@mohasinac/appkit 3.2.6 → 3.2.8

package/dist/features/payments/repository/saved-payment-methods.repository.js

@@ -0,0 +1,236 @@
+/**
+ * SavedPaymentMethodsRepository
+ *
+ * Persists user payment identifiers (UPI VPAs, card tokens, etc.) for
+ * checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` is encrypted at rest (AES-256-GCM) — never returned
+ * to clients. `identifierHash` is unencrypted SHA-256 for cross-account
+ * dedup queries. `displayLabel` is pre-masked and safe to display.
+ */
+import { createHash } from "crypto";
+import { normalizeError } from "../../../errors/normalize";
+import { DatabaseError } from "../../../errors";
+import { serverLogger } from "../../../monitoring";
+import { BaseRepository, prepareForFirestore, } from "../../../providers/db-firebase";
+import { PAYMENT_METHOD_PII_FIELDS, decryptPiiFields, encryptPiiFields, } from "../../../security";
+import { SAVED_PAYMENT_METHOD_FIELDS, SAVED_PAYMENT_METHODS_COLLECTION, } from "../schemas/saved-methods-firestore";
+function normaliseIdentifier(s) {
+    return s.toLowerCase().replace(/\s+/g, "").trim();
+}
+function computeIdentifierHash(type, identifier) {
+    return createHash("sha256")
+        .update(`${type}|${normaliseIdentifier(identifier)}`)
+        .digest("hex");
+}
+export class SavedPaymentMethodsRepository extends BaseRepository {
+    constructor() {
+        super(SAVED_PAYMENT_METHODS_COLLECTION);
+    }
+    decrypt(doc) {
+        return decryptPiiFields(doc, [...PAYMENT_METHOD_PII_FIELDS]);
+    }
+    encrypt(data) {
+        return encryptPiiFields(data, [...PAYMENT_METHOD_PII_FIELDS]);
+    }
+    mapDoc(snap) {
+        const raw = super.mapDoc(snap);
+        return this.decrypt(raw);
+    }
+    async createWithId(id, data) {
+        return super.createWithId(id, this.encrypt(data));
+    }
+    async update(id, data) {
+        return super.update(id, this.encrypt(data));
+    }
+    /** List all saved methods for a user. Never returns raw `identifier` — only `displayLabel`. */
+    async listByUser(userId) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .orderBy(SAVED_PAYMENT_METHOD_FIELDS.LAST_USED_AT, "desc")
+                .get();
+            return snap.docs.map((d) => {
+                const doc = this.mapDoc(d);
+                doc.identifier = ""; // never expose decrypted PII to caller
+                return doc;
+            });
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to list payment methods for user:${userId}`, error);
+        }
+    }
+    /**
+     * Idempotent upsert by (userId + identifierHash).
+     * Computes hash + encrypts identifier before write.
+     * Updates lastUsedAt on re-add.
+     */
+    async upsertForUser(userId, input) {
+        try {
+            const hash = computeIdentifierHash(input.type, input.identifier);
+            // Check for existing
+            const existing = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .where(SAVED_PAYMENT_METHOD_FIELDS.IDENTIFIER_HASH, "==", hash)
+                .limit(1)
+                .get();
+            const now = new Date();
+            if (!existing.empty) {
+                const docId = existing.docs[0].id;
+                return this.update(docId, { lastUsedAt: now, displayLabel: input.displayLabel });
+            }
+            const docRef = this.getCollection().doc();
+            const data = {
+                userId,
+                type: input.type,
+                identifier: input.identifier,
+                displayLabel: input.displayLabel,
+                identifierHash: hash,
+                isDefault: input.isDefault ?? false,
+                lastUsedAt: now,
+                createdAt: now,
+                updatedAt: now,
+            };
+            await docRef.set(prepareForFirestore(this.encrypt(data)));
+            serverLogger.info("Saved payment method created", { userId, type: input.type, docId: docRef.id });
+            const refetched = await this.findById(docRef.id);
+            if (!refetched)
+                throw new DatabaseError("Payment method not readable after create");
+            refetched.identifier = "";
+            return refetched;
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to upsert payment method for user:${userId}`, error);
+        }
+    }
+    /** Cross-account lookup by identifierHash. Returns display-safe docs (identifier stripped). */
+    async listByIdentifierHash(hash) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.IDENTIFIER_HASH, "==", hash)
+                .get();
+            return snap.docs.map((d) => {
+                const doc = this.mapDoc(d);
+                doc.identifier = "";
+                return doc;
+            });
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to lookup payment methods by hash`, error);
+        }
+    }
+    /** Batch-ban all methods for a user. Used by hard-ban cascade. */
+    async banAllForUser(userId, banData) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .get();
+            if (snap.empty)
+                return 0;
+            const now = new Date();
+            const batch = this.db.batch();
+            snap.docs.forEach((doc) => {
+                batch.update(doc.ref, {
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS]: "banned",
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_REASON]: banData.banReason,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_BY]: banData.bannedBy,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT]: now,
+                    [SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED]: true,
+                    [SAVED_PAYMENT_METHOD_FIELDS.UPDATED_AT]: now,
+                });
+            });
+            await batch.commit();
+            return snap.size;
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to ban payment methods for user:${userId}`, error);
+        }
+    }
+    /** Reverse auto-ban cascade on user unban. Leaves manually-banned methods untouched. */
+    async unbanAutoForUser(userId) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.USER_ID, "==", userId)
+                .where(SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED, "==", true)
+                .get();
+            if (snap.empty)
+                return 0;
+            const now = new Date();
+            const batch = this.db.batch();
+            snap.docs.forEach((doc) => {
+                batch.update(doc.ref, {
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BAN_REASON]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_BY]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED]: null,
+                    [SAVED_PAYMENT_METHOD_FIELDS.UPDATED_AT]: now,
+                });
+            });
+            await batch.commit();
+            return snap.size;
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to unban payment methods for user:${userId}`, error);
+        }
+    }
+    /** List by banStatus for admin view. Returns display-safe docs. */
+    async listByBanStatus(banStatus, limit = 50, offset = 0) {
+        try {
+            const snap = await this.getCollection()
+                .where(SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS, "==", banStatus)
+                .orderBy(SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT, "desc")
+                .limit(limit)
+                .offset(offset)
+                .get();
+            return snap.docs.map((d) => {
+                const doc = this.mapDoc(d);
+                doc.identifier = "";
+                return doc;
+            });
+        }
+        catch (error) {
+            void normalizeError(error);
+            throw new DatabaseError(`Failed to list payment methods by banStatus:${banStatus}`, error);
+        }
+    }
+    async banById(id, banData) {
+        await this.update(id, {
+            banStatus: "banned",
+            banReason: banData.banReason,
+            bannedBy: banData.bannedBy,
+            bannedAt: new Date(),
+            autoBanned: false,
+        });
+    }
+    async clearBanById(id) {
+        const now = new Date();
+        await this.db.collection(SAVED_PAYMENT_METHODS_COLLECTION).doc(id).update({
+            [SAVED_PAYMENT_METHOD_FIELDS.BAN_STATUS]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.BAN_REASON]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.BANNED_BY]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.BANNED_AT]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.AUTO_BANNED]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.UNBAN_REQUEST_NOTE]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.UNBAN_REQUESTED_AT]: null,
+            [SAVED_PAYMENT_METHOD_FIELDS.UPDATED_AT]: now,
+        });
+    }
+    async deleteForUser(userId, id) {
+        const existing = await this.findById(id);
+        if (!existing || existing.userId !== userId) {
+            throw new DatabaseError(`Payment method ${id} not found for user:${userId}`);
+        }
+        await this.delete(id);
+    }
+    /** Public wrapper — compute identifier hash from outside the class (e.g. in API routes). */
+    computeIdentifierHash(type, identifier) {
+        return computeIdentifierHash(type, identifier);
+    }
+}
+export const savedPaymentMethodsRepository = new SavedPaymentMethodsRepository();

package/dist/features/payments/schemas/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./firestore";
+export * from "./saved-methods-firestore";
 import { z } from "zod";
 export declare const payoutStatusEnumSchema: z.ZodEnum<["pending", "processing", "completed", "failed"]>;
 export declare const payoutPaymentMethodSchema: z.ZodEnum<["bank_transfer", "upi"]>;

package/dist/features/payments/schemas/index.js

@@ -1,4 +1,5 @@
 export * from "./firestore";
+export * from "./saved-methods-firestore";
 import { z } from "zod";
 import { getDefaultCurrency } from "../../../core/baseline-resolver";
 import { auditTimestampsShape, firestoreDateSchema, paiseSchema } from "../../../schemas/firestore-helpers";

package/dist/features/payments/schemas/saved-methods-firestore.d.ts

@@ -0,0 +1,63 @@
+/**
+ * SavedPaymentMethod Firestore Document Types & Constants
+ *
+ * Stores user-saved payment identifiers (UPI VPAs, card tokens, bank accounts)
+ * for checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` (full UPI VPA / card PAN) is encrypted at rest via
+ * encryptPiiFields. `identifierHash` is a deterministic SHA-256 of the
+ * normalised identifier and stored unencrypted for cross-account queries.
+ * `displayLabel` is a pre-masked string and never contains full PII.
+ */
+import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+export type SavedPaymentMethodType = "upi" | "card" | "bank_account" | "wallet";
+export type SavedPaymentMethodBanStatus = "banned" | "suspicious" | "unban_requested";
+export interface SavedPaymentMethodDocument extends BaseDocument {
+    userId: string;
+    type: SavedPaymentMethodType;
+    /** Full UPI VPA / card PAN / account number — ENCRYPTED at rest. */
+    identifier: string;
+    /** Pre-masked display string, never contains full PII. e.g. "9876...@paytm", "XXXX 4321 (HDFC)" */
+    displayLabel: string;
+    /** SHA-256(type|normalised(identifier)) — unencrypted; enables cross-account dedup without decrypting. */
+    identifierHash: string;
+    isDefault?: boolean;
+    lastUsedAt?: Date;
+    banStatus?: SavedPaymentMethodBanStatus;
+    banReason?: string;
+    bannedBy?: string;
+    bannedAt?: Date;
+    autoBanned?: boolean;
+    unbanRequestNote?: string;
+    unbanRequestedAt?: Date;
+}
+export declare const SAVED_PAYMENT_METHODS_COLLECTION: "savedPaymentMethods";
+export declare const SAVED_PAYMENT_METHOD_INDEXED_FIELDS: readonly ["userId", "identifierHash", "banStatus", "type", "createdAt"];
+export declare const SAVED_PAYMENT_METHOD_PUBLIC_FIELDS: readonly ["id", "userId", "type", "displayLabel", "identifierHash", "isDefault", "lastUsedAt", "banStatus", "banReason", "bannedAt", "unbanRequestNote", "unbanRequestedAt", "createdAt", "updatedAt"];
+export declare const SAVED_PAYMENT_METHOD_UPDATABLE_FIELDS: readonly ["displayLabel", "isDefault", "lastUsedAt", "unbanRequestNote", "unbanRequestedAt"];
+export declare const SAVED_PAYMENT_METHOD_FIELDS: {
+    readonly USER_ID: "userId";
+    readonly TYPE: "type";
+    readonly IDENTIFIER: "identifier";
+    readonly DISPLAY_LABEL: "displayLabel";
+    readonly IDENTIFIER_HASH: "identifierHash";
+    readonly IS_DEFAULT: "isDefault";
+    readonly LAST_USED_AT: "lastUsedAt";
+    readonly BAN_STATUS: "banStatus";
+    readonly BAN_REASON: "banReason";
+    readonly BANNED_BY: "bannedBy";
+    readonly BANNED_AT: "bannedAt";
+    readonly AUTO_BANNED: "autoBanned";
+    readonly UNBAN_REQUEST_NOTE: "unbanRequestNote";
+    readonly UNBAN_REQUESTED_AT: "unbanRequestedAt";
+    readonly CREATED_AT: "createdAt";
+    readonly UPDATED_AT: "updatedAt";
+};
+export type SavedPaymentMethodCreateInput = {
+    type: SavedPaymentMethodType;
+    /** Raw identifier — will be encrypted + hashed by repository. */
+    identifier: string;
+    displayLabel: string;
+    isDefault?: boolean;
+};
+export type SavedPaymentMethodUpdateInput = Partial<Pick<SavedPaymentMethodDocument, (typeof SAVED_PAYMENT_METHOD_UPDATABLE_FIELDS)[number]>>;

package/dist/features/payments/schemas/saved-methods-firestore.js

@@ -0,0 +1,60 @@
+/**
+ * SavedPaymentMethod Firestore Document Types & Constants
+ *
+ * Stores user-saved payment identifiers (UPI VPAs, card tokens, bank accounts)
+ * for checkout pre-fill and cross-account fraud detection.
+ *
+ * PII: `identifier` (full UPI VPA / card PAN) is encrypted at rest via
+ * encryptPiiFields. `identifierHash` is a deterministic SHA-256 of the
+ * normalised identifier and stored unencrypted for cross-account queries.
+ * `displayLabel` is a pre-masked string and never contains full PII.
+ */
+export const SAVED_PAYMENT_METHODS_COLLECTION = "savedPaymentMethods";
+export const SAVED_PAYMENT_METHOD_INDEXED_FIELDS = [
+    "userId",
+    "identifierHash",
+    "banStatus",
+    "type",
+    "createdAt",
+];
+export const SAVED_PAYMENT_METHOD_PUBLIC_FIELDS = [
+    "id",
+    "userId",
+    "type",
+    "displayLabel",
+    "identifierHash",
+    "isDefault",
+    "lastUsedAt",
+    "banStatus",
+    "banReason",
+    "bannedAt",
+    "unbanRequestNote",
+    "unbanRequestedAt",
+    "createdAt",
+    "updatedAt",
+];
+export const SAVED_PAYMENT_METHOD_UPDATABLE_FIELDS = [
+    "displayLabel",
+    "isDefault",
+    "lastUsedAt",
+    "unbanRequestNote",
+    "unbanRequestedAt",
+];
+export const SAVED_PAYMENT_METHOD_FIELDS = {
+    USER_ID: "userId",
+    TYPE: "type",
+    IDENTIFIER: "identifier",
+    DISPLAY_LABEL: "displayLabel",
+    IDENTIFIER_HASH: "identifierHash",
+    IS_DEFAULT: "isDefault",
+    LAST_USED_AT: "lastUsedAt",
+    BAN_STATUS: "banStatus",
+    BAN_REASON: "banReason",
+    BANNED_BY: "bannedBy",
+    BANNED_AT: "bannedAt",
+    AUTO_BANNED: "autoBanned",
+    UNBAN_REQUEST_NOTE: "unbanRequestNote",
+    UNBAN_REQUESTED_AT: "unbanRequestedAt",
+    CREATED_AT: "createdAt",
+    UPDATED_AT: "updatedAt",
+};

package/dist/features/payments/server.d.ts

@@ -5,3 +5,5 @@
  */
 export { PaymentsRepository } from "./repository/payments.repository";
 export { payoutRepository } from "./repository/payout.repository";
+export { savedPaymentMethodsRepository, SavedPaymentMethodsRepository, } from "./repository/saved-payment-methods.repository";
+export * from "./schemas/saved-methods-firestore";

package/dist/features/payments/server.js

@@ -5,3 +5,5 @@
  */
 export { PaymentsRepository } from "./repository/payments.repository";
 export { payoutRepository } from "./repository/payout.repository";
+export { savedPaymentMethodsRepository, SavedPaymentMethodsRepository, } from "./repository/saved-payment-methods.repository";
+export * from "./schemas/saved-methods-firestore";

package/dist/features/promotions/schemas/index.d.ts

@@ -405,22 +405,22 @@ export declare const couponUsageFirestoreSchema: z.ZodObject<{
     orders: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
     id: string;
-    orders: string[];
     userId: string;
-    couponCode: string;
-    usageCount: number;
     lastUsedAt: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
-}, {
-    id: string;
     orders: string[];
-    userId: string;
     couponCode: string;
     usageCount: number;
+}, {
+    id: string;
+    userId: string;
     lastUsedAt: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    orders: string[];
+    couponCode: string;
+    usageCount: number;
 }>;
 export declare const claimedCouponStatusSchema: z.ZodEnum<["active", "expired", "used"]>;
 export declare const claimedCouponSourceSchema: z.ZodEnum<["manual", "promo", "spin", "raffle", "prize-draw"]>;

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -35,6 +35,10 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
      * Cloud Functions compatibility: approved review count + average by store.
      */
     getApprovedRatingAggregateByStore(storeId: string): Promise<ReviewRatingAggregate>;
+    /** Find reviews where this user is the reviewee (seller→buyer reviews received by a buyer). */
+    findByReviewee(revieweeId: string): Promise<ReviewDocument[]>;
+    /** Find reviews written by a user filtered by their role as reviewer. */
+    findByUserAsRole(userId: string, role: "buyer" | "seller"): Promise<ReviewDocument[]>;
     static readonly SIEVE_FIELDS: {
         id: {
             canFilter: boolean;
@@ -68,6 +72,14 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
             canFilter: boolean;
             canSort: boolean;
         };
+        revieweeId: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
+        reviewerRole: {
+            canFilter: boolean;
+            canSort: boolean;
+        };
         status: {
             canFilter: boolean;
             canSort: boolean;

package/dist/features/reviews/repository/reviews.repository.js

@@ -8,6 +8,8 @@ const REVIEW_FIELDS = {
     STATUS: "status",
     FEATURED: "featured",
     CREATED_AT: "createdAt",
+    REVIEWEE_ID: "revieweeId",
+    REVIEWER_ROLE: "reviewerRole",
 };
 class ReviewRepository extends BaseRepository {
     constructor() {
@@ -197,6 +199,26 @@ class ReviewRepository extends BaseRepository {
         const avgRating = Math.round((sum / count) * 10) / 10;
         return { count, avgRating };
     }
+    /** Find reviews where this user is the reviewee (seller→buyer reviews received by a buyer). */
+    async findByReviewee(revieweeId) {
+        const snapshot = await this.db
+            .collection(this.collection)
+            .where(REVIEW_FIELDS.REVIEWEE_ID, "==", revieweeId)
+            .where(REVIEW_FIELDS.STATUS, "==", "approved")
+            .orderBy(REVIEW_FIELDS.CREATED_AT, "desc")
+            .get();
+        return snapshot.docs.map((doc) => this.mapDoc(doc));
+    }
+    /** Find reviews written by a user filtered by their role as reviewer. */
+    async findByUserAsRole(userId, role) {
+        const snapshot = await this.db
+            .collection(this.collection)
+            .where(REVIEW_FIELDS.USER_ID, "==", userId)
+            .where(REVIEW_FIELDS.REVIEWER_ROLE, "==", role)
+            .orderBy(REVIEW_FIELDS.CREATED_AT, "desc")
+            .get();
+        return snapshot.docs.map((doc) => this.mapDoc(doc));
+    }
     async listForProduct(productId, model) {
         const baseQuery = this.getCollection().where(REVIEW_FIELDS.PRODUCT_ID, "==", productId);
         const result = await this.sieveQuery(model, ReviewRepository.SIEVE_FIELDS, {
@@ -232,6 +254,8 @@ ReviewRepository.SIEVE_FIELDS = {
     userName: { canFilter: false, canSort: false },
     storeId: { canFilter: true, canSort: false },
     storeName: { canFilter: true, canSort: false },
+    revieweeId: { canFilter: true, canSort: false },
+    reviewerRole: { canFilter: true, canSort: false },
     status: { canFilter: true, canSort: true },
     rating: { canFilter: true, canSort: true },
     verified: { canFilter: true, canSort: false },

package/dist/features/reviews/schemas/firestore.d.ts

@@ -46,9 +46,13 @@ export interface ReviewDocument extends BaseDocument {
     sellerRepliedAt?: Date;
     approvedAt?: Date;
     rejectedAt?: Date;
+    /** Set only on seller→buyer reviews. The userId of the buyer being reviewed. */
+    revieweeId?: string;
+    /** Absent on legacy docs = "buyer". Distinguishes seller→buyer reviews from buyer→product reviews. */
+    reviewerRole?: "buyer" | "seller";
 }
 export declare const REVIEW_COLLECTION: "reviews";
-export declare const REVIEW_INDEXED_FIELDS: readonly ["productId", "storeId", "userId", "status", "rating", "verified", "featured", "createdAt"];
+export declare const REVIEW_INDEXED_FIELDS: readonly ["productId", "storeId", "userId", "revieweeId", "reviewerRole", "status", "rating", "verified", "featured", "createdAt"];
 export declare const DEFAULT_REVIEW_DATA: Partial<ReviewDocument>;
 export declare const REVIEW_PUBLIC_FIELDS: readonly ["id", "productId", "userName", "userAvatar", "rating", "title", "comment", "helpfulCount", "verified", "images", "createdAt"];
 export declare const REVIEW_UPDATABLE_FIELDS: readonly ["rating", "title", "comment", "images"];

package/dist/features/reviews/schemas/firestore.js

@@ -13,6 +13,8 @@ export const REVIEW_INDEXED_FIELDS = [
     "productId",
     "storeId",
     "userId",
+    "revieweeId",
+    "reviewerRole",
     "status",
     "rating",
     "verified",

package/dist/features/reviews/schemas/index.d.ts

@@ -108,10 +108,10 @@ export declare const reviewFirestoreSchema: z.ZodObject<{
     updatedAt: string | Date | z.objectOutputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    userId: string;
     productId: string;
     productTitle: string;
     rating: number;
-    userId: string;
     userName: string;
     comment: string;
     helpfulCount: number;
@@ -155,10 +155,10 @@ export declare const reviewFirestoreSchema: z.ZodObject<{
     updatedAt: string | Date | z.objectInputType<{
         toDate: z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodDate>;
     }, z.ZodTypeAny, "passthrough">;
+    userId: string;
     productId: string;
     productTitle: string;
     rating: number;
-    userId: string;
     userName: string;
     comment: string;
     helpfulCount: number;
@@ -288,9 +288,9 @@ export declare const reviewSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     status: "pending" | "approved" | "rejected";
     id: string;
+    userId: string;
     productId: string;
     rating: 3 | 1 | 2 | 4 | 5;
-    userId: string;
     userName: string;
     video?: {
         url: string;
@@ -318,9 +318,9 @@ export declare const reviewSchema: z.ZodObject<{
 }, {
     status: "pending" | "approved" | "rejected";
     id: string;
+    userId: string;
     productId: string;
     rating: 3 | 1 | 2 | 4 | 5;
-    userId: string;
     userName: string;
     video?: {
         url: string;
@@ -364,9 +364,9 @@ export declare const reviewListParamsSchema: z.ZodObject<{
     featured?: boolean | undefined;
     page?: number | undefined;
     perPage?: number | undefined;
+    userId?: string | undefined;
     productId?: string | undefined;
     rating?: number | undefined;
-    userId?: string | undefined;
 }, {
     status?: "pending" | "approved" | "rejected" | undefined;
     sort?: string | undefined;
@@ -374,7 +374,7 @@ export declare const reviewListParamsSchema: z.ZodObject<{
     featured?: boolean | undefined;
     page?: number | undefined;
     perPage?: number | undefined;
+    userId?: string | undefined;
     productId?: string | undefined;
     rating?: number | undefined;
-    userId?: string | undefined;
 }>;

package/dist/features/seller/components/SellerAddressesView.js

@@ -2,7 +2,7 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useCallback, useEffect, useState } from "react";
 import { MapPin, Pencil, Plus, Trash2, Star } from "lucide-react";
-import { Button, ConfirmDeleteModal, Div, Grid, Heading, Label, Row, SideDrawer, Span, Stack, Table, Thead, Tbody, Tr, Th, Td, Text } from "../../../ui";
+import { Badge, Button, ConfirmDeleteModal, Div, Grid, Heading, Label, Row, SideDrawer, Span, Stack, Table, Thead, Tbody, Tr, Th, Td, Text } from "../../../ui";
 import { FieldInput } from "../../../ui/forms/FieldInput";
 import { FieldCheckbox } from "../../../ui/forms/FieldCheckbox";
 import { ROW_ACTION_META, ROW_ACTION_ID } from "../../../features/products/constants/action-defs";
@@ -50,7 +50,8 @@ function fromDoc(doc) {
     };
 }
 function AddressCard({ address, onEdit, onDelete, }) {
-    return (_jsxs(Stack, { surface: "card", padding: "sm", gap: "sm", children: [_jsxs(Row, { align: "start", justify: "between", gap: "xs", children: [_jsxs(Row, { gap: "xs", className: "min-w-0", children: [_jsx(MapPin, { className: "h-4 w-4 shrink-0 text-[var(--appkit-color-primary)]" }), _jsx(Span, { size: "sm", weight: "semibold", className: "truncate", color: "primary", children: address.label }), address.isDefault && (_jsxs(Span, { size: "xs", weight: "medium", className: CLS_DEFAULT_PILL, children: [_jsx(Star, { className: "h-3 w-3" }), "Default"] }))] }), _jsxs(Row, { gap: "px", className: "shrink-0", children: [_jsx("button", { type: "button", onClick: onEdit, title: "Edit address", className: "rounded-lg p-1.5 text-zinc-500 dark:text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800 hover:text-zinc-700 dark:hover:text-zinc-300 transition-colors", children: _jsx(Pencil, { className: "h-4 w-4" }) }), _jsx("button", { type: "button", onClick: onDelete, title: "Delete address", className: CLS_DELETE_BTN, children: _jsx(Trash2, { className: "h-4 w-4" }) })] })] }), _jsxs(Text, { size: "sm", color: "muted", children: [address.fullName, " \u00B7 ", address.phone] }), _jsxs(Text, { className: "leading-relaxed", color: "muted", size: "xs", children: [address.addressLine1, address.addressLine2 ? `, ${address.addressLine2}` : "", address.landmark ? ` (near ${address.landmark})` : "", _jsx("br", {}), address.city, ", ", address.state, " ", address.postalCode, ", ", address.country] })] }));
+    const isBanned = address.banStatus === "banned";
+    return (_jsxs(Stack, { surface: "card", padding: "sm", gap: "sm", children: [_jsxs(Row, { align: "start", justify: "between", gap: "xs", children: [_jsxs(Row, { gap: "xs", wrap: true, className: "min-w-0", children: [_jsx(MapPin, { className: "h-4 w-4 shrink-0 text-[var(--appkit-color-primary)]" }), _jsx(Span, { size: "sm", weight: "semibold", className: "truncate", color: "primary", children: address.label }), address.isDefault && (_jsxs(Span, { size: "xs", weight: "medium", className: CLS_DEFAULT_PILL, children: [_jsx(Star, { className: "h-3 w-3" }), "Default"] })), isBanned && _jsx(Badge, { variant: "danger", size: "sm", children: "Banned" })] }), _jsx(Row, { gap: "px", className: "shrink-0", children: isBanned ? (_jsx(Span, { size: "xs", color: "muted", title: "Contact support to resolve address ban", children: "Contact support" })) : (_jsxs(_Fragment, { children: [_jsx("button", { type: "button", onClick: onEdit, title: "Edit address", className: "rounded-lg p-1.5 text-zinc-500 dark:text-zinc-400 hover:bg-zinc-100 dark:hover:bg-zinc-800 hover:text-zinc-700 dark:hover:text-zinc-300 transition-colors", children: _jsx(Pencil, { className: "h-4 w-4" }) }), _jsx("button", { type: "button", onClick: onDelete, title: "Delete address", className: CLS_DELETE_BTN, children: _jsx(Trash2, { className: "h-4 w-4" }) })] })) })] }), _jsxs(Text, { size: "sm", color: "muted", children: [address.fullName, " \u00B7 ", address.phone] }), _jsxs(Text, { className: "leading-relaxed", color: "muted", size: "xs", children: [address.addressLine1, address.addressLine2 ? `, ${address.addressLine2}` : "", address.landmark ? ` (near ${address.landmark})` : "", _jsx("br", {}), address.city, ", ", address.state, " ", address.postalCode, ", ", address.country] })] }));
 }
 // ---------------------------------------------------------------------------
 // Main Component
@@ -143,5 +144,8 @@ export function SellerAddressesView({ apiBase = SELLER_ENDPOINTS.STORE_ADDRESSES
     const handleDelete = (addr) => setDeleteTargetAddr(addr);
     const set = (key, value) => setDraft((p) => ({ ...p, [key]: value }));
     const setField = (key) => (value) => set(key, value);
-    return (_jsxs(Div, { className: "min-h-screen", children: [_jsxs(Row, { border: "default", justify: "between", className: "sticky top-[var(--header-height,0px)] z-10 backdrop-blur-sm border-b", surface: "default", padding: "inline", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "base", weight: "semibold", color: "primary", children: "Pickup Addresses" }), _jsx(Text, { size: "xs", color: "muted", className: "mt-0.5", children: "Manage your store's pickup and return locations" })] }), _jsxs(Button, { gap: "sm", size: "sm", onClick: openAdd, children: [_jsx(Plus, { className: "h-4 w-4" }), _jsx(Span, { children: "Add Address" })] })] }), _jsxs(Div, { paddingX: "x-md-lg", className: "max-w-2xl", padding: "y-lg", children: [errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), isLoading ? (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })) : addresses.length === 0 ? (_jsxs(Stack, { border: "default", className: "border-2 border-dashed", padding: "y-4xl", align: "center", gap: "3", rounded: "xl", children: [_jsx(MapPin, { className: "h-8 w-8 text-zinc-300 dark:text-slate-600" }), _jsx(Text, { size: "sm", color: "muted", children: "No pickup addresses yet" }), _jsx(Button, { size: "sm", variant: "outline", onClick: openAdd, children: "Add your first address" })] })) : (_jsxs(_Fragment, { children: [_jsxs(Row, { justify: "end", className: "mb-2", children: [_jsx(Button, { size: "sm", variant: listView === "table" ? "primary" : "ghost", onClick: () => setListView("table"), children: "Table" }), _jsx(Button, { size: "sm", variant: listView === "cards" ? "primary" : "ghost", onClick: () => setListView("cards"), children: "Cards" })] }), listView === "cards" ? (_jsx(Grid, { gap: "sm", children: addresses.map((addr) => (_jsx(Div, { className: deletingId === addr.id ? "opacity-50 pointer-events-none" : "", children: _jsx(AddressCard, { address: addr, onEdit: () => openEdit(addr), onDelete: () => handleDelete(addr) }) }, addr.id))) })) : (_jsx(Div, { className: `${__O.xAuto}`, rounded: "lg", border: "default", children: _jsxs(Table, { size: "sm", children: [_jsx(Thead, { surface: "muted", children: _jsxs(Tr, { children: [_jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "Label" }), _jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "Name" }), _jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "City" }), _jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "Phone" }), _jsx(Th, { className: "text-right", padding: "sm", weight: "semibold", children: "Actions" })] }) }), _jsx(Tbody, { children: addresses.map((addr) => (_jsxs(Tr, { className: `border-t border-[var(--appkit-color-border)] ${deletingId === addr.id ? "opacity-50" : ""}`, children: [_jsx(Td, { padding: "sm", children: addr.label }), _jsx(Td, { padding: "sm", children: addr.fullName }), _jsxs(Td, { padding: "sm", children: [addr.city, ", ", addr.state] }), _jsx(Td, { className: "tabular-nums", padding: "sm", children: addr.phone }), _jsx(Td, { className: "text-right", padding: "sm", children: _jsxs(Row, { justify: "end", gap: "xs", children: [_jsx(Button, { size: "sm", variant: "ghost", onClick: () => openEdit(addr), children: ROW_ACTION_META[ROW_ACTION_ID.EDIT].label }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => handleDelete(addr), children: ROW_ACTION_META[ROW_ACTION_ID.DELETE].label })] }) })] }, addr.id))) })] }) }))] }))] }), _jsx(SideDrawer, { isOpen: drawerOpen, onClose: closeDrawer, title: editingId ? "Edit Address" : "Add Address", footer: _jsxs(Row, { gap: "xs", children: [_jsx(Button, { variant: "outline", onClick: closeDrawer, className: "flex-1", children: "Cancel" }), _jsx(Button, { onClick: handleSave, disabled: saving, className: "flex-1", children: saving ? "Saving…" : editingId ? "Save Changes" : "Add Address" })] }), children: _jsxs(Stack, { gap: "md", padding: "y-2xs", children: [saveError && (_jsx(Div, { textSize: "sm", className: "border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", children: saveError })), _jsx(FieldInput, { name: "label", label: "Label *", hint: "e.g. Warehouse, Shop, Home", type: "text", value: draft.label, onChange: setField("label"), placeholder: "Warehouse", maxLength: 60 }), _jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(FieldInput, { name: "fullName", label: "Full Name *", type: "text", value: draft.fullName, onChange: setField("fullName"), placeholder: "Ravi Kumar", maxLength: 100 }), _jsx(FieldInput, { name: "phone", label: "Phone *", type: "tel", value: draft.phone, onChange: setField("phone"), placeholder: "+91 98765 43210", maxLength: 20 })] }), _jsx(FieldInput, { name: "addressLine1", label: "Address Line 1 *", type: "text", value: draft.addressLine1, onChange: setField("addressLine1"), placeholder: "Shop 12, Main Market", maxLength: 200 }), _jsx(FieldInput, { name: "addressLine2", label: "Address Line 2", type: "text", value: draft.addressLine2, onChange: setField("addressLine2"), placeholder: "Building / Floor (optional)", maxLength: 200 }), _jsx(FieldInput, { name: "landmark", label: "Landmark", type: "text", value: draft.landmark, onChange: setField("landmark"), placeholder: "Near metro station (optional)", maxLength: 100 }), _jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(FieldInput, { name: "city", label: "City *", type: "text", value: draft.city, onChange: setField("city"), placeholder: "Mumbai", maxLength: 100 }), _jsx(FieldInput, { name: "state", label: "State *", type: "text", value: draft.state, onChange: setField("state"), placeholder: "Maharashtra", maxLength: 100 })] }), _jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(FieldInput, { name: "postalCode", label: "Postal Code *", type: "text", value: draft.postalCode, onChange: setField("postalCode"), placeholder: "400001", maxLength: 10 }), _jsx(FieldInput, { name: "country", label: "Country *", type: "text", value: draft.country, onChange: setField("country"), placeholder: "India", maxLength: 60 })] }), _jsx(FieldCheckbox, { name: "isDefault", label: "Set as default pickup address", checked: draft.isDefault, onChange: (c) => set("isDefault", c) })] }) }), deleteTargetAddr && (_jsx(ConfirmDeleteModal, { isOpen: true, title: "Delete Address", message: `Delete address "${deleteTargetAddr.label}"? This cannot be undone.`, onConfirm: () => { deleteById(deleteTargetAddr.id); setDeleteTargetAddr(null); }, onClose: () => setDeleteTargetAddr(null), isDeleting: deletingId === deleteTargetAddr.id }))] }));
+    return (_jsxs(Div, { className: "min-h-screen", children: [_jsxs(Row, { border: "default", justify: "between", className: "sticky top-[var(--header-height,0px)] z-10 backdrop-blur-sm border-b", surface: "default", padding: "inline", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "base", weight: "semibold", color: "primary", children: "Pickup Addresses" }), _jsx(Text, { size: "xs", color: "muted", className: "mt-0.5", children: "Manage your store's pickup and return locations" })] }), _jsxs(Button, { gap: "sm", size: "sm", onClick: openAdd, children: [_jsx(Plus, { className: "h-4 w-4" }), _jsx(Span, { children: "Add Address" })] })] }), _jsxs(Div, { paddingX: "x-md-lg", className: "max-w-2xl", padding: "y-lg", children: [errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), isLoading ? (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })) : addresses.length === 0 ? (_jsxs(Stack, { border: "default", className: "border-2 border-dashed", padding: "y-4xl", align: "center", gap: "3", rounded: "xl", children: [_jsx(MapPin, { className: "h-8 w-8 text-zinc-300 dark:text-slate-600" }), _jsx(Text, { size: "sm", color: "muted", children: "No pickup addresses yet" }), _jsx(Button, { size: "sm", variant: "outline", onClick: openAdd, children: "Add your first address" })] })) : (_jsxs(_Fragment, { children: [_jsxs(Row, { justify: "end", className: "mb-2", children: [_jsx(Button, { size: "sm", variant: listView === "table" ? "primary" : "ghost", onClick: () => setListView("table"), children: "Table" }), _jsx(Button, { size: "sm", variant: listView === "cards" ? "primary" : "ghost", onClick: () => setListView("cards"), children: "Cards" })] }), listView === "cards" ? (_jsx(Grid, { gap: "sm", children: addresses.map((addr) => (_jsx(Div, { className: deletingId === addr.id ? "opacity-50 pointer-events-none" : "", children: _jsx(AddressCard, { address: addr, onEdit: () => openEdit(addr), onDelete: () => handleDelete(addr) }) }, addr.id))) })) : (_jsx(Div, { className: `${__O.xAuto}`, rounded: "lg", border: "default", children: _jsxs(Table, { size: "sm", children: [_jsx(Thead, { surface: "muted", children: _jsxs(Tr, { children: [_jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "Label" }), _jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "Name" }), _jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "City" }), _jsx(Th, { className: "text-left", padding: "sm", weight: "semibold", children: "Phone" }), _jsx(Th, { className: "text-right", padding: "sm", weight: "semibold", children: "Actions" })] }) }), _jsx(Tbody, { children: addresses.map((addr) => {
+                                                const isBanned = addr.banStatus === "banned";
+                                                return (_jsxs(Tr, { className: `border-t border-[var(--appkit-color-border)] ${deletingId === addr.id ? "opacity-50" : ""}`, children: [_jsx(Td, { padding: "sm", children: _jsxs(Row, { gap: "xs", align: "center", children: [_jsx(Span, { children: addr.label }), isBanned && _jsx(Badge, { variant: "danger", size: "sm", children: "Banned" })] }) }), _jsx(Td, { padding: "sm", children: addr.fullName }), _jsxs(Td, { padding: "sm", children: [addr.city, ", ", addr.state] }), _jsx(Td, { className: "tabular-nums", padding: "sm", children: addr.phone }), _jsx(Td, { className: "text-right", padding: "sm", children: isBanned ? (_jsx(Span, { size: "xs", color: "muted", title: "Contact support to resolve address ban", children: "Contact support" })) : (_jsxs(Row, { justify: "end", gap: "xs", children: [_jsx(Button, { size: "sm", variant: "ghost", onClick: () => openEdit(addr), children: ROW_ACTION_META[ROW_ACTION_ID.EDIT].label }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => handleDelete(addr), children: ROW_ACTION_META[ROW_ACTION_ID.DELETE].label })] })) })] }, addr.id));
+                                            }) })] }) }))] }))] }), _jsx(SideDrawer, { isOpen: drawerOpen, onClose: closeDrawer, title: editingId ? "Edit Address" : "Add Address", footer: _jsxs(Row, { gap: "xs", children: [_jsx(Button, { variant: "outline", onClick: closeDrawer, className: "flex-1", children: "Cancel" }), _jsx(Button, { onClick: handleSave, disabled: saving, className: "flex-1", children: saving ? "Saving…" : editingId ? "Save Changes" : "Add Address" })] }), children: _jsxs(Stack, { gap: "md", padding: "y-2xs", children: [saveError && (_jsx(Div, { textSize: "sm", className: "border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", children: saveError })), _jsx(FieldInput, { name: "label", label: "Label *", hint: "e.g. Warehouse, Shop, Home", type: "text", value: draft.label, onChange: setField("label"), placeholder: "Warehouse", maxLength: 60 }), _jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(FieldInput, { name: "fullName", label: "Full Name *", type: "text", value: draft.fullName, onChange: setField("fullName"), placeholder: "Ravi Kumar", maxLength: 100 }), _jsx(FieldInput, { name: "phone", label: "Phone *", type: "tel", value: draft.phone, onChange: setField("phone"), placeholder: "+91 98765 43210", maxLength: 20 })] }), _jsx(FieldInput, { name: "addressLine1", label: "Address Line 1 *", type: "text", value: draft.addressLine1, onChange: setField("addressLine1"), placeholder: "Shop 12, Main Market", maxLength: 200 }), _jsx(FieldInput, { name: "addressLine2", label: "Address Line 2", type: "text", value: draft.addressLine2, onChange: setField("addressLine2"), placeholder: "Building / Floor (optional)", maxLength: 200 }), _jsx(FieldInput, { name: "landmark", label: "Landmark", type: "text", value: draft.landmark, onChange: setField("landmark"), placeholder: "Near metro station (optional)", maxLength: 100 }), _jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(FieldInput, { name: "city", label: "City *", type: "text", value: draft.city, onChange: setField("city"), placeholder: "Mumbai", maxLength: 100 }), _jsx(FieldInput, { name: "state", label: "State *", type: "text", value: draft.state, onChange: setField("state"), placeholder: "Maharashtra", maxLength: 100 })] }), _jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(FieldInput, { name: "postalCode", label: "Postal Code *", type: "text", value: draft.postalCode, onChange: setField("postalCode"), placeholder: "400001", maxLength: 10 }), _jsx(FieldInput, { name: "country", label: "Country *", type: "text", value: draft.country, onChange: setField("country"), placeholder: "India", maxLength: 60 })] }), _jsx(FieldCheckbox, { name: "isDefault", label: "Set as default pickup address", checked: draft.isDefault, onChange: (c) => set("isDefault", c) })] }) }), deleteTargetAddr && (_jsx(ConfirmDeleteModal, { isOpen: true, title: "Delete Address", message: `Delete address "${deleteTargetAddr.label}"? This cannot be undone.`, onConfirm: () => { deleteById(deleteTargetAddr.id); setDeleteTargetAddr(null); }, onClose: () => setDeleteTargetAddr(null), isDeleting: deletingId === deleteTargetAddr.id }))] }));
 }