@mohasinac/appkit 3.2.6 → 3.2.8

package/dist/features/admin/components/AdminAddressesView.js

@@ -0,0 +1,137 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { sortBy } from "@mohasinac/appkit";
+import { useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { Badge, Div, FilterChipGroup, Span, Stack, Text, useToast } from "../../../ui";
+import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry";
+import { toRecordArray, toRelativeDate, toStringValue } from "../hooks/useAdminListingData";
+import { DataListingView } from "./DataListingView";
+import { apiClient } from "../../../http";
+import { useApiMutation } from "@mohasinac/appkit/client";
+import { QuickEditMenu } from "./QuickEditMenu";
+const BAN_STATUS_TABS = [
+    { id: "", label: "All" },
+    { id: "banned", label: "Banned" },
+    { id: "unban_requested", label: "Unban Requested" },
+    { id: "suspicious", label: "Suspicious" },
+];
+const STATUS_BADGE = {
+    banned: "danger",
+    unban_requested: "warning",
+    suspicious: "secondary",
+};
+const ADDRESS_COLUMNS = [
+    {
+        key: "primary",
+        header: "Address",
+        render: (row) => (_jsxs(Stack, { gap: "none", children: [_jsx(Text, { weight: "medium", color: "primary", children: row.primary }), row.secondary ? _jsx(Text, { size: "xs", color: "muted", children: row.secondary }) : null] })),
+    },
+    {
+        key: "status",
+        header: "Status",
+        className: "w-36",
+        render: (row) => {
+            if (!row.status)
+                return _jsx(Span, { size: "xs", color: "muted", children: "\u2014" });
+            const variant = (STATUS_BADGE[row.status] ?? "secondary");
+            return _jsx(Badge, { variant: variant, size: "sm", children: row.status.replace(/_/g, " ") });
+        },
+    },
+    {
+        key: "updatedAt",
+        header: "Flagged",
+        className: "w-32",
+        render: (row) => _jsx(Span, { size: "sm", color: "muted", children: row.updatedAt }),
+    },
+];
+function buildAddressConfig(banStatus, onAction) {
+    return {
+        portal: "admin",
+        title: "Address Management",
+        searchPlaceholder: "Search by city or owner",
+        emptyLabel: "No addresses found",
+        filterKeys: [],
+        defaultSort: sortBy("bannedAt", "DESC"),
+        queryKey: ["admin", "addresses", banStatus],
+        endpoint: banStatus
+            ? `${ADMIN_ENDPOINTS.ADDRESSES}?banStatus=${encodeURIComponent(banStatus)}`
+            : ADMIN_ENDPOINTS.ADDRESSES,
+        sortOptions: [
+            { value: "bannedAt", label: "Flagged Date" },
+            { value: "city", label: "City" },
+        ],
+        columns: ADDRESS_COLUMNS,
+        mapRows: (response) => toRecordArray(response.items).map((item, index) => ({
+            id: toStringValue(item.id, `addr-${index}`),
+            primary: [
+                toStringValue(item.addressLine1, ""),
+                toStringValue(item.city, ""),
+                toStringValue(item.state, ""),
+                toStringValue(item.postalCode, ""),
+            ].filter(Boolean).join(", "),
+            secondary: `Owner: ${toStringValue(item.ownerId, "unknown")} (${toStringValue(item.ownerType, "")})${item.banReason ? ` · ${toStringValue(item.banReason, "")}` : ""}`,
+            status: toStringValue(item.banStatus, ""),
+            updatedAt: toRelativeDate(item.bannedAt ?? item.updatedAt),
+            _raw: item,
+        })),
+        getTotal: (response, rows) => typeof response.total === "number" ? response.total : rows.length,
+        buildFilters: () => undefined,
+        renderRowActions: (row) => {
+            const actions = [];
+            if (row.status !== "banned") {
+                actions.push({
+                    label: ACTIONS.ADMIN["ban-address"].label,
+                    destructive: true,
+                    onClick: () => onAction(row.id, "ban"),
+                });
+            }
+            if (row.status === "banned") {
+                actions.push({
+                    label: ACTIONS.ADMIN["approve-unban"].label,
+                    onClick: () => onAction(row.id, "approve_unban"),
+                });
+                actions.push({
+                    label: ACTIONS.ADMIN["reject-unban"].label,
+                    onClick: () => onAction(row.id, "reject_unban"),
+                });
+            }
+            if (row.status !== "suspicious") {
+                actions.push({
+                    label: "Flag Suspicious",
+                    onClick: () => onAction(row.id, "flag_suspicious"),
+                });
+            }
+            if (row.status) {
+                actions.push({
+                    label: "Clear Flag",
+                    onClick: () => onAction(row.id, "clear_ban"),
+                });
+            }
+            return _jsx(QuickEditMenu, { actions: actions });
+        },
+    };
+}
+export function AdminAddressesView(_props) {
+    const [banStatus, setBanStatus] = useState("");
+    const queryClient = useQueryClient();
+    const { showToast } = useToast();
+    const actionMutation = useApiMutation({
+        mutationFn: async ({ id, action }) => {
+            await apiClient.patch(ADMIN_ENDPOINTS.ADDRESS_BY_ID(id), { action });
+        },
+        onSuccess: () => {
+            showToast("Address updated.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "addresses"] });
+        },
+        onError: (err) => {
+            showToast(err.message ?? "Failed to update address.", "error");
+        },
+    });
+    const handleAction = (id, action) => {
+        actionMutation.mutate({ id, action });
+    };
+    const config = buildAddressConfig(banStatus, handleAction);
+    return (_jsxs(Stack, { gap: "md", children: [_jsx(Div, { padding: "inline", border: "default", className: "border-b", children: _jsx(FilterChipGroup, { label: "Status", tabs: BAN_STATUS_TABS, value: banStatus, onChange: (v) => setBanStatus(v) }) }), _jsx(DataListingView, { config: config })] }));
+}

package/dist/features/admin/components/AdminPaymentClustersView.d.ts

@@ -0,0 +1,5 @@
+import React from "react";
+export interface AdminPaymentClustersViewProps {
+    children?: React.ReactNode;
+}
+export declare function AdminPaymentClustersView(_props: AdminPaymentClustersViewProps): import("react/jsx-runtime").JSX.Element;

package/dist/features/admin/components/AdminPaymentClustersView.js

@@ -0,0 +1,37 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useQuery } from "@tanstack/react-query";
+import { useQueryClient } from "@tanstack/react-query";
+import { Badge, Button, Div, Heading, Row, Span, Stack, Text, useToast } from "../../../ui";
+import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { apiClient } from "../../../http";
+import { useApiMutation } from "@mohasinac/appkit/client";
+const BAN_BADGE = {
+    banned: "danger",
+    suspicious: "secondary",
+};
+export function AdminPaymentClustersView(_props) {
+    const queryClient = useQueryClient();
+    const { showToast } = useToast();
+    const { data, isLoading, error } = useQuery({
+        queryKey: ["admin", "payment-clusters"],
+        queryFn: async () => {
+            const res = await apiClient.get(ADMIN_ENDPOINTS.PAYMENT_METHOD_CLUSTERS);
+            return res;
+        },
+    });
+    const flagMutation = useApiMutation({
+        mutationFn: async (id) => {
+            await apiClient.patch(ADMIN_ENDPOINTS.PAYMENT_METHOD_BY_ID(id), { action: "flag_suspicious" });
+        },
+        onSuccess: () => {
+            showToast("Payment method flagged as suspicious.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "payment-clusters"] });
+        },
+        onError: (err) => {
+            showToast(err.message ?? "Failed to flag payment method.", "error");
+        },
+    });
+    const clusters = data?.clusters ?? [];
+    return (_jsxs(Stack, { gap: "lg", padding: "page", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", color: "primary", children: "Payment Method Clusters" }), _jsx(Text, { size: "sm", color: "muted", className: "mt-1", children: "Multiple accounts sharing the same payment identifier. Flagging is informational only \u2014 users are not blocked." })] }), isLoading && (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), error && (_jsx(Div, { surface: "danger-surface", color: "error", padding: "inline", rounded: "xl", textSize: "sm", children: "Failed to load payment clusters." })), !isLoading && clusters.length === 0 && (_jsx(Div, { surface: "muted", padding: "y-4xl", rounded: "xl", className: "text-center", children: _jsx(Text, { color: "muted", size: "sm", children: "No shared payment identifiers found." }) })), clusters.map((cluster) => (_jsxs(Stack, { surface: "card", padding: "md", gap: "md", rounded: "xl", border: "default", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Text, { size: "xs", color: "muted", weight: "medium", children: "Identifier Hash" }), _jsx(Span, { size: "xs", color: "muted", className: "font-mono truncate max-w-xs", children: cluster.identifierHash })] }), _jsxs(Badge, { variant: "secondary", size: "sm", children: [cluster.methods.length, " accounts"] })] }), _jsx(Stack, { gap: "xs", children: cluster.methods.map((m) => (_jsxs(Row, { justify: "between", align: "center", gap: "sm", surface: "muted", padding: "inlineSm", rounded: "lg", children: [_jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsxs(Text, { size: "sm", weight: "medium", color: "primary", className: "truncate", children: [m.type.toUpperCase(), " \u00B7 ", m.displayLabel] }), _jsxs(Text, { size: "xs", color: "muted", children: ["User: ", m.userId] })] }), _jsxs(Row, { gap: "xs", align: "center", children: [m.banStatus && (_jsx(Badge, { variant: BAN_BADGE[m.banStatus] ?? "secondary", size: "sm", children: m.banStatus.replace(/_/g, " ") })), m.banStatus !== "suspicious" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => flagMutation.mutate(m.id), disabled: flagMutation.isPending, children: "Flag Suspicious" }))] })] }, m.id))) })] }, cluster.identifierHash)))] }));
+}

package/dist/features/admin/components/AdminPaymentMethodsView.d.ts

@@ -0,0 +1,5 @@
+import React from "react";
+export interface AdminPaymentMethodsViewProps {
+    children?: React.ReactNode;
+}
+export declare function AdminPaymentMethodsView(_props: AdminPaymentMethodsViewProps): import("react/jsx-runtime").JSX.Element;

package/dist/features/admin/components/AdminPaymentMethodsView.js

@@ -0,0 +1,130 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { sortBy } from "@mohasinac/appkit";
+import { useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { Badge, Div, FilterChipGroup, Span, Stack, Text, useToast } from "../../../ui";
+import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry";
+import { toRecordArray, toRelativeDate, toStringValue } from "../hooks/useAdminListingData";
+import { DataListingView } from "./DataListingView";
+import { apiClient } from "../../../http";
+import { useApiMutation } from "@mohasinac/appkit/client";
+import { QuickEditMenu } from "./QuickEditMenu";
+const BAN_STATUS_TABS = [
+    { id: "", label: "All" },
+    { id: "banned", label: "Banned" },
+    { id: "suspicious", label: "Suspicious" },
+];
+const STATUS_BADGE = {
+    banned: "danger",
+    suspicious: "secondary",
+};
+const PM_COLUMNS = [
+    {
+        key: "primary",
+        header: "Payment Method",
+        render: (row) => (_jsxs(Stack, { gap: "none", children: [_jsx(Text, { weight: "medium", color: "primary", children: row.primary }), row.secondary ? _jsx(Text, { size: "xs", color: "muted", children: row.secondary }) : null] })),
+    },
+    {
+        key: "status",
+        header: "Status",
+        className: "w-36",
+        render: (row) => {
+            if (!row.status)
+                return _jsx(Span, { size: "xs", color: "muted", children: "\u2014" });
+            const variant = STATUS_BADGE[row.status] ?? "secondary";
+            return _jsx(Badge, { variant: variant, size: "sm", children: row.status.replace(/_/g, " ") });
+        },
+    },
+    {
+        key: "updatedAt",
+        header: "Flagged",
+        className: "w-32",
+        render: (row) => _jsx(Span, { size: "sm", color: "muted", children: row.updatedAt }),
+    },
+];
+function buildConfig(banStatus, onAction) {
+    return {
+        portal: "admin",
+        title: "Payment Methods",
+        searchPlaceholder: "Search by type or owner",
+        emptyLabel: "No payment methods found",
+        filterKeys: [],
+        defaultSort: sortBy("bannedAt", "DESC"),
+        queryKey: ["admin", "payment-methods", banStatus],
+        endpoint: banStatus
+            ? `${ADMIN_ENDPOINTS.PAYMENT_METHODS}?banStatus=${encodeURIComponent(banStatus)}`
+            : ADMIN_ENDPOINTS.PAYMENT_METHODS,
+        sortOptions: [
+            { value: "bannedAt", label: "Flagged Date" },
+            { value: "type", label: "Type" },
+        ],
+        columns: PM_COLUMNS,
+        mapRows: (response) => toRecordArray(response.items).map((item, index) => ({
+            id: toStringValue(item.id, `pm-${index}`),
+            primary: `${toStringValue(item.type, "unknown").toUpperCase()} · ${toStringValue(item.displayLabel, "—")}`,
+            secondary: `User: ${toStringValue(item.userId, "unknown")}${item.banReason ? ` · ${toStringValue(item.banReason, "")}` : ""}`,
+            status: toStringValue(item.banStatus, ""),
+            updatedAt: toRelativeDate(item.bannedAt ?? item.updatedAt),
+            _raw: item,
+        })),
+        getTotal: (response, rows) => typeof response.total === "number" ? response.total : rows.length,
+        buildFilters: () => undefined,
+        renderRowActions: (row) => {
+            const actions = [];
+            if (row.status !== "banned") {
+                actions.push({
+                    label: ACTIONS.ADMIN["ban-payment-method"].label,
+                    destructive: true,
+                    onClick: () => onAction(row.id, "ban"),
+                });
+            }
+            if (row.status === "banned") {
+                actions.push({
+                    label: ACTIONS.ADMIN["approve-payment-unban"].label,
+                    onClick: () => onAction(row.id, "approve_unban"),
+                });
+                actions.push({
+                    label: ACTIONS.ADMIN["reject-payment-unban"].label,
+                    onClick: () => onAction(row.id, "reject_unban"),
+                });
+            }
+            if (row.status !== "suspicious") {
+                actions.push({
+                    label: "Flag Suspicious",
+                    onClick: () => onAction(row.id, "flag_suspicious"),
+                });
+            }
+            if (row.status) {
+                actions.push({
+                    label: "Clear Flag",
+                    onClick: () => onAction(row.id, "clear_ban"),
+                });
+            }
+            return _jsx(QuickEditMenu, { actions: actions });
+        },
+    };
+}
+export function AdminPaymentMethodsView(_props) {
+    const [banStatus, setBanStatus] = useState("");
+    const queryClient = useQueryClient();
+    const { showToast } = useToast();
+    const actionMutation = useApiMutation({
+        mutationFn: async ({ id, action }) => {
+            await apiClient.patch(ADMIN_ENDPOINTS.PAYMENT_METHOD_BY_ID(id), { action });
+        },
+        onSuccess: () => {
+            showToast("Payment method updated.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "payment-methods"] });
+        },
+        onError: (err) => {
+            showToast(err.message ?? "Failed to update payment method.", "error");
+        },
+    });
+    const handleAction = (id, action) => {
+        actionMutation.mutate({ id, action });
+    };
+    const config = buildConfig(banStatus, handleAction);
+    return (_jsxs(Stack, { gap: "md", children: [_jsx(Div, { padding: "inline", border: "default", className: "border-b", children: _jsx(FilterChipGroup, { label: "Status", tabs: BAN_STATUS_TABS, value: banStatus, onChange: (v) => setBanStatus(v) }) }), _jsx(DataListingView, { config: config })] }));
+}

package/dist/features/admin/components/index.d.ts

@@ -155,3 +155,11 @@ export { AdminScammerEditorView } from "./AdminScammerEditorView";
 export type { AdminScammerEditorViewProps } from "./AdminScammerEditorView";
 export { AdminFulfillmentView } from "./AdminFulfillmentView";
 export type { AdminFulfillmentViewProps } from "./AdminFulfillmentView";
+export { AdminAddressesView } from "./AdminAddressesView";
+export type { AdminAddressesViewProps } from "./AdminAddressesView";
+export { AdminAddressClustersView } from "./AdminAddressClustersView";
+export type { AdminAddressClustersViewProps } from "./AdminAddressClustersView";
+export { AdminPaymentMethodsView } from "./AdminPaymentMethodsView";
+export type { AdminPaymentMethodsViewProps } from "./AdminPaymentMethodsView";
+export { AdminPaymentClustersView } from "./AdminPaymentClustersView";
+export type { AdminPaymentClustersViewProps } from "./AdminPaymentClustersView";

package/dist/features/admin/components/index.js

@@ -81,3 +81,7 @@ export { AdminSupportTicketDetailView } from "./AdminSupportTicketDetailView";
 export { AdminScammersView } from "./AdminScammersView";
 export { AdminScammerEditorView } from "./AdminScammerEditorView";
 export { AdminFulfillmentView } from "./AdminFulfillmentView";
+export { AdminAddressesView } from "./AdminAddressesView";
+export { AdminAddressClustersView } from "./AdminAddressClustersView";
+export { AdminPaymentMethodsView } from "./AdminPaymentMethodsView";
+export { AdminPaymentClustersView } from "./AdminPaymentClustersView";

package/dist/features/auth/actions/profile-actions.d.ts

@@ -27,5 +27,7 @@ export declare function getPublicUserProfile(userId: string): Promise<Pick<UserD
 /** Fetch approved reviews for a store. storeId === storeSlug in this project. */
 export declare function getSellerReviews(storeId: string): Promise<Review[]>;
 export declare function getProfileStoreProducts(storeId: string): Promise<import("../../products").ProductDocument[]>;
-/** Approved reviews AUTHORED by this user (not reviews of their store). */
+/** Approved product reviews written by this user as a buyer. Excludes seller→buyer ratings. */
 export declare function getReviewsAuthoredBy(userId: string): Promise<Review[]>;
+/** Approved seller→buyer reviews received by this buyer. */
+export declare function getReviewsReceivedBy(userId: string): Promise<Review[]>;

package/dist/features/auth/actions/profile-actions.js

@@ -70,9 +70,36 @@ export async function getProfileStoreProducts(storeId) {
     const products = await productRepository.findByStore(storeId);
     return products.filter((p) => p.status === ProductStatusValues.PUBLISHED);
 }
-/** Approved reviews AUTHORED by this user (not reviews of their store). */
+/** Approved product reviews written by this user as a buyer. Excludes seller→buyer ratings. */
 export async function getReviewsAuthoredBy(userId) {
-    const snapshot = await reviewRepository.findApprovedByUser(userId).catch(() => []);
+    const all = await reviewRepository.findApprovedByUser(userId).catch(() => []);
+    // reviewerRole:"seller" means this user rated a buyer — not a product review
+    const snapshot = all.filter((r) => r.reviewerRole !== "seller");
+    return snapshot.map((r) => ({
+        id: r.id,
+        productId: r.productId,
+        productTitle: r.productTitle,
+        userId: r.userId,
+        userName: maskPublicReview(r).userName,
+        userAvatar: r.userAvatar,
+        rating: r.rating,
+        title: r.title,
+        comment: r.comment,
+        images: r.images?.map((url) => ({ url })),
+        status: r.status,
+        helpfulCount: r.helpfulCount,
+        reportCount: r.reportCount,
+        verified: r.verified,
+        featured: r.featured,
+        createdAt: r.createdAt instanceof Date ? r.createdAt.toISOString() : undefined,
+        updatedAt: r.updatedAt instanceof Date ? r.updatedAt.toISOString() : undefined,
+        storeSlug: r.storeId,
+        storeName: r.storeName,
+    }));
+}
+/** Approved seller→buyer reviews received by this buyer. */
+export async function getReviewsReceivedBy(userId) {
+    const snapshot = await reviewRepository.findByReviewee(userId).catch(() => []);
     return snapshot.map((r) => ({
         id: r.id,
         productId: r.productId,

package/dist/features/cart/schemas/index.d.ts

@@ -66,8 +66,8 @@ export declare const cartItemSchema: z.ZodObject<{
         slug?: string | undefined;
         attributes?: Record<string, string> | undefined;
     } | undefined;
-    sessionId?: string | undefined;
     userId?: string | undefined;
+    sessionId?: string | undefined;
     addedAt?: string | undefined;
 }, {
     id: string;
@@ -79,9 +79,9 @@ export declare const cartItemSchema: z.ZodObject<{
         slug?: string | undefined;
         attributes?: Record<string, string> | undefined;
     } | undefined;
+    userId?: string | undefined;
     sessionId?: string | undefined;
     quantity?: number | undefined;
-    userId?: string | undefined;
     addedAt?: string | undefined;
 }>;
 export declare const cartSummarySchema: z.ZodObject<{
@@ -122,8 +122,8 @@ export declare const cartSummarySchema: z.ZodObject<{
             slug?: string | undefined;
             attributes?: Record<string, string> | undefined;
         } | undefined;
-        sessionId?: string | undefined;
         userId?: string | undefined;
+        sessionId?: string | undefined;
         addedAt?: string | undefined;
     }, {
         id: string;
@@ -135,9 +135,9 @@ export declare const cartSummarySchema: z.ZodObject<{
             slug?: string | undefined;
             attributes?: Record<string, string> | undefined;
         } | undefined;
+        userId?: string | undefined;
         sessionId?: string | undefined;
         quantity?: number | undefined;
-        userId?: string | undefined;
         addedAt?: string | undefined;
     }>, "many">;
     subtotal: z.ZodNumber;
@@ -156,8 +156,8 @@ export declare const cartSummarySchema: z.ZodObject<{
             slug?: string | undefined;
             attributes?: Record<string, string> | undefined;
         } | undefined;
-        sessionId?: string | undefined;
         userId?: string | undefined;
+        sessionId?: string | undefined;
         addedAt?: string | undefined;
     }[];
     subtotal: number;
@@ -173,9 +173,9 @@ export declare const cartSummarySchema: z.ZodObject<{
             slug?: string | undefined;
             attributes?: Record<string, string> | undefined;
         } | undefined;
+        userId?: string | undefined;
         sessionId?: string | undefined;
         quantity?: number | undefined;
-        userId?: string | undefined;
         addedAt?: string | undefined;
     }[];
     subtotal: number;

package/dist/features/orders/schemas/index.d.ts

@@ -417,10 +417,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
     updatedAt: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    userId: string;
     productId: string;
     quantity: number;
     productTitle: string;
-    userId: string;
     userEmail: string;
     paymentStatus: "pending" | "paid" | "failed" | "processing" | "refunded" | "partial_refund";
     orderDate: string | Date | z.objectOutputType<{
@@ -546,10 +546,10 @@ export declare const orderFirestoreSchema: z.ZodObject<{
     updatedAt: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    userId: string;
     productId: string;
     quantity: number;
     productTitle: string;
-    userId: string;
     userEmail: string;
     paymentStatus: "pending" | "paid" | "failed" | "processing" | "refunded" | "partial_refund";
     orderDate: string | Date | z.objectInputType<{
@@ -794,6 +794,7 @@ export declare const orderSchema: z.ZodObject<{
     address: {} & {
         [k: string]: unknown;
     };
+    userId: string;
     items: {
         title: string;
         price: number;
@@ -805,7 +806,6 @@ export declare const orderSchema: z.ZodObject<{
         attributes?: Record<string, string> | undefined;
     }[];
     total: number;
-    userId: string;
     paymentStatus: string;
     subtotal: number;
     orderStatus: "cancelled" | "pending" | "processing" | "refunded" | "confirmed" | "shipped" | "delivered" | "return_requested" | "returned";
@@ -831,6 +831,7 @@ export declare const orderSchema: z.ZodObject<{
     address: {} & {
         [k: string]: unknown;
     };
+    userId: string;
     items: {
         title: string;
         price: number;
@@ -842,7 +843,6 @@ export declare const orderSchema: z.ZodObject<{
         attributes?: Record<string, string> | undefined;
     }[];
     total: number;
-    userId: string;
     paymentStatus: string;
     subtotal: number;
     orderStatus: "cancelled" | "pending" | "processing" | "refunded" | "confirmed" | "shipped" | "delivered" | "return_requested" | "returned";

package/dist/features/payments/repository/saved-payment-methods.repository.d.ts

@@ -0,0 +1,48 @@
+/**
+ * SavedPaymentMethodsRepository
+ *
+ * Persists user payment identifiers (UPI VPAs, card tokens, etc.) for
+ * checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` is encrypted at rest (AES-256-GCM) — never returned
+ * to clients. `identifierHash` is unencrypted SHA-256 for cross-account
+ * dedup queries. `displayLabel` is pre-masked and safe to display.
+ */
+import { BaseRepository, type DocumentSnapshot } from "../../../providers/db-firebase";
+import { type SavedPaymentMethodBanStatus, type SavedPaymentMethodCreateInput, type SavedPaymentMethodDocument } from "../schemas/saved-methods-firestore";
+export declare class SavedPaymentMethodsRepository extends BaseRepository<SavedPaymentMethodDocument> {
+    constructor();
+    private decrypt;
+    private encrypt;
+    protected mapDoc<D = SavedPaymentMethodDocument>(snap: DocumentSnapshot): D;
+    createWithId(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
+    update(id: string, data: Partial<SavedPaymentMethodDocument>): Promise<SavedPaymentMethodDocument>;
+    /** List all saved methods for a user. Never returns raw `identifier` — only `displayLabel`. */
+    listByUser(userId: string): Promise<SavedPaymentMethodDocument[]>;
+    /**
+     * Idempotent upsert by (userId + identifierHash).
+     * Computes hash + encrypts identifier before write.
+     * Updates lastUsedAt on re-add.
+     */
+    upsertForUser(userId: string, input: SavedPaymentMethodCreateInput): Promise<SavedPaymentMethodDocument>;
+    /** Cross-account lookup by identifierHash. Returns display-safe docs (identifier stripped). */
+    listByIdentifierHash(hash: string): Promise<SavedPaymentMethodDocument[]>;
+    /** Batch-ban all methods for a user. Used by hard-ban cascade. */
+    banAllForUser(userId: string, banData: {
+        banReason: string;
+        bannedBy: string;
+    }): Promise<number>;
+    /** Reverse auto-ban cascade on user unban. Leaves manually-banned methods untouched. */
+    unbanAutoForUser(userId: string): Promise<number>;
+    /** List by banStatus for admin view. Returns display-safe docs. */
+    listByBanStatus(banStatus: SavedPaymentMethodBanStatus, limit?: number, offset?: number): Promise<SavedPaymentMethodDocument[]>;
+    banById(id: string, banData: {
+        banReason: string;
+        bannedBy: string;
+    }): Promise<void>;
+    clearBanById(id: string): Promise<void>;
+    deleteForUser(userId: string, id: string): Promise<void>;
+    /** Public wrapper — compute identifier hash from outside the class (e.g. in API routes). */
+    computeIdentifierHash(type: string, identifier: string): string;
+}
+export declare const savedPaymentMethodsRepository: SavedPaymentMethodsRepository;