@mohasinac/appkit 3.2.5 → 3.2.7

package/dist/features/layout/background-seed-defaults.js

@@ -0,0 +1,14 @@
+// Seed defaults for siteSettings.theme.background — Firestore data values, not CSS styling.
+// These are the first-boot theme configuration and are exempt from the hex-tokens audit.
+// Override via the admin theme editor (Site Settings → Themes).
+export const SEED_LIGHT_BG = {
+    type: "color",
+    value: "#f9fafb",
+    overlay: { enabled: false, color: "#000000", opacity: 0 },
+};
+export const SEED_DARK_BG = {
+    type: "color",
+    value: "#030712",
+    overlay: { enabled: false, color: "#000000", opacity: 0 },
+};
+export const OVERLAY_FALLBACK_COLOR = "#000000";

package/dist/features/lottery/schemas/firestore.d.ts

@@ -3,7 +3,7 @@
  */
 import type { LotteryEntryStatus } from "../types";
 export declare const LOTTERY_ENTRIES_COLLECTION: "lotteryEntries";
-export interface LotteryEntryDocument {
+export type LotteryEntryDocument = {
     id: string;
     sourceType: "event" | "product";
     /** Set when sourceType === "event" */
@@ -33,7 +33,7 @@ export interface LotteryEntryDocument {
     flaggedAt?: Date;
     submittedAt: Date;
     drawnAt?: Date;
-}
+};
 export declare const LOTTERY_ENTRY_INDEXED_FIELDS: readonly ["sourceType", "eventId", "productId", "userId", "status", "submittedAt", "userLotteryNumber"];
 /** Canonical field name constants for lotteryEntries collection — use instead of hardcoded strings. */
 export declare const LOTTERY_ENTRY_FIELDS: {

package/dist/features/messages/hooks/useConversation.js

@@ -51,7 +51,6 @@ export function useConversation(conversationId) {
             setConversation(await fetchDetail(conversationId));
         }
         catch (e) {
-            // toast-intentionally-silent: background refetch, error surfaced via error state
             void normalizeError(e);
             setError(e instanceof Error ? e : new Error(String(e)));
         }
@@ -102,19 +101,12 @@ export function useConversation(conversationId) {
         // the ping path isn't subscribed (e.g. provider not registered).
         await refetch();
     }, [conversationId, refetch]);
-    const markRead = useCallback(async () => {
+    const markRead = useCallback(() => {
         if (!conversationId)
-            return;
-        try {
-            await fetch(READ_ENDPOINT(conversationId), {
-                method: "POST",
-                credentials: "include",
-            });
-            await refetch();
-        }
-        catch {
-            // toast-intentionally-silent: read-receipt is best-effort, non-critical
-        }
+            return Promise.resolve();
+        return fetch(READ_ENDPOINT(conversationId), { method: "POST", credentials: "include" })
+            .then(() => void refetch())
+            .catch((err) => void normalizeError(err));
     }, [conversationId, refetch]);
     return {
         conversation,

package/dist/features/messages/hooks/useConversations.js

@@ -31,7 +31,6 @@ export function useConversations(userId) {
             setConversations(await fetchList());
         }
         catch (e) {
-            // toast-intentionally-silent: background refetch, error surfaced via error state
             void normalizeError(e);
             setError(e instanceof Error ? e : new Error(String(e)));
         }

package/dist/features/messages/schemas/firestore.d.ts

@@ -6,7 +6,7 @@
  * a subcollection when the thread exceeds ~200 messages.
  */
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
-export interface ConversationMessage {
+export type ConversationMessage = {
     id: string;
     senderId: string;
     senderRole: "buyer" | "seller";
@@ -14,7 +14,7 @@ export interface ConversationMessage {
     isRead: boolean;
     sentAt: Date;
     attachments?: string[];
-}
+};
 export interface ConversationDocument extends BaseDocument {
     buyerId: string;
     buyerDisplayName: string;

package/dist/features/orders/components/RefundHistoryTable.js

@@ -21,7 +21,5 @@ export function RefundHistoryTable({ order, className = "" }) {
     const currency = order.currency ?? "INR";
     if (events.length === 0 && order.contestable !== false)
         return null;
-    return (_jsxs(Div, { className: `${className}`, rounded: "xl", surface: "default", border: "default", children: [order.contestable === false && (
-            // audit-inline-style-ok: asymmetric border-radius (top corners only); no appkit rounded= variant covers partial corners
-            _jsx(Div, { surface: "warning-surface", padding: "inline", style: { borderTopLeftRadius: "0.75rem", borderTopRightRadius: "0.75rem" }, children: _jsxs(Row, { gap: "sm", align: "center", children: [_jsx(WarningIcon, {}), _jsx(Text, { size: "sm", weight: "semibold", className: "text-warning", children: REFUND_COPY.history.nonContestableBanner })] }) })), events.length > 0 && (_jsxs(Div, { className: `${__P.p4}`, children: [_jsx(Heading, { level: 4, className: "mb-3", color: "muted", size: "sm", weight: "semibold", children: REFUND_COPY.history.heading }), _jsx(Stack, { gap: "none", children: events.map((e) => (_jsx(RefundRow, { event: e, currency: currency }, e.refundId))) })] }))] }));
+    return (_jsxs(Div, { className: `${className}`, rounded: "xl", surface: "default", border: "default", children: [order.contestable === false && (_jsx(Div, { surface: "warning-surface", padding: "inline", roundedTop: "lg", children: _jsxs(Row, { gap: "sm", align: "center", children: [_jsx(WarningIcon, {}), _jsx(Text, { size: "sm", weight: "semibold", className: "text-warning", children: REFUND_COPY.history.nonContestableBanner })] }) })), events.length > 0 && (_jsxs(Div, { className: `${__P.p4}`, children: [_jsx(Heading, { level: 4, className: "mb-3", color: "muted", size: "sm", weight: "semibold", children: REFUND_COPY.history.heading }), _jsx(Stack, { gap: "none", children: events.map((e) => (_jsx(RefundRow, { event: e, currency: currency }, e.refundId))) })] }))] }));
 }

package/dist/features/orders/schemas/firestore.d.ts

@@ -4,6 +4,7 @@
 import type { OrderStatus, PaymentStatus } from "../types";
 import type { OrderType } from "../utils/order-splitter";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { ListingType } from "../../products/types";
 export type ShippingMethod = "custom" | "shiprocket";
 export type RefundType = "full" | "partial";
 export type OrderPayoutStatus = "eligible" | "requested" | "paid";
@@ -58,7 +59,7 @@ export interface OrderDocumentItem {
     unitPrice: number;
     totalPrice: number;
     /** SB8-F â€" set when the item is a prize-draw entry; drives the reveals badge. */
-    listingType?: "standard" | "auction" | "pre-order" | "prize-draw" | "classified" | "digital-code" | "live";
+    listingType?: ListingType;
     /** SB8-F â€" per-item reveal status; flips through pending â†' open â†' revealed/closed. */
     prizeRevealStatus?: "pending" | "open" | "closed" | "revealed";
     /** SB8-F â€" ISO timestamp; deadline by which the buyer must claim the prize. */

package/dist/features/orders/schemas/index.d.ts

@@ -417,10 +417,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
     updatedAt: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    userId: string;
     productId: string;
     quantity: number;
     productTitle: string;
-    userId: string;
     userEmail: string;
     paymentStatus: "pending" | "paid" | "failed" | "processing" | "refunded" | "partial_refund";
     orderDate: string | Date | z.objectOutputType<{
@@ -546,10 +546,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
     updatedAt: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    userId: string;
     productId: string;
     quantity: number;
     productTitle: string;
-    userId: string;
     userEmail: string;
     paymentStatus: "pending" | "paid" | "failed" | "processing" | "refunded" | "partial_refund";
     orderDate: string | Date | z.objectInputType<{
@@ -756,7 +756,7 @@ export declare const orderSchema: z.ZodObject<{
         storeId?: string | undefined;
         attributes?: Record<string, string> | undefined;
     }>, "many">;
-    address: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    address: z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>;
     orderStatus: z.ZodEnum<["pending", "confirmed", "processing", "shipped", "delivered", "cancelled", "refunded", "return_requested", "returned"]>;
     paymentStatus: z.ZodString;
     paymentGateway: z.ZodOptional<z.ZodString>;
@@ -791,7 +791,10 @@ export declare const orderSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     currency: string;
     id: string;
-    address: Record<string, unknown>;
+    address: {} & {
+        [k: string]: unknown;
+    };
+    userId: string;
     items: {
         title: string;
         price: number;
@@ -803,7 +806,6 @@ export declare const orderSchema: z.ZodObject<{
         attributes?: Record<string, string> | undefined;
     }[];
     total: number;
-    userId: string;
     paymentStatus: string;
     subtotal: number;
     orderStatus: "cancelled" | "pending" | "processing" | "refunded" | "confirmed" | "shipped" | "delivered" | "return_requested" | "returned";
@@ -826,7 +828,10 @@ export declare const orderSchema: z.ZodObject<{
 }, {
     currency: string;
     id: string;
-    address: Record<string, unknown>;
+    address: {} & {
+        [k: string]: unknown;
+    };
+    userId: string;
     items: {
         title: string;
         price: number;
@@ -838,7 +843,6 @@ export declare const orderSchema: z.ZodObject<{
         attributes?: Record<string, string> | undefined;
     }[];
     total: number;
-    userId: string;
     paymentStatus: string;
     subtotal: number;
     orderStatus: "cancelled" | "pending" | "processing" | "refunded" | "confirmed" | "shipped" | "delivered" | "return_requested" | "returned";

package/dist/features/orders/schemas/index.js

@@ -194,7 +194,7 @@ export const orderSchema = z.object({
     userId: z.string(),
     items: z.array(orderItemSchema),
     // address shape is intentionally open to allow extending apps
-    address: z.record(z.string(), z.unknown()), // audit-z-any-ok: extending-apps extend this with their own address schema
+    address: z.object({}).passthrough(),
     orderStatus: orderStatusSchema,
     paymentStatus: z.string(),
     paymentGateway: z.string().optional(),

package/dist/features/payments/repository/saved-payment-methods.repository.d.ts

@@ -0,0 +1,48 @@
+/**
+ * SavedPaymentMethodsRepository
+ *
+ * Persists user payment identifiers (UPI VPAs, card tokens, etc.) for
+ * checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` is encrypted at rest (AES-256-GCM) — never returned
+ * to clients. `identifierHash` is unencrypted SHA-256 for cross-account
+ * dedup queries. `displayLabel` is pre-masked and safe to display.
+ */
+import { BaseRepository, type DocumentSnapshot } from "../../../providers/db-firebase";
+import { type SavedPaymentMethodBanStatus, type SavedPaymentMethodCreateInput, type SavedPaymentMethodDocument } from "../schemas/saved-methods-firestore";
+export declare class SavedPaymentMethodsRepository extends BaseRepository<SavedPaymentMethodDocument> {
+    constructor();
+    private decrypt;
+    private encrypt;
+    protected mapDoc<D = SavedPaymentMethodDocument>(snap: DocumentSnapshot): D;
+    createWithId(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
+    update(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
+    /** List all saved methods for a user. Never returns raw `identifier` — only `displayLabel`. */
+    listByUser(userId: string): Promise<SavedPaymentMethodDocument[]>;
+    /**
+     * Idempotent upsert by (userId + identifierHash).
+     * Computes hash + encrypts identifier before write.
+     * Updates lastUsedAt on re-add.
+     */
+    upsertForUser(userId: string, input: SavedPaymentMethodCreateInput): Promise<SavedPaymentMethodDocument>;
+    /** Cross-account lookup by identifierHash. Returns display-safe docs (identifier stripped). */
+    listByIdentifierHash(hash: string): Promise<SavedPaymentMethodDocument[]>;
+    /** Batch-ban all methods for a user. Used by hard-ban cascade. */
+    banAllForUser(userId: string, banData: {
+        banReason: string;
+        bannedBy: string;
+    }): Promise<number>;
+    /** Reverse auto-ban cascade on user unban. Leaves manually-banned methods untouched. */
+    unbanAutoForUser(userId: string): Promise<number>;
+    /** List by banStatus for admin view. Returns display-safe docs. */
+    listByBanStatus(banStatus: SavedPaymentMethodBanStatus, limit?: number, offset?: number): Promise<SavedPaymentMethodDocument[]>;
+    banById(id: string, banData: {
+        banReason: string;
+        bannedBy: string;
+    }): Promise<void>;
+    clearBanById(id: string): Promise<void>;
+    deleteForUser(userId: string, id: string): Promise<void>;
+    /** Public wrapper — compute identifier hash from outside the class (e.g. in API routes). */
+    computeIdentifierHash(type: string, identifier: string): string;
+}
+export declare const savedPaymentMethodsRepository: SavedPaymentMethodsRepository;

package/dist/features/payments/repository/saved-payment-methods.repository.js

@@ -0,0 +1,236 @@
+/**
+ * SavedPaymentMethodsRepository
+ *
+ * Persists user payment identifiers (UPI VPAs, card tokens, etc.) for
+ * checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` is encrypted at rest (AES-256-GCM) — never returned
+ * to clients. `identifierHash` is unencrypted SHA-256 for cross-account
+ * dedup queries. `displayLabel` is pre-masked and safe to display.
+ */
+import { createHash } from "crypto";
+import { normalizeError } from "../../../errors/normalize";
+import { DatabaseError } from "../../../errors";
+import { serverLogger } from "../../../monitoring";
+import { BaseRepository, prepareForFirestore, } from "../../../providers/db-firebase";
+import { PAYMENT_METHOD_PII_FIELDS, decryptPiiFields, encryptPiiFields, } from "../../../security";
+import { SAVED_PAYMENT_METHOD_FIELDS, SAVED_PAYMENT_METHODS_COLLECTION, } from "../schemas/saved-methods-firestore";
+function normaliseIdentifier(s) {
+    return s.toLowerCase().replace(/\s+/g, "").trim();
+}
+function computeIdentifierHash(type, identifier) {
+    return createHash("sha256")
+        .update(`${type}|${normaliseIdentifier(identifier)}`)
+        .digest("hex");
+}
+export class SavedPaymentMethodsRepository extends BaseRepository {
+    constructor() {
+        super(SAVED_PAYMENT_METHODS_COLLECTION);
+    }
+    decrypt(doc) {
+        return decryptPiiFields(doc, [...PAYMENT_METHOD_PII_FIELDS]);
+    }
+    encrypt(data) {
+        return encryptPiiFields(data, [...PAYMENT_METHOD_PII_FIELDS]);
+    }
+    mapDoc(snap) {
+        const raw = super.mapDoc(snap);
+        return this.decrypt(raw);
+    }
+    async createWithId(id, data) {
+        return super.createWithId(id, this.encrypt(data));
+    }
+    async update(id, data) {
+        return super.update(id, this.encrypt(data));
+    }
+    /** List all saved methods for a user. Never returns raw `identifier` — only `displayLabel`. */
+    async listByUser(userId) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .orderBy(SAVED_PAYMENT_METHOD_FIELDS.LAST_USED_AT, "desc")
+                .get();
+            return snap.docs.map((d) => {
+                const doc = this.mapDoc(d);
+                doc.identifier = ""; // never expose decrypted PII to caller
+                return doc;
+            });
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to list payment methods for user:${userId}`, error);
+        }
+    }
+    /**
+     * Idempotent upsert by (userId + identifierHash).
+     * Computes hash + encrypts identifier before write.
+     * Updates lastUsedAt on re-add.
+     */
+    async upsertForUser(userId, input) {
+        try {
+            const hash = computeIdentifierHash(input.type, input.identifier);
+            // Check for existing
+            const existing = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .where(SAVED_PAYMENT_METHOD_FIELDS.IDENTIFIER_HASH, "==", hash)
+                .limit(1)
+                .get();
+            const now = new Date();
+            if (!existing.empty) {
+                const docId = existing.docs[0].id;
+                return this.update(docId, { lastUsedAt: now, displayLabel: input.displayLabel });
+            }
+            const docRef = this.getCollection().doc();
+            const data = {
+                userId,
+                type: input.type,
+                identifier: input.identifier,
+                displayLabel: input.displayLabel,
+                identifierHash: hash,
+                isDefault: input.isDefault ?? false,
+                lastUsedAt: now,
+                createdAt: now,
+                updatedAt: now,
+            };
+            await docRef.set(prepareForFirestore(this.encrypt(data)));
+            serverLogger.info("Saved payment method created", { userId, type: input.type, docId: docRef.id });
+            const refetched = await this.findById(docRef.id);
+            if (!refetched)
+                throw new DatabaseError("Payment method not readable after create");
+            refetched.identifier = "";
+            return refetched;
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to upsert payment method for user:${userId}`, error);
+        }
+    }
+    /** Cross-account lookup by identifierHash. Returns display-safe docs (identifier stripped). */
+    async listByIdentifierHash(hash) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.IDENTIFIER_HASH, "==", hash)
+                .get();
+            return snap.docs.map((d) => {
+                const doc = this.mapDoc(d);
+                doc.identifier = "";
+                return doc;
+            });
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to lookup payment methods by hash`, error);
+        }
+    }
+    /** Batch-ban all methods for a user. Used by hard-ban cascade. */
+    async banAllForUser(userId, banData) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .get();
+            if (snap.empty)
+                return 0;
+            const now = new Date();
+            const batch = this.db.batch();
+            snap.docs.forEach((doc) => {
+                batch.update(doc.ref, {
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS]: "banned",
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_REASON]: banData.banReason,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_BY]: banData.bannedBy,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT]: now,
+                    [SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED]: true,
+                    [SAVED_PAYMENT_METHOD_FIELDS.UPDATED_AT]: now,
+                });
+            });
+            await batch.commit();
+            return snap.size;
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to ban payment methods for user:${userId}`, error);
+        }
+    }
+    /** Reverse auto-ban cascade on user unban. Leaves manually-banned methods untouched. */
+    async unbanAutoForUser(userId) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .where(SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED, "==", true)
+                .get();
+            if (snap.empty)
+                return 0;
+            const now = new Date();
+            const batch = this.db.batch();
+            snap.docs.forEach((doc) => {
+                batch.update(doc.ref, {
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_REASON]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_BY]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.UPDATED_AT]: now,
+                });
+            });
+            await batch.commit();
+            return snap.size;
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to unban payment methods for user:${userId}`, error);
+        }
+    }
+    /** List by banStatus for admin view. Returns display-safe docs. */
+    async listByBanStatus(banStatus, limit = 50, offset = 0) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS, "==", banStatus)
+                .orderBy(SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT, "desc")
+                .limit(limit)
+                .offset(offset)
+                .get();
+            return snap.docs.map((d) => {
+                const doc = this.mapDoc(d);
+                doc.identifier = "";
+                return doc;
+            });
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to list payment methods by banStatus:${banStatus}`, error);
+        }
+    }
+    async banById(id, banData) {
+        await this.update(id, {
+            banStatus: "banned",
+            banReason: banData.banReason,
+            bannedBy: banData.bannedBy,
+            bannedAt: new Date(),
+            autoBanned: false,
+        });
+    }
+    async clearBanById(id) {
+        const now = new Date();
+        await this.db.collection(SAVED_PAYMENT_METHODS_COLLECTION).doc(id).update({
+            [SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.BAN_REASON]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.BANNED_BY]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.UNBAN_REQUEST_NOTE]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.UNBAN_REQUESTED_AT]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.UPDATED_AT]: now,
+        });
+    }
+    async deleteForUser(userId, id) {
+        const existing = await this.findById(id);
+        if (!existing || existing.userId !== userId) {
+            throw new DatabaseError(`Payment method ${id} not found for user:${userId}`);
+        }
+        await this.delete(id);
+    }
+    /** Public wrapper — compute identifier hash from outside the class (e.g. in API routes). */
+    computeIdentifierHash(type, identifier) {
+        return computeIdentifierHash(type, identifier);
+    }
+}
+export const savedPaymentMethodsRepository = new SavedPaymentMethodsRepository();

package/dist/features/payments/schemas/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./firestore";
+export * from "./saved-methods-firestore";
 import { z } from "zod";
 export declare const payoutStatusEnumSchema: z.ZodEnum<["pending", "processing", "completed", "failed"]>;
 export declare const payoutPaymentMethodSchema: z.ZodEnum<["bank_transfer", "upi"]>;

package/dist/features/payments/schemas/index.js

@@ -1,4 +1,5 @@
 export * from "./firestore";
+export * from "./saved-methods-firestore";
 import { z } from "zod";
 import { getDefaultCurrency } from "../../../core/baseline-resolver";
 import { auditTimestampsShape, firestoreDateSchema, paiseSchema } from "../../../schemas/firestore-helpers";

package/dist/features/payments/schemas/saved-methods-firestore.d.ts

@@ -0,0 +1,63 @@
+/**
+ * SavedPaymentMethod Firestore Document Types & Constants
+ *
+ * Stores user-saved payment identifiers (UPI VPAs, card tokens, bank accounts)
+ * for checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` (full UPI VPA / card PAN) is encrypted at rest via
+ * encryptPiiFields. `identifierHash` is a deterministic SHA-256 of the
+ * normalised identifier and stored unencrypted for cross-account queries.
+ * `displayLabel` is a pre-masked string and never contains full PII.
+ */
+import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+export type SavedPaymentMethodType = "upi" | "card" | "bank_account" | "wallet";
+export type SavedPaymentMethodBanStatus = "banned" | "suspicious" | "unban_requested";
+export interface SavedPaymentMethodDocument extends BaseDocument {
+    userId: string;
+    type: SavedPaymentMethodType;
+    /** Full UPI VPA / card PAN / account number — ENCRYPTED at rest. */
+    identifier: string;
+    /** Pre-masked display string, never contains full PII. e.g. "9876...@paytm", "XXXX 4321 (HDFC)" */
+    displayLabel: string;
+    /** SHA-256(type|normalised(identifier)) — unencrypted; enables cross-account dedup without decrypting. */
+    identifierHash: string;
+    isDefault?: boolean;
+    lastUsedAt?: Date;
+    banStatus?: SavedPaymentMethodBanStatus;
+    banReason?: string;
+    bannedBy?: string;
+    bannedAt?: Date;
+    autoBanned?: boolean;
+    unbanRequestNote?: string;
+    unbanRequestedAt?: Date;
+}
+export declare const SAVED_PAYMENT_METHODS_COLLECTION: "savedPaymentMethods";
+export declare const SAVED_PAYMENT_METHOD_INDEXED_FIELDS: readonly ["userId", "identifierHash", "banStatus", "type", "createdAt"];
+export declare const SAVED_PAYMENT_METHOD_PUBLIC_FIELDS: readonly ["id", "userId", "type", "displayLabel", "identifierHash", "isDefault", "lastUsedAt", "banStatus", "banReason", "bannedAt", "unbanRequestNote", "unbanRequestedAt", "createdAt", "updatedAt"];
+export declare const SAVED_PAYMENT_METHOD_UPDATABLE_FIELDS: readonly ["displayLabel", "isDefault", "lastUsedAt", "unbanRequestNote", "unbanRequestedAt"];
+export declare const SAVED_PAYMENT_METHOD_FIELDS: {
+    readonly USER_ID: "userId";
+    readonly TYPE: "type";
+    readonly IDENTIFIER: "identifier";
+    readonly DISPLAY_LABEL: "displayLabel";
+    readonly IDENTIFIER_HASH: "identifierHash";
+    readonly IS_DEFAULT: "isDefault";
+    readonly LAST_USED_AT: "lastUsedAt";
+    readonly BAN_STATUS: "banStatus";
+    readonly BAN_REASON: "banReason";
+    readonly BANNED_BY: "bannedBy";
+    readonly BANNED_AT: "bannedAt";
+    readonly AUTO_BANNED: "autoBanned";
+    readonly UNBAN_REQUEST_NOTE: "unbanRequestNote";
+    readonly UNBAN_REQUESTED_AT: "unbanRequestedAt";
+    readonly CREATED_AT: "createdAt";
+    readonly UPDATED_AT: "updatedAt";
+};
+export type SavedPaymentMethodCreateInput = {
+    type: SavedPaymentMethodType;
+    /** Raw identifier — will be encrypted + hashed by repository. */
+    identifier: string;
+    displayLabel: string;
+    isDefault?: boolean;
+};
+export type SavedPaymentMethodUpdateInput = Partial<Pick<SavedPaymentMethodDocument, (typeof SAVED_PAYMENT_METHOD_UPDATABLE_FIELDS)[number]>>;

package/dist/features/payments/schemas/saved-methods-firestore.js

@@ -0,0 +1,60 @@
+/**
+ * SavedPaymentMethod Firestore Document Types & Constants
+ *
+ * Stores user-saved payment identifiers (UPI VPAs, card tokens, bank accounts)
+ * for checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` (full UPI VPA / card PAN) is encrypted at rest via
+ * encryptPiiFields. `identifierHash` is a deterministic SHA-256 of the
+ * normalised identifier and stored unencrypted for cross-account queries.
+ * `displayLabel` is a pre-masked string and never contains full PII.
+ */
+export const SAVED_PAYMENT_METHODS_COLLECTION = "savedPaymentMethods";
+export const SAVED_PAYMENT_METHOD_INDEXED_FIELDS = [
+    "userId",
+    "identifierHash",
+    "banStatus",
+    "type",
+    "createdAt",
+];
+export const SAVED_PAYMENT_METHOD_PUBLIC_FIELDS = [
+    "id",
+    "userId",
+    "type",
+    "displayLabel",
+    "identifierHash",
+    "isDefault",
+    "lastUsedAt",
+    "banStatus",
+    "banReason",
+    "bannedAt",
+    "unbanRequestNote",
+    "unbanRequestedAt",
+    "createdAt",
+    "updatedAt",
+];
+export const SAVED_PAYMENT_METHOD_UPDATABLE_FIELDS = [
+    "displayLabel",
+    "isDefault",
+    "lastUsedAt",
+    "unbanRequestNote",
+    "unbanRequestedAt",
+];
+export const SAVED_PAYMENT_METHOD_FIELDS = {
+    USER_ID: "userId",
+    TYPE: "type",
+    IDENTIFIER: "identifier",
+    DISPLAY_LABEL: "displayLabel",
+    IDENTIFIER_HASH: "identifierHash",
+    IS_DEFAULT: "isDefault",
+    LAST_USED_AT: "lastUsedAt",
+    BAN_STATUS: "banStatus",
+    BAN_REASON: "banReason",
+    BANNED_BY: "bannedBy",
+    BANNED_AT: "bannedAt",
+    AUTO_BANNED: "autoBanned",
+    UNBAN_REQUEST_NOTE: "unbanRequestNote",
+    UNBAN_REQUESTED_AT: "unbanRequestedAt",
+    CREATED_AT: "createdAt",
+    UPDATED_AT: "updatedAt",
+};

package/dist/features/payments/server.d.ts

@@ -5,3 +5,5 @@
  */
 export { PaymentsRepository } from "./repository/payments.repository";
 export { payoutRepository } from "./repository/payout.repository";
+export { savedPaymentMethodsRepository, SavedPaymentMethodsRepository, } from "./repository/saved-payment-methods.repository";
+export * from "./schemas/saved-methods-firestore";

package/dist/features/payments/server.js

@@ -5,3 +5,5 @@
  */
 export { PaymentsRepository } from "./repository/payments.repository";
 export { payoutRepository } from "./repository/payout.repository";
+export { savedPaymentMethodsRepository, SavedPaymentMethodsRepository, } from "./repository/saved-payment-methods.repository";
+export * from "./schemas/saved-methods-firestore";

package/dist/features/products/actions/product-actions.d.ts

@@ -1,3 +1,4 @@
+import type { ListingType } from "../types";
 import type { ProductDocument } from "../schemas";
 import type { FirebaseSieveResult } from "../../../providers/db-firebase";
 export interface ProductListActionParams {
@@ -6,7 +7,7 @@ export interface ProductListActionParams {
     page?: number;
     pageSize?: number;
     /** Canonical listing-kind discriminator (SB1-G Phase 4). */
-    listingType?: "standard" | "auction" | "pre-order" | "prize-draw" | "classified" | "digital-code" | "live";
+    listingType?: ListingType;
     featured?: boolean;
     storeId?: string;
     categoriesIn?: string[];