId(`coupon-${parsed.data.code.toLowerCase()}`, { ...parsed.data, createdBy: user.uid, usage: { ...parsed.data.usage, currentUsage: 0 } });
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["admin", "seller"]);
+        const parsed = createCouponSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);
+        return couponsRepository.createWithId(`coupon-${parsed.data.code.toLowerCase()}`, { ...parsed.data, createdBy: user.uid, usage: { ...parsed.data.usage, currentUsage: 0 } });
+    });
 }
+// audit-unknown-ok: callback entry point — accepts arbitrary payload value
 export async function updateCouponAction(couponId, input) {
-    await requireRoleUser(["admin", "seller"]);
-    const coupon = await couponsRepository.findById(couponId).catch(() => null);
-    if (!coupon)
-        throw new CouponNotFoundError(couponId);
-    const parsed = updateCouponSchema.safeParse(input);
-    if (!parsed.success)
-        throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);
-    return couponsRepository.update(couponId, parsed.data);
+    return wrapAction(async () => {
+        await requireRoleUser(["admin", "seller"]);
+        const coupon = await couponsRepository.findById(couponId).catch(() => null);
+        if (!coupon)
+            throw new CouponNotFoundError(couponId);
+        const parsed = updateCouponSchema.safeParse(input);
+        if (!parsed.success)
+            throw new ValidationError(parsed.error.issues[0]?.message ?? ERR_INVALID_COUPON_INPUT);
+        return couponsRepository.update(couponId, parsed.data);
+    });
 }
 export async function deactivateCouponAction(couponId) {
-    await requireRoleUser(["admin", "seller"]);
-    return couponsRepository.update(couponId, { "validity.isActive": false });
+    return wrapAction(async () => {
+        await requireRoleUser(["admin", "seller"]);
+        return couponsRepository.update(couponId, { "validity.isActive": false });
+    });
 }

package/dist/_internal/server/features/raffle/actions.d.ts

@@ -5,7 +5,8 @@
  * handlers also work in a Vercel lambda (10s cap honoured by raffle pool
  * size).
  */
+import { type ActionResult } from "@mohasinac/appkit/server";
 import { type TriggerEventRaffleInput, type TriggerEventRaffleResult } from "../../jobs/core/triggerEventRaffle";
 import { type AssignSpinPrizeInput, type AssignSpinPrizeResult } from "../../jobs/core/assignSpinPrize";
-export declare function triggerEventRaffleAction(input: TriggerEventRaffleInput): Promise<TriggerEventRaffleResult>;
-export declare function assignSpinPrizeAction(input: AssignSpinPrizeInput): Promise<AssignSpinPrizeResult>;
+export declare function triggerEventRaffleAction(input: TriggerEventRaffleInput): Promise<ActionResult<TriggerEventRaffleResult>>;
+export declare function assignSpinPrizeAction(input: AssignSpinPrizeInput): Promise<ActionResult<AssignSpinPrizeResult>>;

package/dist/_internal/server/features/raffle/actions.js

@@ -1,3 +1,4 @@
+"use server";
 /**
  * SB9-H — server actions for triggering an event raffle / assigning a spin
  * prize from a Next.js API route. Builds an ad-hoc JobContext around
@@ -5,7 +6,7 @@
  * handlers also work in a Vercel lambda (10s cap honoured by raffle pool
  * size).
  */
-"use server";
+import { wrapAction } from "@mohasinac/appkit/server";
 import { getAdminDb } from "../../../../providers/db-firebase/admin";
 import { runTriggerEventRaffle, } from "../../jobs/core/triggerEventRaffle";
 import { runAssignSpinPrize, } from "../../jobs/core/assignSpinPrize";
@@ -24,8 +25,8 @@ function buildContext(job) {
     };
 }
 export async function triggerEventRaffleAction(input) {
-    return runTriggerEventRaffle(input, buildContext("admin.triggerEventRaffle"));
+    return wrapAction(async () => runTriggerEventRaffle(input, buildContext("admin.triggerEventRaffle")));
 }
 export async function assignSpinPrizeAction(input) {
-    return runAssignSpinPrize(input, buildContext("user.assignSpinPrize"));
+    return wrapAction(async () => runAssignSpinPrize(input, buildContext("user.assignSpinPrize")));
 }

package/dist/_internal/server/features/refunds/actions.d.ts

@@ -1,3 +1,4 @@
+import { type ActionResult } from "@mohasinac/appkit/server";
 import type { RefundType } from "../../../../features/orders/schemas";
 export type ProcessRefundInput = {
     orderId: string;
@@ -25,7 +26,7 @@ export type ProcessRefundInput = {
     proofDocumentUrl?: string;
     proofDocumentMimeType?: string;
 });
-export declare function processRefundAction(input: ProcessRefundInput): Promise<{
+export declare function processRefundAction(input: ProcessRefundInput): Promise<ActionResult<{
     success: true;
     refundId: string;
-}>;
+}>>;

package/dist/_internal/server/features/refunds/actions.js

@@ -1,4 +1,5 @@
 "use server";
+import { wrapAction } from "@mohasinac/appkit/server";
 /**
  * processRefundAction — append a refund event to an order.
  *
@@ -22,101 +23,118 @@ import { serverLogger } from "../../../../monitoring";
 import { applyRefundDeductionAction } from "../payouts/actions";
 import { getAdminDb } from "../../../../providers/db-firebase";
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION, } from "../../../../features/products/schemas/firestore";
-export async function processRefundAction(input) {
-    const order = await orderRepository.findById(input.orderId);
-    if (!order)
-        throw new NotFoundError(`Order ${input.orderId} not found`);
-    if (input.amountInPaise <= 0)
-        throw new ValidationError("Refund amount must be positive");
-    if (input.amountInPaise > order.totalPrice) {
-        throw new ValidationError("Refund amount exceeds order total");
-    }
-    // Guard: non-refundable orders (prize draws, bundles).
-    if (order.isNonRefundable) {
-        throw new ValidationError("This order is marked non-refundable and cannot be refunded.");
-    }
-    // SB-UNI-N — digital-code refund gate: block if code is already claimed (revealed).
-    const digitalCodeItems = (order.items ?? []).filter((i) => (i.listingType ?? "standard") === "digital-code");
-    if (digitalCodeItems.length > 0) {
-        const db = getAdminDb();
-        for (const item of digitalCodeItems) {
-            const codesSnap = await db
-                .collection(PRODUCT_COLLECTION)
-                .doc(item.productId)
-                .collection(PRODUCT_CODES_SUBCOLLECTION)
-                .where("orderId", "==", input.orderId)
-                .limit(1)
-                .get();
-            if (!codesSnap.empty) {
-                const codeStatus = codesSnap.docs[0].data()?.status;
-                if (codeStatus === "claimed") {
-                    throw new ValidationError("The digital code for this order has already been revealed and cannot be refunded automatically. Please contact support.");
-                }
-            }
+/**
+ * SB-UNI-N — block the refund if any of the order's digital codes has already
+ * been claimed (revealed). Throws ValidationError on the first claimed code.
+ */
+async function assertDigitalCodesNotClaimed(orderId, items) {
+    if (items.length === 0)
+        return;
+    const db = getAdminDb();
+    for (const item of items) {
+        const codesSnap = await db
+            .collection(PRODUCT_COLLECTION)
+            .doc(item.productId)
+            .collection(PRODUCT_CODES_SUBCOLLECTION)
+            .where("orderId", "==", orderId)
+            .limit(1)
+            .get();
+        if (codesSnap.empty)
+            continue;
+        const codeStatus = codesSnap.docs[0].data()?.status;
+        if (codeStatus === "claimed") {
+            throw new ValidationError("The digital code for this order has already been revealed and cannot be refunded automatically. Please contact support.");
         }
     }
-    const refundId = randomUUID();
-    const now = new Date();
-    let razorpayRefundId;
-    if (input.method === "razorpay") {
-        const payment = getProviders().payment;
-        if (!payment)
-            throw new ValidationError("Payment provider not configured");
-        const result = await payment.refund(input.razorpayPaymentId, input.amountInPaise);
-        razorpayRefundId = result.id;
+}
+/**
+ * SB-UNI-N — fire-and-forget revoke of any AVAILABLE (unclaimed) digital code
+ * tied to the refunded order. Failures are logged but never thrown.
+ */
+function revokeAvailableDigitalCodes(orderId, items) {
+    if (items.length === 0)
+        return;
+    const db = getAdminDb();
+    for (const item of items) {
+        db.collection(PRODUCT_COLLECTION)
+            .doc(item.productId)
+            .collection(PRODUCT_CODES_SUBCOLLECTION)
+            .where("orderId", "==", orderId)
+            .where(ORDER_FIELDS.STATUS, "==", "available")
+            .limit(1)
+            .get()
+            .then((snap) => revokeFirstSnapDoc(snap))
+            .catch((e) => serverLogger.error("refund: code query failed", e));
     }
-    const isFull = input.amountInPaise >= order.totalPrice;
-    const event = {
-        refundId,
-        type: input.type,
-        amount: input.amountInPaise,
-        ...(input.itemIds?.length ? { itemIds: input.itemIds } : {}),
-        reason: input.reason,
-        refundedAt: now,
-        refundedBy: input.refundedBy,
-        ...(razorpayRefundId ? { razorpayRefundId } : {}),
-        ...(input.method === "manual" && input.manualTransactionId
-            ? { manualTransactionId: input.manualTransactionId }
-            : {}),
-        ...(input.method === "manual" && input.proofDocumentUrl
-            ? {
-                proofDocumentUrl: input.proofDocumentUrl,
-                proofDocumentMimeType: input.proofDocumentMimeType,
-            }
-            : {}),
-    };
-    await orderRepository.postRefundEvent(input.orderId, event, isFull);
-    // SB-UNI-N — revoke any available (unclaimed) digital codes linked to this order.
-    if (digitalCodeItems.length > 0) {
-        const db = getAdminDb();
-        for (const item of digitalCodeItems) {
-            db.collection(PRODUCT_COLLECTION)
-                .doc(item.productId)
-                .collection(PRODUCT_CODES_SUBCOLLECTION)
-                .where("orderId", "==", input.orderId)
-                .where(ORDER_FIELDS.STATUS, "==", "available")
-                .limit(1)
-                .get()
-                .then((snap) => {
-                if (!snap.empty) {
-                    snap.docs[0].ref
-                        .update({ status: "revoked", updatedAt: new Date() })
-                        .catch((e) => serverLogger.error("refund: code revoke failed", e));
-                }
-            })
-                .catch((e) => serverLogger.error("refund: code query failed", e));
+}
+function revokeFirstSnapDoc(snap) {
+    if (snap.empty)
+        return;
+    snap.docs[0].ref
+        .update({ status: "revoked", updatedAt: new Date() })
+        .catch((e) => serverLogger.error("refund: code revoke failed", e));
+}
+export async function processRefundAction(input) {
+    return wrapAction(async () => {
+        const order = await orderRepository.findById(input.orderId);
+        if (!order)
+            throw new NotFoundError(`Order ${input.orderId} not found`);
+        if (input.amountInPaise <= 0)
+            throw new ValidationError("Refund amount must be positive");
+        if (input.amountInPaise > order.totalPrice) {
+            throw new ValidationError("Refund amount exceeds order total");
         }
-    }
-    // Fire-and-forget: deduct from the store's pending payout if one exists.
-    // Failure here must not roll back the already-posted refund event.
-    if (order.storeId) {
-        applyRefundDeductionAction({
-            storeId: order.storeId,
-            orderId: input.orderId,
+        // Guard: non-refundable orders (prize draws, bundles).
+        if (order.isNonRefundable) {
+            throw new ValidationError("This order is marked non-refundable and cannot be refunded.");
+        }
+        // SB-UNI-N — digital-code refund gate: block if code is already claimed (revealed).
+        const digitalCodeItems = (order.items ?? []).filter((i) => (i.listingType ?? "standard") === "digital-code");
+        await assertDigitalCodesNotClaimed(input.orderId, digitalCodeItems);
+        const refundId = randomUUID();
+        const now = new Date();
+        let razorpayRefundId;
+        if (input.method === "razorpay") {
+            const payment = getProviders().payment;
+            if (!payment)
+                throw new ValidationError("Payment provider not configured");
+            const result = await payment.refund(input.razorpayPaymentId, input.amountInPaise);
+            razorpayRefundId = result.id;
+        }
+        const isFull = input.amountInPaise >= order.totalPrice;
+        const event = {
             refundId,
-            refundedAmountInPaise: input.amountInPaise,
+            type: input.type,
+            amount: input.amountInPaise,
+            ...(input.itemIds?.length ? { itemIds: input.itemIds } : {}),
             reason: input.reason,
-        }).catch(() => { });
-    }
-    return { success: true, refundId };
+            refundedAt: now,
+            refundedBy: input.refundedBy,
+            ...(razorpayRefundId ? { razorpayRefundId } : {}),
+            ...(input.method === "manual" && input.manualTransactionId
+                ? { manualTransactionId: input.manualTransactionId }
+                : {}),
+            ...(input.method === "manual" && input.proofDocumentUrl
+                ? {
+                    proofDocumentUrl: input.proofDocumentUrl,
+                    proofDocumentMimeType: input.proofDocumentMimeType,
+                }
+                : {}),
+        };
+        await orderRepository.postRefundEvent(input.orderId, event, isFull);
+        // SB-UNI-N — revoke any available (unclaimed) digital codes linked to this order.
+        revokeAvailableDigitalCodes(input.orderId, digitalCodeItems);
+        // Fire-and-forget: deduct from the store's pending payout if one exists.
+        // Failure here must not roll back the already-posted refund event.
+        if (order.storeId) {
+            applyRefundDeductionAction({
+                storeId: order.storeId,
+                orderId: input.orderId,
+                refundId,
+                refundedAmountInPaise: input.amountInPaise,
+                reason: input.reason,
+            }).catch(() => { });
+        }
+        return { success: true, refundId };
+    });
 }

package/dist/_internal/server/features/reviews/actions.d.ts

@@ -1,4 +1,5 @@
-export declare function createReviewAction(input: unknown): Promise<import("../../../..").ReviewDocument>;
-export declare function replyToReviewAction(input: unknown): Promise<import("../../../..").ReviewDocument>;
-export declare function deleteReviewAction(input: unknown): Promise<void>;
-export declare function markReviewHelpfulAction(reviewId: string): Promise<void>;
+import { type ActionResult } from "@mohasinac/appkit/server";
+export declare function createReviewAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function replyToReviewAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function deleteReviewAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function markReviewHelpfulAction(reviewId: string): Promise<ActionResult<unknown>>;