@mohasinac/appkit 3.4.8 → 3.5.1

package/dist/_internal/server/features/checkout/bundle-expansion.d.ts

@@ -55,3 +55,34 @@ export interface StockShortfall {
  * that product, not just this item's slice.
  */
 export declare function validateCartItemStock(item: CartItemDocument, productById: Map<string, ProductDocument>, decrements: Map<string, number>): StockShortfall | null;
+/**
+ * Result of bucketing a cart into stock-satisfiable vs. stock-short lines.
+ * Shared shape consumed by both checkout entry points (COD/UPI transaction
+ * path and Razorpay post-payment path) so "what happens when an item is
+ * unavailable" (skip it vs. cancel the whole checkout) is decided ONCE, by
+ * the caller, from the same bucketing logic.
+ */
+export interface StockBucketResult {
+    available: {
+        item: CartItemDocument;
+        product: ProductDocument;
+    }[];
+    unavailable: {
+        productId: string;
+        productTitle: string;
+        requestedQty: number;
+        availableQty: number;
+    }[];
+}
+/**
+ * For every cart item: bucket into `available` (with its resolved
+ * "representative" product attached) or `unavailable` (with the shortfall
+ * detail). Pure stock bucketing only — callers are responsible for any
+ * extra per-item side effects (sync preflight checks, business-rule caps,
+ * etc.) they want to run over the `available` bucket.
+ *
+ * `resolveRepresentative` lets each call site supply its own "which product
+ * represents this cart line" logic (both current call sites use the first
+ * bundle member / the plain productId) without duplicating that lookup here.
+ */
+export declare function bucketCartItemsByStock(cartItems: CartItemDocument[], productById: Map<string, ProductDocument>, decrements: Map<string, number>, resolveRepresentative: (item: CartItemDocument) => ProductDocument | null): StockBucketResult;

package/dist/_internal/server/features/checkout/bundle-expansion.js

@@ -68,3 +68,44 @@ export function validateCartItemStock(item, productById, decrements) {
     }
     return null;
 }
+/**
+ * For every cart item: bucket into `available` (with its resolved
+ * "representative" product attached) or `unavailable` (with the shortfall
+ * detail). Pure stock bucketing only — callers are responsible for any
+ * extra per-item side effects (sync preflight checks, business-rule caps,
+ * etc.) they want to run over the `available` bucket.
+ *
+ * `resolveRepresentative` lets each call site supply its own "which product
+ * represents this cart line" logic (both current call sites use the first
+ * bundle member / the plain productId) without duplicating that lookup here.
+ */
+export function bucketCartItemsByStock(cartItems, productById, decrements, resolveRepresentative) {
+    const available = [];
+    const unavailable = [];
+    for (const item of cartItems) {
+        const shortfall = validateCartItemStock(item, productById, decrements);
+        if (shortfall) {
+            unavailable.push({
+                productId: shortfall.productId,
+                productTitle: item.productTitle,
+                requestedQty: item.quantity,
+                availableQty: shortfall.availableQty,
+            });
+            continue;
+        }
+        const representative = resolveRepresentative(item);
+        if (!representative) {
+            // Defensive — validateCartItemStock already confirmed every member
+            // product exists + is published, so this should be unreachable.
+            unavailable.push({
+                productId: item.productId,
+                productTitle: item.productTitle,
+                requestedQty: item.quantity,
+                availableQty: 0,
+            });
+            continue;
+        }
+        available.push({ item, product: representative });
+    }
+    return { available, unavailable };
+}

package/dist/_internal/server/features/lottery/actions.js

@@ -1,7 +1,7 @@
 "use server";
 import { wrapAction } from "@mohasinac/appkit/server";
 import { getAdminDb } from "../../../../providers/db-firebase";
-import { eventRepository } from "../../../../repositories";
+import { eventRepository, productRepository } from "../../../../repositories";
 import { lotteryEntryRepository } from "../../../../features/lottery/repository/lottery-entry.repository";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { ValidationError } from "../../../shared/errors/index";
@@ -52,8 +52,17 @@ export async function submitLotteryPullAction(input) {
             lotteryConfig = event.lotteryConfig;
         }
         else {
-            // Product lottery — load via product repository (not implemented here; caller ensures correct source)
-            throw new ValidationError("Product lottery pull must go through the product lottery pull route.");
+            const product = await productRepository.findById(sourceId).catch(() => null);
+            if (!product || product.listingType !== "prize-draw") {
+                throw new LotteryError("LOTTERY_WINDOW_CLOSED", "Prize-draw product not found.");
+            }
+            if (product.status !== "published") {
+                throw new LotteryError("LOTTERY_WINDOW_CLOSED", "This prize draw is not currently active.");
+            }
+            if (product.prizeDrawMode !== "lottery" || !product.lotteryConfig) {
+                throw new LotteryError("LOTTERY_WINDOW_CLOSED", "Lottery config not found on product.");
+            }
+            lotteryConfig = product.lotteryConfig;
         }
         // Check draw window
         if (!isDrawWindowOpen(lotteryConfig)) {
@@ -71,7 +80,8 @@ export async function submitLotteryPullAction(input) {
         }
         // Atomically: pick slot + create entry + mark slot booked
         const db = getAdminDb();
-        const sourceDocRef = db.collection("events").doc(sourceId);
+        const sourceCollectionName = data.sourceType === "event" ? "events" : "products";
+        const sourceDocRef = db.collection(sourceCollectionName).doc(sourceId);
         const { assignedSlot, userLotteryNumber } = await db.runTransaction(async (tx) => {
             // Re-read lotteryConfig inside transaction for freshness
             const sourceSnap = await tx.get(sourceDocRef);

package/dist/_internal/server/features/maintenance/analyze.js

@@ -10,6 +10,7 @@
  */
 import { getAdminDb } from "../../../../providers/db-firebase/admin";
 import { SERVER_ERRORS_COLLECTION, } from "../../../../features/server-errors/schemas/firestore";
+import { CLIENT_ERROR_ENDPOINTS } from "../../../../constants/api-endpoints";
 function topFrames(stack, n) {
     if (!stack)
         return [];
@@ -153,9 +154,10 @@ export async function analyzeLogs(opts) {
     if (topCodes.find((c) => c.code.startsWith("PAYMENT_ROLLBACK"))) {
         recommendations.push("PAYMENT_ROLLBACK_* observed — verify Razorpay webhook health and check the refund-rollback path.");
     }
-    if (topRoutes.find((r) => r.route === "/api/client-errors" &&
+    if (topRoutes.find((r) => r.route === CLIENT_ERROR_ENDPOINTS.REPORT &&
         topCodes[0]?.code === "NETWORK_ERROR")) {
-        recommendations.push("/api/client-errors itself is failing — ingestion endpoint may be down; client errors are being lost.");
+        // audit-hardcoded-api-routes-ok: human-readable diagnostic message, not a call site
+        recommendations.push(`${CLIENT_ERROR_ENDPOINTS.REPORT} itself is failing — ingestion endpoint may be down; client errors are being lost.`);
     }
     if (recommendations.length === 0) {
         recommendations.push("No anomaly heuristics triggered — failures are within expected distribution.");

package/dist/_internal/server/features/orders/actions.js

@@ -97,6 +97,15 @@ export async function adminVerifyPaymentAction(orderId) {
             paymentStatus: "paid",
             paymentId: order.paymentTransactionId ?? order.paymentId ?? `manual-${orderId}`,
             status: "processing",
+            paymentRecord: {
+                method: "manual",
+                transactionId: order.paymentTransactionId,
+                proofUrl: order.paymentProofUrl,
+                amountPaise: order.totalPrice,
+                paidAt: new Date(),
+                verifiedBy: user.uid,
+                verificationMethod: "manual_review",
+            },
         });
     });
 }

package/dist/_internal/server/features/orders/adapters.js

@@ -64,5 +64,24 @@ export function orderDocumentToOrder(doc) {
         updatedAt: doc.updatedAt instanceof Date
             ? doc.updatedAt.toISOString()
             : String(doc.updatedAt),
+        ...(doc.prizeWon
+            ? {
+                prizeWon: {
+                    ...doc.prizeWon,
+                    wonAt: doc.prizeWon.wonAt instanceof Date
+                        ? doc.prizeWon.wonAt.toISOString()
+                        : String(doc.prizeWon.wonAt),
+                },
+            }
+            : {}),
+        ...(doc.prizeRevealDeadline
+            ? {
+                prizeRevealDeadline: doc.prizeRevealDeadline instanceof Date
+                    ? doc.prizeRevealDeadline.toISOString()
+                    : String(doc.prizeRevealDeadline),
+            }
+            : {}),
+        ...(doc.prizeRevealExpired !== undefined ? { prizeRevealExpired: doc.prizeRevealExpired } : {}),
+        ...(doc.prizeDrawProductId ? { prizeDrawProductId: doc.prizeDrawProductId } : {}),
     };
 }

package/dist/_internal/server/features/seo/robots.js

@@ -6,7 +6,7 @@ export function buildRobots({ siteUrl }) {
                 allow: "/",
                 disallow: [
                     "/admin/",
-                    "/api/",
+                    "/api/", // audit-hardcoded-api-routes-ok: robots.txt disallow prefix, not an endpoint reference
                     "/seller/",
                     "/user/",
                     "/auth/",

package/dist/_internal/server/functions/firestore.d.ts

@@ -23,8 +23,54 @@ export declare const onSupportTicketUpdate: import("./types").DocumentTriggerFun
 export declare const onUserBanChange: import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>;
 export declare const onScamReportCreate: import("./types").DocumentTriggerFunctionDefinition<null, Record<string, import("../../..").JsonValue>>;
 export declare const onScamReportUpdate: import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>;
+export declare const onShipmentItemWrite: import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>;
+export declare const onShipmentLotWrite: import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>;
+export declare const onShipmentHeaderWrite: import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>;
+export declare const onShipmentDeleted: import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>;
+export declare const onCatalogueSubmittedForApproval: import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>;
+export declare const onJobCreated: import("./types").DocumentTriggerFunctionDefinition<null, import("../../../server").JobDocument>;
 export declare const FIRESTORE_TRIGGER_FUNCTIONS: readonly [import("./types").DocumentTriggerFunctionDefinition<null, import("../jobs").NewBid>, import("./types").DocumentTriggerFunctionDefinition<null, import("../jobs").NewOrder>, import("./types").DocumentTriggerFunctionDefinition<import("../jobs").OrderBefore, import("../jobs").OrderAfter>, import("./types").DocumentTriggerFunctionDefinition<import("../jobs").ProductDoc, import("../jobs").ProductDoc>, import("./types").DocumentTriggerFunctionDefinition<{
     [x: string]: import("../../..").JsonValue;
 }, {
     [x: string]: import("../../..").JsonValue;
-}>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<import("../jobs").CategoryDoc, import("../jobs").CategoryDoc>, import("./types").DocumentTriggerFunctionDefinition<import("../jobs").StoreDoc, import("../jobs").StoreDoc>, import("./types").DocumentTriggerFunctionDefinition<null, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<null, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>];
+}>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<import("../jobs").CategoryDoc, import("../jobs").CategoryDoc>, import("./types").DocumentTriggerFunctionDefinition<import("../jobs").StoreDoc, import("../jobs").StoreDoc>, import("./types").DocumentTriggerFunctionDefinition<null, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<null, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<Record<string, import("../../..").JsonValue>, Record<string, import("../../..").JsonValue>>, import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>, import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>, import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>, import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>, import("./types").DocumentTriggerFunctionDefinition<{
+    [x: string]: import("../../..").JsonValue;
+}, {
+    [x: string]: import("../../..").JsonValue;
+}>, import("./types").DocumentTriggerFunctionDefinition<null, import("../../../server").JobDocument>];

package/dist/_internal/server/functions/firestore.js

@@ -6,7 +6,7 @@
  * The path patterns mirror the original `functions/src/index.ts` declarations
  * to preserve identical deploy behavior.
  */
-import { onBidPlacedHandler, onCategoryWriteHandler, onOrderCreateHandler, onOrderStatusChangeHandler, onProductStockChangeHandler, onProductWriteHandler, onReviewWriteHandler, onScamReportCreateHandler, onScamReportUpdateHandler, onStoreWriteHandler, onSupportTicketCreateHandler, onSupportTicketUpdateHandler, onUserBanChangeHandler, } from "../jobs/handlers";
+import { onBidPlacedHandler, onCategoryWriteHandler, onOrderCreateHandler, onOrderStatusChangeHandler, onProductStockChangeHandler, onProductWriteHandler, onReviewWriteHandler, onScamReportCreateHandler, onScamReportUpdateHandler, onStoreWriteHandler, onSupportTicketCreateHandler, onSupportTicketUpdateHandler, onUserBanChangeHandler, onShipmentItemWriteHandler, onShipmentLotWriteHandler, onShipmentHeaderWriteHandler, onShipmentDeletedHandler, onCatalogueSubmittedForApprovalHandler, onJobCreatedHandler, } from "../jobs/handlers";
 import { defineFunction } from "./define";
 const REGION = "asia-south1";
 export const onBidPlaced = defineFunction({
@@ -100,6 +100,55 @@ export const onScamReportUpdate = defineFunction({
     handler: onScamReportUpdateHandler,
     options: { region: REGION },
 });
+// Procurement Shipments — 3-function recompute cascade. See
+// onShipmentItemWrite/onShipmentAllocationSync/onShipmentDeleted handler
+// files for the full data-flow explanation.
+export const onShipmentItemWrite = defineFunction({
+    name: "onShipmentItemWrite",
+    description: "Recompute a shipment lot's itemCount + mainItemsProjectedRevenuePaise on any item write.",
+    trigger: { kind: "documentWritten", pathPattern: "shipmentItems/{itemId}" },
+    handler: onShipmentItemWriteHandler,
+    options: { region: REGION },
+});
+export const onShipmentLotWrite = defineFunction({
+    name: "onShipmentLotWrite",
+    description: "Recompute cross-lot customs/shipping allocation + shipment totals on any lot write.",
+    trigger: { kind: "documentWritten", pathPattern: "shipmentLots/{lotId}" },
+    handler: onShipmentLotWriteHandler,
+    options: { region: REGION },
+});
+export const onShipmentHeaderWrite = defineFunction({
+    name: "onShipmentHeaderWrite",
+    description: "Recompute cross-lot allocation when a shipment's customs/shipping/labor/status fields change.",
+    trigger: { kind: "documentWritten", pathPattern: "procurementShipments/{shipmentId}" },
+    handler: onShipmentHeaderWriteHandler,
+    options: { region: REGION },
+});
+export const onShipmentDeleted = defineFunction({
+    name: "onShipmentDeleted",
+    description: "Cascade-delete a shipment's lots + items in batches of 500 (bound as documentWritten; handler checks for deletion).",
+    trigger: { kind: "documentWritten", pathPattern: "procurementShipments/{shipmentId}" },
+    handler: onShipmentDeletedHandler,
+    options: { region: REGION },
+});
+export const onCatalogueSubmittedForApproval = defineFunction({
+    name: "onCatalogueSubmittedForApproval",
+    description: "Notify all admins when a catalogue item's listingStatus transitions to pending_admin_approval.",
+    trigger: { kind: "documentUpdated", pathPattern: "catalogueItems/{itemId}" },
+    handler: onCatalogueSubmittedForApprovalHandler,
+    options: { region: REGION },
+});
+// Async job primitive — Vercel routes write a lightweight `jobs/{jobId}` doc
+// via `enqueueJob()` and return immediately; this Function does the actual
+// processing (CLAUDE.md Rule #6). Longer timeout/memory than the other
+// triggers since job runners (e.g. hardBanCascade, payoutsWeekly) do real work.
+export const onJobCreated = defineFunction({
+    name: "onJobCreated",
+    description: "Dispatch a jobs/{jobId} doc to its JOB_RUNNERS entry and report the result via bulk_events RTDB.",
+    trigger: { kind: "documentCreated", pathPattern: "jobs/{jobId}" },
+    handler: onJobCreatedHandler,
+    options: { region: REGION, timeoutSeconds: 300, memory: "512MiB" },
+});
 export const FIRESTORE_TRIGGER_FUNCTIONS = [
     onBidPlaced,
     onOrderCreate,
@@ -114,4 +163,10 @@ export const FIRESTORE_TRIGGER_FUNCTIONS = [
     onUserBanChange,
     onScamReportCreate,
     onScamReportUpdate,
+    onShipmentItemWrite,
+    onShipmentLotWrite,
+    onShipmentHeaderWrite,
+    onShipmentDeleted,
+    onCatalogueSubmittedForApproval,
+    onJobCreated,
 ];

package/dist/_internal/server/functions/scheduled.d.ts

@@ -20,4 +20,5 @@ export declare const prizeRevealExpiry: import("./types").ScheduledFunctionDefin
 export declare const prizeRevealReminder: import("./types").ScheduledFunctionDefinition;
 export declare const bundleStockSync: import("./types").ScheduledFunctionDefinition;
 export declare const emiInstallmentReminder: import("./types").ScheduledFunctionDefinition;
-export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];
+export declare const catalogueImageStalenessReminder: import("./types").ScheduledFunctionDefinition;
+export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];

package/dist/_internal/server/functions/scheduled.js

@@ -1,6 +1,6 @@
 // Scheduled function definitions (Cloud Scheduler triggers).
 // Cron syntax accepts both Firebase shorthand and standard cron expressions.
-import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, payoutBatchHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeRevealCloseHandler, prizeRevealExpiryHandler, prizeRevealOpenHandler, prizeRevealReminderHandler, productStatsSyncHandler, weeklyPayoutEligibilityHandler, } from "../jobs/handlers";
+import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, payoutBatchHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeRevealCloseHandler, prizeRevealExpiryHandler, prizeRevealOpenHandler, prizeRevealReminderHandler, productStatsSyncHandler, weeklyPayoutEligibilityHandler, } from "../jobs/handlers";
 import { defineFunction } from "./define";
 const REGION = "asia-south1";
 const EVERY_5_MIN = "every 5 minutes";
@@ -158,6 +158,13 @@ export const emiInstallmentReminder = defineFunction({
     handler: emiInstallmentReminderHandler,
     options: { region: REGION, timeoutSeconds: 300, memory: "256MiB", maxInstances: 1 },
 });
+export const catalogueImageStalenessReminder = defineFunction({
+    name: "catalogueImageStalenessReminder",
+    description: "Remind catalogue owners whose photos are nearing the 30-day freshness cutoff (daily 07:00 IST).",
+    trigger: { kind: "schedule", cron: "0 7 * * *", timeZone: "Asia/Kolkata" },
+    handler: catalogueImageStalenessReminderHandler,
+    options: { region: REGION, timeoutSeconds: 300, memory: "256MiB", maxInstances: 1 },
+});
 export const SCHEDULED_FUNCTIONS = [
     auctionSettlement,
     pendingOrderTimeout,
@@ -181,4 +188,5 @@ export const SCHEDULED_FUNCTIONS = [
     prizeRevealReminder,
     bundleStockSync,
     emiInstallmentReminder,
+    catalogueImageStalenessReminder,
 ];

package/dist/_internal/server/jobs/core/catalogueImageStalenessReminder.d.ts

@@ -0,0 +1,10 @@
+import type { JobContext } from "../runtime/types";
+/**
+ * Daily sweep — nudges catalogue owners whose photos are approaching (or
+ * past) the freshness cutoff (`assertCatalogueImagesFresh`'s 30-day gate),
+ * so the "List" / "Request to sell" block doesn't come as a surprise.
+ * `staleReminderSentAt` gates re-notification: only fires again once
+ * `lastImageUpdateAt` has moved past the previous reminder (i.e. the owner
+ * uploaded a fresh photo and then let it go stale again).
+ */
+export declare function runCatalogueImageStalenessReminder(ctx: JobContext): Promise<void>;

package/dist/_internal/server/jobs/core/catalogueImageStalenessReminder.js

@@ -0,0 +1,49 @@
+import { normalizeError } from "../../../../errors/normalize";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions";
+import { catalogueRepository } from "../../../../repositories";
+import { CATALOGUE_IMAGE_FRESHNESS_DAYS } from "../../../../features/catalogue/schemas/firestore";
+const REMINDER_LEAD_DAYS = 5;
+const DAY_MS = 86400000;
+/**
+ * Daily sweep — nudges catalogue owners whose photos are approaching (or
+ * past) the freshness cutoff (`assertCatalogueImagesFresh`'s 30-day gate),
+ * so the "List" / "Request to sell" block doesn't come as a surprise.
+ * `staleReminderSentAt` gates re-notification: only fires again once
+ * `lastImageUpdateAt` has moved past the previous reminder (i.e. the owner
+ * uploaded a fresh photo and then let it go stale again).
+ */
+export async function runCatalogueImageStalenessReminder(ctx) {
+    ctx.logger.info("Catalogue image staleness reminder sweep starting");
+    const reminderCutoff = new Date(ctx.now.getTime() - (CATALOGUE_IMAGE_FRESHNESS_DAYS - REMINDER_LEAD_DAYS) * DAY_MS);
+    const items = await catalogueRepository.listStale(reminderCutoff, 200);
+    let remindersSent = 0;
+    for (const item of items) {
+        if (item.listingStatus === "listed")
+            continue; // already listed — no gate left to hit
+        const lastUpdate = new Date(item.lastImageUpdateAt);
+        if (item.staleReminderSentAt && new Date(item.staleReminderSentAt) >= lastUpdate)
+            continue; // already reminded for this image set
+        try {
+            await sendNotification({
+                userId: item.ownerId,
+                type: "catalogue_images_stale",
+                priority: "normal",
+                title: "Refresh your catalogue photos",
+                message: `Photos for "${item.title}" are getting old — refresh them within ${CATALOGUE_IMAGE_FRESHNESS_DAYS - REMINDER_LEAD_DAYS} days or you won't be able to list it.`,
+                relatedId: item.id,
+                relatedType: "catalogueItem",
+                actionUrl: `/user/catalogue/${item.id}/edit`,
+            });
+            await catalogueRepository.update(item.id, { staleReminderSentAt: ctx.now });
+            remindersSent++;
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.warn("Catalogue staleness reminder notification failed", {
+                itemId: item.id,
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    ctx.logger.info("Catalogue image staleness reminder sweep complete", { remindersSent });
+}

package/dist/_internal/server/jobs/core/cleanupRtdbEvents.js

@@ -1,7 +1,11 @@
 import { normalizeError } from "../../../../errors/normalize";
 import { getAdminAuth, getAdminRealtimeDb } from "../../../../providers/db-firebase";
+import { jobsRepository } from "../../../../repositories";
+import { batchDelete } from "../handlers/_helpers";
 const AUTH_STALE_MS = 3 * 60 * 1000;
 const PAYMENT_STALE_MS = 15 * 60 * 1000;
+const BULK_STALE_MS = 15 * 60 * 1000;
+const JOBS_TTL_DAYS = 30;
 export async function runCleanupRtdbEvents(ctx) {
     ctx.logger.info("Starting RTDB events cleanup");
     const rtdb = getAdminRealtimeDb();
@@ -47,5 +51,33 @@ export async function runCleanupRtdbEvents(ctx) {
         void normalizeError(payErr);
         ctx.logger.error("Payment events cleanup failed (non-fatal)", payErr);
     }
+    try {
+        const bulkSnap = await rtdb.ref("bulk_events").get();
+        if (bulkSnap.exists()) {
+            const allBulkEvents = bulkSnap.val();
+            const staleBulkIds = Object.entries(allBulkEvents)
+                .filter(([, node]) => (node.updatedAt ?? node.createdAt ?? 0) < now - BULK_STALE_MS)
+                .map(([id]) => id);
+            if (staleBulkIds.length > 0) {
+                await Promise.all(staleBulkIds.map((id) => rtdb.ref(`bulk_events/${id}`).remove()));
+                ctx.logger.info("Bulk events removed", { count: staleBulkIds.length });
+            }
+        }
+    }
+    catch (bulkErr) {
+        void normalizeError(bulkErr);
+        ctx.logger.error("Bulk events cleanup failed (non-fatal)", bulkErr);
+    }
+    try {
+        const staleJobRefs = await jobsRepository.getStaleFinishedRefs(JOBS_TTL_DAYS);
+        if (staleJobRefs.length > 0) {
+            const deleted = await batchDelete(ctx, staleJobRefs);
+            ctx.logger.info("Stale jobs pruned", { deleted });
+        }
+    }
+    catch (jobsErr) {
+        void normalizeError(jobsErr);
+        ctx.logger.error("Jobs prune failed (non-fatal)", jobsErr);
+    }
     ctx.logger.info("RTDB events cleanup complete");
 }

package/dist/_internal/server/jobs/core/hardBanCascade.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Core: hard-ban cascade — disables Auth login, marks the user banned,
+ * revokes sessions, suspends any owned store + archives its products,
+ * cancels active bids, and cascades the ban across any address / payment
+ * clusters shared with other accounts (fraud-ring containment).
+ *
+ * Extracted verbatim (stage-for-stage) from the former synchronous
+ * `POST /api/admin/users/[uid]/hard-ban` route body — that route now only
+ * runs the cheap pre-flight guards (self-ban / target-exists / admin-target)
+ * and enqueues this as a `hardBanCascade` job (see `./jobRunners.ts`) so the
+ * cascade runs inside a Firebase Function instead of the Vercel 10s sync
+ * ceiling (CLAUDE.md Rule #6).
+ *
+ * Each stage keeps its original non-fatal try/catch-log-continue behavior,
+ * EXCEPT stage 2 (marking the user banned on Firestore), which is the one
+ * write that must succeed for the ban to take effect — if it throws, the job
+ * is marked failed so an admin can retry.
+ */
+import type { JobContext } from "../runtime/types";
+import type { JobRunResult } from "./jobRunners";
+export interface HardBanCascadeInput {
+    uid: string;
+    reason: string;
+    bannedBy: string;
+}
+export declare function runHardBanCascade(input: HardBanCascadeInput, ctx: JobContext): Promise<JobRunResult>;