@mohasinac/appkit 3.8.1 → 3.9.0

package/dist/_internal/server/features/orders/actions.d.ts

@@ -7,5 +7,33 @@ export declare function attachPaymentProofAction(orderId: string, proof: {
     proofUrl: string;
     transactionId?: string;
     mimeType?: string;
+    buyerMarkedPaid: boolean;
+    buyerFraudAgreementAccepted: boolean;
+    buyerReportedUpiId?: string;
 }): Promise<ActionResult<void>>;
 export declare function adminVerifyPaymentAction(orderId: string): Promise<ActionResult<void>>;
+/**
+ * Tier PP — "honest mistake" tier of the two-tier admin review (blurry
+ * screenshot, wrong amount typed). Clears the proof so the buyer can cleanly
+ * resubmit, and extends `paymentDeadline` by another 15 minutes from now so
+ * review latency doesn't eat into the buyer's time to fix it. Order stays
+ * `pending`/`pending` — no penalty.
+ */
+export declare function adminRequestProofReuploadAction(orderId: string, note: string): Promise<ActionResult<void>>;
+/**
+ * Tier PP — "fraud" tier of the two-tier admin review. Cancels the order,
+ * restores stock, and triggers a new temporary 7-day full-account hard ban
+ * (extends the existing permanent-only `hardBanCascade` job with an
+ * `expiresAt`, rather than forking a parallel cascade — see
+ * `HardBanCascadeInput.expiresAt`).
+ */
+export declare function adminRejectPaymentAsFraudAction(orderId: string, note: string): Promise<ActionResult<void>>;
+/**
+ * Tier PP — raises a dispute on an auto-approved order ("the automation
+ * might be wrong"). Only valid when `autoApproved === true` — a manually
+ * reviewed order already went through human judgment and disputes on it go
+ * through the existing return/refund flow instead. Callable by the buyer,
+ * the seller (store owner), or admin/moderator. Does not itself reverse
+ * payment/order status — surfaces to the admin queue for investigation.
+ */
+export declare function raiseOrderDisputeAction(orderId: string, reason: string): Promise<ActionResult<void>>;

package/dist/_internal/server/features/orders/actions.js

@@ -1,12 +1,19 @@
 "use server";
 import { wrapAction } from "@mohasinac/appkit/server";
-import { orderRepository } from "../../../../repositories";
+import { orderRepository, storeRepository, userRepository } from "../../../../repositories";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { createOrderSchema, updateOrderStatusSchema, cancelOrderSchema, } from "../../../shared/features/orders/schema";
 import { assertOrderCancellable, assertReturnWindowOpen } from "./service";
 import { ValidationError } from "../../../shared/errors/index";
 import { OrderNotFoundError, OrderOwnershipError } from "../../../shared/features/orders/errors";
 import { isAdminUser, isModeratorUser } from "../../../../features/auth/role-predicates";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions";
+import { restoreStockForOrder } from "../checkout/stock-restore";
+import { getAdminDb } from "../../../../providers/db-firebase";
+import { enqueueJob } from "../../../../features/jobs/actions/enqueue-job";
+import { PAYMENT_WINDOW_MS, PAYMENT_FRAUD_REJECTED_REASON } from "../../../../features/orders/constants/payment-window";
+import { normalizeError } from "../../../../errors/normalize";
+import { serverLogger } from "../../../../monitoring";
 export async function createOrderAction(input) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["buyer", "seller", "admin"]);
@@ -59,6 +66,63 @@ export async function updateOrderStatusAction(input) {
     });
 }
 // ── P-1 Manual payment proof ─────────────────────────────────────────────────
+/** Loose UPI VPA comparison — case/whitespace differences shouldn't register as a mismatch. */
+function normalizeUpi(vpa) {
+    return (vpa ?? "").trim().toLowerCase();
+}
+const REASON_REQUIRED_MSG = "A reason is required";
+/**
+ * Fast-review WhatsApp push — fans out to every configured admin number so
+ * a payment proof can be acted on within the 2-hour auto-approve window
+ * without hunting through the orders list. Fire-and-forget, non-fatal on
+ * failure (mirrors the existing `onOrderCreate.ts` purchase-announcement
+ * pattern) — skips silently if the WhatsApp Cloud API isn't configured.
+ */
+function notifyAdminsOfPaymentProof(order) {
+    void (async () => {
+        try {
+            const [{ resolveKeys }, { sendWhatsAppBusinessMessage, buildPaymentProofReviewMessage }] = await Promise.all([
+                import("../../../../core/integration-keys"),
+                import("../../../../features/whatsapp-bot/server"),
+            ]);
+            const keys = await resolveKeys();
+            if (!keys.whatsappPhoneNumberId || !keys.whatsappCloudApiToken)
+                return;
+            const adminNumbers = keys.whatsappAdminNotifyNumbers
+                .split(",")
+                .map((n) => n.trim().replace(/\D/g, ""))
+                .filter(Boolean);
+            if (adminNumbers.length === 0)
+                return;
+            // No hardcoded domain fallback here (audit-ssr-in-appkit) — every
+            // consumer sets NEXT_PUBLIC_SITE_URL; skip the review link rather than
+            // guessing a brand-specific domain from inside appkit/_internal/.
+            const baseUrl = process.env.NEXT_PUBLIC_SITE_URL ?? "";
+            const message = buildPaymentProofReviewMessage({
+                orderId: order.id,
+                buyerName: order.userName,
+                productTitle: order.productTitle,
+                totalAmount: order.totalPrice,
+                reviewUrl: `${baseUrl}/admin/orders`,
+            });
+            await Promise.allSettled(adminNumbers.map((toPhone) => sendWhatsAppBusinessMessage({
+                toPhone,
+                message,
+                phoneNumberId: keys.whatsappPhoneNumberId,
+                accessToken: keys.whatsappCloudApiToken,
+            })));
+        }
+        catch (err) {
+            void normalizeError(err);
+            // Non-fatal — the order itself already saved successfully; a WhatsApp
+            // Cloud API hiccup here must never surface as a proof-upload failure.
+            serverLogger.warn("Payment-proof admin WhatsApp push failed (non-fatal)", {
+                orderId: order.id,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    })();
+}
 export async function attachPaymentProofAction(orderId, proof) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["buyer", "seller", "admin"]);
@@ -68,17 +132,41 @@ export async function attachPaymentProofAction(orderId, proof) {
         if (!isAdminUser(user) && order.userId !== user.uid)
             throw new OrderOwnershipError(orderId);
         const pm = order.paymentMethod ?? "";
-        if (pm !== "cash" && pm !== "upi_manual") {
-            throw new ValidationError("Payment proof can only be attached to cash or UPI orders");
+        if (pm !== "cash" && pm !== "upi_manual" && pm !== "emi") {
+            throw new ValidationError("Payment proof can only be attached to cash, UPI, or EMI orders");
         }
         if (order.paymentProofUrl) {
             throw new ValidationError("PROOF_ALREADY_ATTACHED");
         }
+        // The 15-min sweep cancels+restocks the order once its window passes with
+        // no proof attached — a late submission must surface a clear "window
+        // expired" error rather than silently attaching proof to a dead order.
+        if (order.paymentDeadline && new Date(order.paymentDeadline) < new Date() && order.status !== "pending") {
+            throw new ValidationError("PAYMENT_WINDOW_EXPIRED");
+        }
+        if (!proof.buyerFraudAgreementAccepted) {
+            throw new ValidationError("You must confirm this payment is genuine before submitting proof.");
+        }
+        const paymentUpiMismatch = order.displayedUpiId
+            ? normalizeUpi(proof.buyerReportedUpiId) !== normalizeUpi(order.displayedUpiId)
+            : false;
         await orderRepository.update(orderId, {
             paymentProofUrl: proof.proofUrl,
             paymentTransactionId: proof.transactionId,
             paymentProofMimeType: proof.mimeType,
             paymentProofUploadedAt: new Date(),
+            buyerMarkedPaid: proof.buyerMarkedPaid,
+            buyerMarkedPaidAt: proof.buyerMarkedPaid ? new Date() : undefined,
+            buyerFraudAgreementAccepted: proof.buyerFraudAgreementAccepted,
+            buyerFraudAgreementAcceptedAt: new Date(),
+            buyerReportedUpiId: proof.buyerReportedUpiId,
+            paymentUpiMismatch,
+        });
+        notifyAdminsOfPaymentProof({
+            id: orderId,
+            userName: order.userName,
+            productTitle: order.productTitle,
+            totalPrice: order.totalPrice,
         });
     });
 }
@@ -101,11 +189,158 @@ export async function adminVerifyPaymentAction(orderId) {
                 method: "manual",
                 transactionId: order.paymentTransactionId,
                 proofUrl: order.paymentProofUrl,
-                amountPaise: order.totalPrice,
+                amount: order.totalPrice,
                 paidAt: new Date(),
                 verifiedBy: user.uid,
                 verificationMethod: "manual_review",
             },
+            paymentReviewOutcome: "approved",
+            paymentReviewedBy: user.uid,
+            paymentReviewedAt: new Date(),
+        });
+    });
+}
+/**
+ * Tier PP — "honest mistake" tier of the two-tier admin review (blurry
+ * screenshot, wrong amount typed). Clears the proof so the buyer can cleanly
+ * resubmit, and extends `paymentDeadline` by another 15 minutes from now so
+ * review latency doesn't eat into the buyer's time to fix it. Order stays
+ * `pending`/`pending` — no penalty.
+ */
+export async function adminRequestProofReuploadAction(orderId, note) {
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["admin", "moderator"]);
+        if (!isAdminUser(user) && !isModeratorUser(user)) {
+            throw new ValidationError("Only admin or moderator can request a proof re-upload");
+        }
+        if (!note.trim())
+            throw new ValidationError(REASON_REQUIRED_MSG);
+        const order = await orderRepository.findById(orderId).catch(() => null);
+        if (!order)
+            throw new OrderNotFoundError(orderId);
+        if (order.paymentStatus === "paid") {
+            throw new ValidationError("This order's payment is already verified");
+        }
+        await orderRepository.update(orderId, {
+            paymentProofUrl: null,
+            paymentTransactionId: null,
+            paymentProofMimeType: null,
+            paymentProofUploadedAt: null,
+            buyerMarkedPaid: null,
+            buyerMarkedPaidAt: null,
+            buyerFraudAgreementAccepted: null,
+            buyerFraudAgreementAcceptedAt: null,
+            buyerReportedUpiId: null,
+            paymentUpiMismatch: null,
+            paymentDeadline: new Date(Date.now() + PAYMENT_WINDOW_MS),
+            paymentReviewOutcome: "reupload_requested",
+            paymentReviewNote: note,
+            paymentReviewedBy: user.uid,
+            paymentReviewedAt: new Date(),
+        });
+        await sendNotification({
+            userId: order.userId,
+            type: "payment_review",
+            priority: "high",
+            title: "Payment proof needs correction",
+            message: `Your payment proof for "${order.productTitle}" needs correction: ${note}. Please re-upload within 15 minutes.`,
+            relatedId: orderId,
+            relatedType: "order",
+        });
+    });
+}
+/**
+ * Tier PP — "fraud" tier of the two-tier admin review. Cancels the order,
+ * restores stock, and triggers a new temporary 7-day full-account hard ban
+ * (extends the existing permanent-only `hardBanCascade` job with an
+ * `expiresAt`, rather than forking a parallel cascade — see
+ * `HardBanCascadeInput.expiresAt`).
+ */
+export async function adminRejectPaymentAsFraudAction(orderId, note) {
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["admin", "moderator"]);
+        if (!isAdminUser(user) && !isModeratorUser(user)) {
+            throw new ValidationError("Only admin or moderator can reject a payment as fraudulent");
+        }
+        if (!note.trim())
+            throw new ValidationError(REASON_REQUIRED_MSG);
+        const order = await orderRepository.findById(orderId).catch(() => null);
+        if (!order)
+            throw new OrderNotFoundError(orderId);
+        if (order.paymentStatus === "paid") {
+            throw new ValidationError("This order's payment is already verified");
+        }
+        await restoreStockForOrder(getAdminDb(), { ...order, id: orderId }, {
+            status: "cancelled",
+            cancellationDate: new Date(),
+            cancellationReason: PAYMENT_FRAUD_REJECTED_REASON,
+            paymentReviewOutcome: "rejected_fraud",
+            paymentReviewNote: note,
+            paymentReviewedBy: user.uid,
+            paymentReviewedAt: new Date(),
+        });
+        const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000);
+        await enqueueJob({
+            jobType: "hardBanCascade",
+            payload: {
+                uid: order.userId,
+                reason: `Fraudulent payment proof on order ${orderId}: ${note}`,
+                bannedBy: user.uid,
+                expiresAt: expiresAt.toISOString(),
+                fraudOrderId: orderId,
+            },
+            requestedBy: user.uid,
+        });
+    });
+}
+/**
+ * Tier PP — raises a dispute on an auto-approved order ("the automation
+ * might be wrong"). Only valid when `autoApproved === true` — a manually
+ * reviewed order already went through human judgment and disputes on it go
+ * through the existing return/refund flow instead. Callable by the buyer,
+ * the seller (store owner), or admin/moderator. Does not itself reverse
+ * payment/order status — surfaces to the admin queue for investigation.
+ */
+export async function raiseOrderDisputeAction(orderId, reason) {
+    return wrapAction(async () => {
+        const user = await requireRoleUser(["buyer", "seller", "admin"]);
+        if (!reason.trim())
+            throw new ValidationError(REASON_REQUIRED_MSG);
+        const order = await orderRepository.findById(orderId).catch(() => null);
+        if (!order)
+            throw new OrderNotFoundError(orderId);
+        const isBuyer = order.userId === user.uid;
+        let isSeller = false;
+        if (!isBuyer && !isAdminUser(user) && !isModeratorUser(user) && order.storeId) {
+            const store = await storeRepository.findById(order.storeId).catch(() => null);
+            isSeller = store?.ownerId === user.uid;
+        }
+        if (!isBuyer && !isSeller && !isAdminUser(user) && !isModeratorUser(user)) {
+            throw new OrderOwnershipError(orderId);
+        }
+        if (!order.autoApproved) {
+            throw new ValidationError("Disputes can only be raised on auto-approved orders. Use the return/refund flow for manually-reviewed orders.");
+        }
+        if (order.disputeStatus === "open")
+            return; // idempotent
+        await orderRepository.update(orderId, {
+            disputeRaised: true,
+            disputeRaisedBy: user.uid,
+            disputeRaisedAt: new Date(),
+            disputeReason: reason,
+            disputeStatus: "open",
         });
+        // Notify every admin for manual investigation — a dispute on an
+        // auto-approved order means nobody has looked at it yet.
+        const admins = await userRepository.findByRole("admin");
+        await Promise.allSettled(admins.map((admin) => sendNotification({
+            userId: admin.uid,
+            type: "payment_review",
+            priority: "high",
+            title: "Dispute raised on auto-approved order",
+            message: `A dispute was raised on order "${order.productTitle}" (auto-approved payment). Reason: ${reason}.`,
+            relatedId: orderId,
+            relatedType: "order",
+        })));
     });
 }

package/dist/_internal/server/features/orders/adapters.js

@@ -61,6 +61,9 @@ export function orderDocumentToOrder(doc) {
         trackingNumber: doc.trackingNumber,
         shippingCarrier: doc.shippingCarrier,
         notes: doc.notes,
+        autoApproved: doc.autoApproved,
+        disputeRaised: doc.disputeRaised,
+        disputeStatus: doc.disputeStatus,
         createdAt: doc.createdAt instanceof Date
             ? doc.createdAt.toISOString()
             : String(doc.createdAt),

package/dist/_internal/server/features/payments/data.js

@@ -1,4 +1,5 @@
 import { siteSettingsRepository } from "../../../../repositories";
+import { roundRupees } from "../../../../utils/number.formatter";
 import { PAYMENTS_DEFAULT_PLATFORM_FEE_PERCENT, PAYMENTS_DEFAULT_GST_PERCENT, } from "../../../shared/features/payments/config";
 /**
  * Inflates the cart total by our platform fee + GST on that fee.
@@ -11,8 +12,8 @@ export async function resolvePaymentFee(baseAmount) {
     const platformFeePercent = siteSettings?.commissions?.platformFeePercent ?? PAYMENTS_DEFAULT_PLATFORM_FEE_PERCENT;
     const gstPercent = siteSettings?.commissions?.gstPercent ?? PAYMENTS_DEFAULT_GST_PERCENT;
     const minimumTransactionFee = Math.max(0, siteSettings?.commissions?.minimumTransactionFee ?? 0);
-    const platformFee = Math.round(baseAmount * (platformFeePercent / 100) * 100) / 100;
-    const gstOnFee = Math.round(platformFee * (gstPercent / 100) * 100) / 100;
+    const platformFee = roundRupees(baseAmount * (platformFeePercent / 100));
+    const gstOnFee = roundRupees(platformFee * (gstPercent / 100));
     const rawTotal = baseAmount + platformFee + gstOnFee;
     const totalAmount = Math.max(rawTotal, baseAmount + minimumTransactionFee);
     return { baseAmount, platformFee, gstOnFee, totalAmount };

package/dist/_internal/server/features/payouts/actions.d.ts

@@ -3,8 +3,8 @@ export type ApplyRefundDeductionInput = {
     storeId: string;
     orderId: string;
     refundId: string;
-    /** Gross refund amount in paise. */
-    refundedAmountInPaise: number;
+    /** Gross refund amount, decimal rupees. */
+    refundedAmount: number;
     /** Platform fee rate (0–1). Defaults to DEFAULT_PLATFORM_FEE_RATE (0.05). */
     platformFeeRate?: number;
     reason: string;

package/dist/_internal/server/features/payouts/actions.js

@@ -15,13 +15,14 @@ import { wrapAction } from "@mohasinac/appkit/server";
  */
 import { payoutRepository } from "../../../../repositories";
 import { ValidationError } from "../../../../errors";
+import { roundRupees } from "../../../../utils/number.formatter";
 export async function applyRefundDeductionAction(input) {
     return wrapAction(async () => {
-        if (input.refundedAmountInPaise <= 0) {
+        if (input.refundedAmount <= 0) {
             throw new ValidationError("Refund amount must be positive");
         }
         const feeRate = input.platformFeeRate ?? 0.05;
-        const deductedAmount = Math.round(input.refundedAmountInPaise * (1 - feeRate));
+        const deductedAmount = roundRupees(input.refundedAmount * (1 - feeRate));
         const pending = await payoutRepository.findPendingByStore(input.storeId);
         if (!pending) {
             return { applied: false, reason: "no_pending_payout" };
@@ -32,7 +33,7 @@ export async function applyRefundDeductionAction(input) {
         const updated = await payoutRepository.applyRefundDeduction(pending.id, {
             orderId: input.orderId,
             refundId: input.refundId,
-            refundedAmount: input.refundedAmountInPaise,
+            refundedAmount: input.refundedAmount,
             deductedAmount,
             reason: input.reason,
         });

package/dist/_internal/server/features/pre-orders/service.d.ts

@@ -1,7 +1,7 @@
 import type { ProductDocument } from "../../../shared/features/products/types";
 /** Assert a pre-order exists, is published, and has remaining capacity. */
 export declare function assertPreOrderAvailable(preOrderId: string, requestedQty?: number): Promise<ProductDocument>;
-/** Compute deposit amount in paise. */
+/** Compute deposit amount, decimal rupees. */
 export declare function computeDeposit(product: ProductDocument): number;
 /** Determine if the pre-order is still open for new reservations. */
 export declare function isPreOrderOpen(product: ProductDocument): boolean;

package/dist/_internal/server/features/pre-orders/service.js

@@ -1,5 +1,6 @@
 import { productRepository } from "../../../../repositories";
 import { isPreOrderListing } from "../../../../features/products/utils/listing-type";
+import { roundRupees } from "../../../../utils/number.formatter";
 import { PreOrderNotFoundError, PreOrderSoldOutError, PreOrderNotOpenError, } from "../../../shared/features/pre-orders/errors";
 /** Assert a pre-order exists, is published, and has remaining capacity. */
 export async function assertPreOrderAvailable(preOrderId, requestedQty = 1) {
@@ -14,12 +15,12 @@ export async function assertPreOrderAvailable(preOrderId, requestedQty = 1) {
         throw new PreOrderSoldOutError(preOrderId);
     return product;
 }
-/** Compute deposit amount in paise. */
+/** Compute deposit amount, decimal rupees. */
 export function computeDeposit(product) {
     if (product.preOrderDepositAmount)
         return product.preOrderDepositAmount;
     const percent = product.preOrderDepositPercent ?? 20;
-    return Math.round((product.price * percent) / 100);
+    return roundRupees((product.price * percent) / 100);
 }
 /** Determine if the pre-order is still open for new reservations. */
 export function isPreOrderOpen(product) {

package/dist/_internal/server/features/prize-draws/og.js

@@ -4,17 +4,17 @@
  */
 import { renderOgLayout } from "../seo/og-layout";
 import { resolveOgImageUrl } from "../seo/og";
-function formatPriceInr(paise, currency) {
+function formatPriceInr(amount, currency) {
     return new Intl.NumberFormat("en-IN", {
         style: "currency",
         currency,
         maximumFractionDigits: 0,
-    }).format(paise / 100);
+    }).format(amount);
 }
 export function renderPrizeDrawOg(doc, opts) {
-    const entryPaise = doc?.pricePerEntry ?? doc?.price ?? null;
-    const pricePerEntryLabel = typeof entryPaise === "number" && entryPaise > 0
-        ? `${formatPriceInr(entryPaise, doc?.currency ?? "INR")} / entry`
+    const entryPrice = doc?.pricePerEntry ?? doc?.price ?? null;
+    const pricePerEntryLabel = typeof entryPrice === "number" && entryPrice > 0
+        ? `${formatPriceInr(entryPrice, doc?.currency ?? "INR")} / entry`
         : "Free entry";
     const max = doc?.prizeMaxEntries ?? null;
     const current = doc?.prizeCurrentEntries ?? 0;

package/dist/_internal/server/features/products/og.js

@@ -9,7 +9,7 @@ export function renderProductOg(doc, opts) {
     }, opts.siteName);
 }
 export function renderProductOgImage(data, siteName) {
-    const priceLabel = data.price ? `₹${(data.price / 100).toLocaleString("en-IN")}` : null;
+    const priceLabel = data.price ? `₹${data.price.toLocaleString("en-IN")}` : null;
     return renderOgLayout({
         title: data.title,
         imageUrl: data.imageUrl,

package/dist/_internal/server/features/promotions/service.js

@@ -1,4 +1,5 @@
 import { couponsRepository } from "../../../../repositories";
+import { roundRupees } from "../../../../utils/number.formatter";
 import { CouponNotFoundError, CouponExpiredError, CouponUsageLimitError, CouponPerUserLimitError, CouponMinPurchaseError, CouponScopeError, } from "../../../shared/features/promotions/errors";
 export async function validateCoupon(input, userId) {
     const coupon = await couponsRepository.getCouponByCode(input.code).catch(() => null);
@@ -33,7 +34,8 @@ export function computeDiscount(coupon, cartTotal) {
     const maxDiscount = coupon.discount?.maxDiscount;
     let discount = 0;
     if (type === "percentage") {
-        discount = Math.round((cartTotal * value) / 100);
+        // audit-money-units-ok: percentage divisor (value is 0-100), not paise
+        discount = roundRupees((cartTotal * value) / 100);
         if (maxDiscount)
             discount = Math.min(discount, maxDiscount);
     }

package/dist/_internal/server/features/refunds/actions.d.ts

@@ -3,8 +3,8 @@ import type { RefundType } from "../../../../features/orders/schemas";
 export type ProcessRefundInput = {
     orderId: string;
     type: RefundType;
-    /** Amount in paise. Must be > 0 and ≤ remaining refundable amount on the order. */
-    amountInPaise: number;
+    /** Decimal rupees. Must be > 0 and ≤ remaining refundable amount on the order. */
+    amount: number;
     reason: string;
     /** Product/item ids affected (for partial refunds). */
     itemIds?: string[];

package/dist/_internal/server/features/refunds/actions.js

@@ -16,6 +16,7 @@ import { wrapAction } from "@mohasinac/appkit/server";
  */
 import { randomUUID } from "crypto";
 import { getProviders } from "../../../../contracts/registry";
+import { rupeesToPaise } from "../../../../providers/payment-razorpay/index";
 import { orderRepository } from "../../../..";
 import { ORDER_FIELDS } from "../../../../constants/field-names";
 import { NotFoundError, ValidationError } from "../../../../errors";
@@ -79,9 +80,9 @@ export async function processRefundAction(input) {
         const order = await orderRepository.findById(input.orderId);
         if (!order)
             throw new NotFoundError(`Order ${input.orderId} not found`);
-        if (input.amountInPaise <= 0)
+        if (input.amount <= 0)
             throw new ValidationError("Refund amount must be positive");
-        if (input.amountInPaise > order.totalPrice) {
+        if (input.amount > order.totalPrice) {
             throw new ValidationError("Refund amount exceeds order total");
         }
         // Guard: non-refundable orders (prize draws, bundles).
@@ -98,14 +99,14 @@ export async function processRefundAction(input) {
             const payment = getProviders().payment;
             if (!payment)
                 throw new ValidationError("Payment provider not configured");
-            const result = await payment.refund(input.razorpayPaymentId, input.amountInPaise);
+            const result = await payment.refund(input.razorpayPaymentId, rupeesToPaise(input.amount));
             razorpayRefundId = result.id;
         }
-        const isFull = input.amountInPaise >= order.totalPrice;
+        const isFull = input.amount >= order.totalPrice;
         const event = {
             refundId,
             type: input.type,
-            amount: input.amountInPaise,
+            amount: input.amount,
             ...(input.itemIds?.length ? { itemIds: input.itemIds } : {}),
             reason: input.reason,
             refundedAt: now,
@@ -131,7 +132,7 @@ export async function processRefundAction(input) {
                 storeId: order.storeId,
                 orderId: input.orderId,
                 refundId,
-                refundedAmountInPaise: input.amountInPaise,
+                refundedAmount: input.amount,
                 reason: input.reason,
             }).catch(() => { });
         }

package/dist/_internal/server/functions/firestore.js

@@ -105,7 +105,7 @@ export const onScamReportUpdate = defineFunction({
 // files for the full data-flow explanation.
 export const onShipmentItemWrite = defineFunction({
     name: "onShipmentItemWrite",
-    description: "Recompute a shipment lot's itemCount + mainItemsProjectedRevenuePaise on any item write.",
+    description: "Recompute a shipment lot's itemCount + mainItemsProjectedRevenue on any item write.",
     trigger: { kind: "documentWritten", pathPattern: "shipmentItems/{itemId}" },
     handler: onShipmentItemWriteHandler,
     options: { region: REGION },

package/dist/_internal/server/functions/scheduled.d.ts

@@ -1,5 +1,8 @@
 export declare const auctionSettlement: import("./types").ScheduledFunctionDefinition;
 export declare const pendingOrderTimeout: import("./types").ScheduledFunctionDefinition;
+export declare const paymentWindowTimeout: import("./types").ScheduledFunctionDefinition;
+export declare const hardBanReinstatement: import("./types").ScheduledFunctionDefinition;
+export declare const paymentReviewAutoApprove: import("./types").ScheduledFunctionDefinition;
 export declare const couponExpiry: import("./types").ScheduledFunctionDefinition;
 export declare const offerExpiry: import("./types").ScheduledFunctionDefinition;
 export declare const productStatsSync: import("./types").ScheduledFunctionDefinition;
@@ -22,4 +25,4 @@ export declare const prizeRevealReminder: import("./types").ScheduledFunctionDef
 export declare const bundleStockSync: import("./types").ScheduledFunctionDefinition;
 export declare const emiInstallmentReminder: import("./types").ScheduledFunctionDefinition;
 export declare const catalogueImageStalenessReminder: import("./types").ScheduledFunctionDefinition;
-export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];
+export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];

package/dist/_internal/server/functions/scheduled.js

@@ -1,6 +1,6 @@
 // Scheduled function definitions (Cloud Scheduler triggers).
 // Cron syntax accepts both Firebase shorthand and standard cron expressions.
-import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, payoutBatchHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeRevealCloseHandler, prizeRevealExpiryHandler, prizeRevealOpenHandler, prizeRevealReminderHandler, productStatsSyncHandler, weeklyPayoutEligibilityHandler, testerSandboxCleanupHandler, } from "../jobs/handlers";
+import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, payoutBatchHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeRevealCloseHandler, prizeRevealExpiryHandler, prizeRevealOpenHandler, prizeRevealReminderHandler, productStatsSyncHandler, weeklyPayoutEligibilityHandler, testerSandboxCleanupHandler, } from "../jobs/handlers";
 import { defineFunction } from "./define";
 const REGION = "asia-south1";
 const EVERY_5_MIN = "every 5 minutes";
@@ -13,11 +13,32 @@ export const auctionSettlement = defineFunction({
 });
 export const pendingOrderTimeout = defineFunction({
     name: "pendingOrderTimeout",
-    description: "Cancel pending orders that exceeded their timeout window.",
+    description: "Cancel pending COD orders that exceeded the 24h timeout window (orders with a paymentDeadline are paymentWindowTimeout's domain instead).",
     trigger: { kind: "schedule", cron: "0 */2 * * *" },
     handler: pendingOrderTimeoutHandler,
     options: { region: REGION, timeoutSeconds: 120, memory: "256MiB", maxInstances: 1 },
 });
+export const paymentWindowTimeout = defineFunction({
+    name: "paymentWindowTimeout",
+    description: "Cancel + restock orders whose 15-minute manual-payment window expired without proof.",
+    trigger: { kind: "schedule", cron: EVERY_5_MIN },
+    handler: paymentWindowTimeoutHandler,
+    options: { region: REGION, timeoutSeconds: 120, memory: "256MiB", maxInstances: 1 },
+});
+export const hardBanReinstatement = defineFunction({
+    name: "hardBanReinstatement",
+    description: "Re-enable Auth login for temporary hard-bans past their expiry.",
+    trigger: { kind: "schedule", cron: "*/15 * * * *" },
+    handler: hardBanReinstatementHandler,
+    options: { region: REGION, timeoutSeconds: 120, memory: "256MiB", maxInstances: 1 },
+});
+export const paymentReviewAutoApprove = defineFunction({
+    name: "paymentReviewAutoApprove",
+    description: "Auto-approve manual payment proofs unreviewed after 2 hours.",
+    trigger: { kind: "schedule", cron: "*/15 * * * *" },
+    handler: paymentReviewAutoApproveHandler,
+    options: { region: REGION, timeoutSeconds: 120, memory: "256MiB", maxInstances: 1 },
+});
 export const couponExpiry = defineFunction({
     name: "couponExpiry",
     description: "Mark coupons inactive past their endDate (daily 00:05 UTC).",
@@ -175,6 +196,9 @@ export const catalogueImageStalenessReminder = defineFunction({
 export const SCHEDULED_FUNCTIONS = [
     auctionSettlement,
     pendingOrderTimeout,
+    paymentWindowTimeout,
+    hardBanReinstatement,
+    paymentReviewAutoApprove,
     couponExpiry,
     offerExpiry,
     productStatsSync,

package/dist/_internal/server/jobs/core/emiInstallmentReminder.js

@@ -46,7 +46,7 @@ export async function runEmiInstallmentReminder(ctx) {
                     title: isOverdue ? "EMI installment overdue" : "EMI installment due soon",
                     message: isOverdue
                         ? `Installment ${inst.index} for order ${id} is overdue. Pay now to avoid delaying your shipment.`
-                        : `Installment ${inst.index} for order ${id} (₹${(inst.amount / 100).toFixed(2)}) is due on ${dueDate.toDateString()}.`,
+                        : `Installment ${inst.index} for order ${id} (₹${inst.amount.toFixed(2)}) is due on ${dueDate.toDateString()}.`,
                     relatedId: id,
                     relatedType: "order",
                     actionUrl: `/user/orders/view/${id}`,

package/dist/_internal/server/jobs/core/hardBanCascade.d.ts

@@ -22,5 +22,9 @@ export interface HardBanCascadeInput {
     uid: string;
     reason: string;
     bannedBy: string;
+    /** Tier PP — omitted/undefined = permanent (today's only caller, the manual admin hard-ban route). A Date makes this a temporary ban, auto-reinstated by `hardBanReinstatement` — set by `adminRejectPaymentAsFraudAction`. */
+    expiresAt?: Date;
+    /** Tier PP — the order whose payment proof was rejected as fraudulent, for traceability. Only set alongside `expiresAt`. */
+    fraudOrderId?: string;
 }
 export declare function runHardBanCascade(input: HardBanCascadeInput, ctx: JobContext): Promise<JobRunResult>;