@mohasinac/appkit 3.8.1 → 3.9.0

package/dist/features/categories/schemas/firestore.d.ts

@@ -136,7 +136,7 @@ export interface CategoryDocument extends BaseDocument {
      */
     bundleKind?: "special" | "brand";
     /** Discounted bundle price in paise. */
-    bundlePriceInPaise?: number;
+    bundlePrice?: number;
     /** Rule resolving the bundle's member products — static list or live query. */
     bundleQueryRule?: BundleQueryRule;
     /** Snapshot stock state — recomputed by onProductStockChange. */

package/dist/features/categories/schemas/index.d.ts

@@ -231,7 +231,7 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
     brandFounded: z.ZodOptional<z.ZodNumber>;
     brandBannerImage: z.ZodOptional<z.ZodString>;
     bundleKind: z.ZodOptional<z.ZodEnum<["special", "brand"]>>;
-    bundlePriceInPaise: z.ZodOptional<z.ZodNumber>;
+    bundlePrice: z.ZodOptional<z.ZodEffects<z.ZodNumber, number, number>>;
     bundleQueryRule: z.ZodOptional<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         type: z.ZodLiteral<"static">;
         productIds: z.ZodArray<z.ZodString, "many">;
@@ -443,7 +443,7 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
     brandCountry?: string | undefined;
     brandFounded?: number | undefined;
     brandBannerImage?: string | undefined;
-    bundlePriceInPaise?: number | undefined;
+    bundlePrice?: number | undefined;
     bundleQueryRule?: {
         type: "static";
         productIds: string[];
@@ -537,7 +537,7 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
     brandCountry?: string | undefined;
     brandFounded?: number | undefined;
     brandBannerImage?: string | undefined;
-    bundlePriceInPaise?: number | undefined;
+    bundlePrice?: number | undefined;
     bundleQueryRule?: {
         type: "static";
         productIds: string[];

package/dist/features/categories/schemas/index.js

@@ -1,6 +1,6 @@
 export * from "./firestore";
 import { z } from "zod";
-import { auditTimestampsShape, firestoreDateSchema, paiseSchema } from "../../../schemas/firestore-helpers";
+import { auditTimestampsShape, firestoreDateSchema, rupeesSchema } from "../../../schemas/firestore-helpers";
 // ─── Firestore document schema (W2) ───────────────────────────────────────────
 // Mirrors CategoryDocument + nested types in ./firestore.ts.
 // Registered into SCHEMAS.firestore.categories.
@@ -78,7 +78,7 @@ export const categoryFirestoreSchema = z.object({
     brandFounded: z.number().int().optional(),
     brandBannerImage: z.string().optional(),
     bundleKind: z.enum(["special", "brand"]).optional(),
-    bundlePriceInPaise: paiseSchema.optional(),
+    bundlePrice: rupeesSchema.optional(),
     bundleQueryRule: bundleQueryRuleSchema.optional(),
     bundleStockStatus: z.enum(["in_stock", "out_of_stock"]).optional(),
     bundleQueryResolvedAt: firestoreDateSchema.optional(),

package/dist/features/checkout/actions/checkout-value-otp-actions.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Checkout Value OTP Actions (appkit) — Tier PP.
+ *
+ * OTP gate for placing a checkout whose total is at/above
+ * `siteSettings.payment.otpCheckoutThreshold` (skipped for COD). A distinct
+ * purpose from `checkout-actions.ts`'s third-party shipping consent OTP —
+ * same crypto primitives, separate Firestore namespace and copy.
+ */
+/** Sends a checkout-value OTP to the buyer's registered email. Returns masked email so the UI can confirm which inbox to check. */
+export declare function sendCheckoutValueOtp(userId: string, userEmail: string): Promise<{
+    maskedEmail: string;
+}>;
+/** Verifies the 6-digit checkout-value OTP and marks the Firestore record verified. */
+export declare function verifyCheckoutValueOtp(userId: string, code: string): Promise<void>;
+/** Whether the buyer has a currently-verified checkout-value OTP on file. */
+export declare function isCheckoutValueOtpVerified(userId: string): Promise<boolean>;

package/dist/features/checkout/actions/checkout-value-otp-actions.js

@@ -0,0 +1,83 @@
+/**
+ * Checkout Value OTP Actions (appkit) — Tier PP.
+ *
+ * OTP gate for placing a checkout whose total is at/above
+ * `siteSettings.payment.otpCheckoutThreshold` (skipped for COD). A distinct
+ * purpose from `checkout-actions.ts`'s third-party shipping consent OTP —
+ * same crypto primitives, separate Firestore namespace and copy.
+ */
+import { timingSafeEqual } from "crypto";
+import { ValidationError } from "../../../errors";
+import { serverLogger } from "../../../monitoring";
+import { sendEmail } from "../../contact/email";
+import { getAdminDb } from "../../../providers/db-firebase";
+import { resolveDate } from "../../../utils";
+import { CHECKOUT_VALUE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS, hashOtp, generateOtpCode, checkoutValueOtpRef, enforceCheckoutValueOtpRateLimit, } from "../../auth/checkout-value-otp";
+/** Sends a checkout-value OTP to the buyer's registered email. Returns masked email so the UI can confirm which inbox to check. */
+export async function sendCheckoutValueOtp(userId, userEmail) {
+    const db = getAdminDb();
+    await enforceCheckoutValueOtpRateLimit(db, userId);
+    const code = generateOtpCode();
+    const codeHash = hashOtp(code);
+    const expiresAt = new Date(Date.now() + CHECKOUT_VALUE_OTP_EXPIRY_MS);
+    await checkoutValueOtpRef(db, userId).set({
+        codeHash,
+        expiresAt,
+        attempts: 0,
+        verified: false,
+        createdAt: new Date(),
+    });
+    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
+    const [local, domain] = userEmail.split("@");
+    const maskedEmail = domain
+        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
+        : "***";
+    await sendEmail({
+        to: userEmail,
+        subject: `${siteName}: Verify your order`,
+        html: `
+      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
+        <h2 style="margin-bottom:8px">Verify Your Order</h2>
+        <p style="color:#555">Your cart total requires verification before checkout. Enter this code to continue:</p>
+        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
+        <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, please ignore this email.</p>
+      </div>
+    `,
+    });
+    serverLogger.info(`Checkout value OTP sent: uid=${userId}`);
+    return { maskedEmail };
+}
+/** Verifies the 6-digit checkout-value OTP and marks the Firestore record verified. */
+export async function verifyCheckoutValueOtp(userId, code) {
+    const db = getAdminDb();
+    const ref = checkoutValueOtpRef(db, userId);
+    const snap = await ref.get();
+    if (!snap.exists) {
+        throw new ValidationError("No verification code found. Please request a new code.");
+    }
+    const otpDoc = snap.data();
+    if (otpDoc.verified)
+        return;
+    if (otpDoc.attempts >= CHECKOUT_VALUE_OTP_MAX_ATTEMPTS) {
+        throw new ValidationError("Too many failed attempts. Please request a new code.");
+    }
+    if (Date.now() > (resolveDate(otpDoc.expiresAt)?.getTime() ?? 0)) {
+        throw new ValidationError("Code expired. Please request a new one.");
+    }
+    const inputHash = hashOtp(code);
+    if (!timingSafeEqual(Buffer.from(inputHash, "hex"), Buffer.from(otpDoc.codeHash, "hex"))) {
+        await ref.update({ attempts: otpDoc.attempts + 1 });
+        throw new ValidationError("Invalid code. Please check and try again.");
+    }
+    await ref.update({ verified: true, verifiedAt: new Date() });
+    serverLogger.info(`Checkout value OTP verified: uid=${userId}`);
+}
+/** Whether the buyer has a currently-verified checkout-value OTP on file. */
+export async function isCheckoutValueOtpVerified(userId) {
+    const db = getAdminDb();
+    const snap = await checkoutValueOtpRef(db, userId).get();
+    if (!snap.exists)
+        return false;
+    const otpDoc = snap.data();
+    return otpDoc.verified === true;
+}

package/dist/features/checkout/actions/index.d.ts

@@ -1 +1,2 @@
 export * from "./checkout-actions";
+export * from "./checkout-value-otp-actions";

package/dist/features/checkout/actions/index.js

@@ -1 +1,2 @@
 export * from "./checkout-actions";
+export * from "./checkout-value-otp-actions";

package/dist/features/checkout/schemas/firestore.d.ts

@@ -21,7 +21,7 @@ export type FailedPaymentDocument = {
     uid: string;
     gatewayOrderId?: string;
     gatewayPaymentId?: string;
-    /** Amount in smallest currency unit (e.g. paise). */
+    /** Amount in decimal rupees. */
     amountRs?: number;
     addressId?: string;
     reason: FailedPaymentReason;

package/dist/features/classified/components/index.d.ts

@@ -1,6 +1,2 @@
-export { ClassifiedListView } from "./ClassifiedListView";
-export type { ClassifiedListViewProps } from "./ClassifiedListView";
-export { ClassifiedIndexListing } from "./ClassifiedIndexListing";
-export type { ClassifiedIndexListingProps } from "./ClassifiedIndexListing";
 export { ClassifiedFilters } from "./ClassifiedFilters";
 export type { ClassifiedFiltersProps } from "./ClassifiedFilters";

package/dist/features/classified/components/index.js

@@ -1,3 +1 @@
-export { ClassifiedListView } from "./ClassifiedListView";
-export { ClassifiedIndexListing } from "./ClassifiedIndexListing";
 export { ClassifiedFilters } from "./ClassifiedFilters";

package/dist/features/digital-codes/components/index.d.ts

@@ -1,6 +1,2 @@
-export { DigitalCodesListView } from "./DigitalCodesListView";
-export type { DigitalCodesListViewProps } from "./DigitalCodesListView";
-export { DigitalCodesIndexListing } from "./DigitalCodesIndexListing";
-export type { DigitalCodesIndexListingProps } from "./DigitalCodesIndexListing";
 export { DigitalCodeFilters } from "./DigitalCodeFilters";
 export type { DigitalCodeFiltersProps } from "./DigitalCodeFilters";

package/dist/features/digital-codes/components/index.js

@@ -1,3 +1 @@
-export { DigitalCodesListView } from "./DigitalCodesListView";
-export { DigitalCodesIndexListing } from "./DigitalCodesIndexListing";
 export { DigitalCodeFilters } from "./DigitalCodeFilters";

package/dist/features/events/schemas/index.d.ts

@@ -348,7 +348,7 @@ export declare const spinPrizeSchema: z.ZodObject<{
     isActive: boolean;
     couponId?: string | undefined;
 }>;
-/** Lottery slot schema — client-safe shape (no priceInPaise/weight sent to clients). */
+/** Lottery slot schema — client-safe shape (no price/weight sent to clients). */
 export declare const lotterySlotClientSchema: z.ZodObject<{
     slotNumber: z.ZodNumber;
     name: z.ZodString;

package/dist/features/events/schemas/index.js

@@ -77,7 +77,7 @@ export const spinPrizeSchema = z.object({
     weight: z.number(),
     isActive: z.boolean(),
 });
-/** Lottery slot schema — client-safe shape (no priceInPaise/weight sent to clients). */
+/** Lottery slot schema — client-safe shape (no price/weight sent to clients). */
 export const lotterySlotClientSchema = z.object({
     slotNumber: z.number().int().min(1),
     name: z.string(),

package/dist/features/homepage/components/FeaturedBundlesSection.js

@@ -24,7 +24,7 @@ function FeaturedBundleCard({ bundle, onBuyNow }) {
     const memberCount = bundle.bundleProductIds?.length ?? 0;
     const cover = bundle.display?.coverImage;
     const href = String(ROUTES.PUBLIC.BUNDLE_DETAIL?.(bundle.slug) ?? "#");
-    return (_jsxs(Stack, { gap: "none", surface: "default", rounded: "xl", border: "default", children: [_jsxs(Link, { href: href, className: "group block p-[var(--appkit-space-3)] hover:no-underline", children: [_jsx(Div, { className: `relative mb-2 aspect-square ${__O.hidden}`, rounded: "lg", surface: "subtle", children: cover ? (_jsx(MediaImage, { src: cover, alt: bundle.name, size: "card", className: "transition-transform group-hover:scale-105" })) : (_jsx(Row, { textSize: "3xl", className: "h-full w-full", align: "center", justify: "center", children: PLACEHOLDER_EMOJI })) }), _jsx(Text, { className: "line-clamp-2", size: "sm", weight: "semibold", children: bundle.name }), _jsxs(Row, { gap: "sm", align: "center", className: "mt-1", wrap: true, children: [_jsx(Text, { size: "sm", weight: "bold", children: bundle.bundlePriceInPaise
-                                    ? formatCurrency(bundle.bundlePriceInPaise / 100, "INR")
+    return (_jsxs(Stack, { gap: "none", surface: "default", rounded: "xl", border: "default", children: [_jsxs(Link, { href: href, className: "group block p-[var(--appkit-space-3)] hover:no-underline", children: [_jsx(Div, { className: `relative mb-2 aspect-square ${__O.hidden}`, rounded: "lg", surface: "subtle", children: cover ? (_jsx(MediaImage, { src: cover, alt: bundle.name, size: "card", className: "transition-transform group-hover:scale-105" })) : (_jsx(Row, { textSize: "3xl", className: "h-full w-full", align: "center", justify: "center", children: PLACEHOLDER_EMOJI })) }), _jsx(Text, { className: "line-clamp-2", size: "sm", weight: "semibold", children: bundle.name }), _jsxs(Row, { gap: "sm", align: "center", className: "mt-1", wrap: true, children: [_jsx(Text, { size: "sm", weight: "bold", children: bundle.bundlePrice
+                                    ? formatCurrency(bundle.bundlePrice, "INR")
                                     : BUNDLE_COPY.featured.priceFallback }), _jsxs(Text, { size: "xs", color: "muted", children: ["\u00B7 ", BUNDLE_COPY.featured.itemCount(memberCount)] }), stock !== "in_stock" && (_jsx(Badge, { variant: BUNDLE_STOCK_VARIANT[stock], children: BUNDLE_COPY.stockBadge.listVariantOutOfStock }))] })] }), onBuyNow && (_jsx(Div, { border: "subtle", className: `border-t ${__P.p3}`, padding: "t-xs", children: _jsx(BundleBuyNowCta, { bundleSlug: bundle.slug, outOfStock: stock === "out_of_stock", onBuyNow: onBuyNow, compact: true }) }))] }));
 }

package/dist/features/live/components/index.d.ts

@@ -1,6 +1,2 @@
-export { LiveItemsListView } from "./LiveItemsListView";
-export type { LiveItemsListViewProps } from "./LiveItemsListView";
-export { LiveItemsIndexListing } from "./LiveItemsIndexListing";
-export type { LiveItemsIndexListingProps } from "./LiveItemsIndexListing";
 export { LiveItemFilters } from "./LiveItemFilters";
 export type { LiveItemFiltersProps } from "./LiveItemFilters";

package/dist/features/live/components/index.js

@@ -1,3 +1 @@
-export { LiveItemsListView } from "./LiveItemsListView";
-export { LiveItemsIndexListing } from "./LiveItemsIndexListing";
 export { LiveItemFilters } from "./LiveItemFilters";

package/dist/features/lottery/types/index.d.ts

@@ -7,7 +7,7 @@
 export interface LotterySlot {
     slotNumber: number;
     name: string;
-    priceInPaise: number;
+    price: number;
     weight: number;
     isBooked: boolean;
     bookedByUserLotteryNumber?: number;
@@ -27,7 +27,7 @@ export interface LotteryConfig {
     slots: LotterySlot[];
     totalSlots: number;
     pricingMode: LotteryPricingMode;
-    uniformPriceInPaise?: number;
+    uniformPrice?: number;
     drawWindowDurationMinutes: number;
     maxPullsPerTransaction: number;
     maxPullsPerUser: number;
@@ -54,7 +54,7 @@ export declare class LotteryError extends Error {
  * Weight is always at least 1 (never 0).
  * For uniform pricing: all slots get weight 50.
  */
-export declare function computeWeight(priceInPaise: number, maxPriceInPaise: number): number;
+export declare function computeWeight(price: number, maxPrice: number): number;
 /**
  * Pick a slot using weighted random selection. Uses the Web Crypto API, not
  * `Math.random()`, so the fairness claim shown to users (PrizeRevealModal's

package/dist/features/lottery/types/index.js

@@ -17,10 +17,10 @@ export class LotteryError extends Error {
  * Weight is always at least 1 (never 0).
  * For uniform pricing: all slots get weight 50.
  */
-export function computeWeight(priceInPaise, maxPriceInPaise) {
-    if (maxPriceInPaise === 0)
+export function computeWeight(price, maxPrice) {
+    if (maxPrice === 0)
         return 50;
-    return Math.max(1, Math.round((1 - priceInPaise / maxPriceInPaise) * 99) + 1);
+    return Math.max(1, Math.round((1 - price / maxPrice) * 99) + 1);
 }
 /**
  * Cryptographically-random integer in [0, maxExclusive) via the Web Crypto
@@ -60,9 +60,9 @@ export function assignSlotWeights(config) {
     if (config.pricingMode === "uniform") {
         return config.slots.map((sl) => ({ ...sl, weight: 50 }));
     }
-    const maxPrice = Math.max(...config.slots.map((sl) => sl.priceInPaise), 0);
+    const maxPrice = Math.max(...config.slots.map((sl) => sl.price), 0);
     return config.slots.map((sl) => ({
         ...sl,
-        weight: computeWeight(sl.priceInPaise, maxPrice),
+        weight: computeWeight(sl.price, maxPrice),
     }));
 }

package/dist/features/orders/components/OrderPaymentSummary.js

@@ -19,7 +19,7 @@ function legacyFallback(order) {
         method,
         transactionId: order.paymentTransactionId ?? order.paymentId,
         proofUrl: order.paymentProofUrl,
-        amountPaise: order.totalPrice,
+        amount: order.totalPrice,
         verificationMethod: method === "razorpay" ? "webhook" : method === "cod" ? "cod_collection" : "manual_review",
     };
 }
@@ -28,5 +28,5 @@ export function OrderPaymentSummary({ order, className = "" }) {
     if (!record) {
         return (_jsx(Div, { className: className, rounded: "xl", padding: "md", surface: "muted", border: "default", children: _jsx(Text, { size: "sm", color: "muted", children: "No payment information recorded yet." }) }));
     }
-    return (_jsxs(Div, { className: className, rounded: "xl", padding: "md", surface: "muted", border: "default", children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-2", children: [_jsx(Heading, { level: 3, size: "sm", weight: "semibold", color: "muted", children: "Payment" }), _jsx(Badge, { variant: order.paymentStatus === "paid" ? "success" : "default", children: order.paymentStatus ?? "pending" })] }), _jsxs(Stack, { gap: "xs", children: [_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Method" }), _jsx(Text, { size: "sm", weight: "medium", children: METHOD_LABEL[record.method] })] }), _jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Amount" }), _jsx(Text, { size: "sm", weight: "medium", children: formatCurrency(record.amountPaise / 100, order.currency ?? "INR") })] }), record.transactionId && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Reference" }), _jsx(Text, { size: "sm", weight: "medium", children: record.transactionId })] })), record.paidAt && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Paid at" }), _jsx(Text, { size: "sm", children: new Date(record.paidAt).toLocaleString() })] })), record.verifiedBy && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Verified by" }), _jsx(Text, { size: "sm", children: record.verifiedBy })] })), record.gatewayRef?.paymentId && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Gateway payment ID" }), _jsx(Text, { size: "sm", children: record.gatewayRef.paymentId })] }))] })] }));
+    return (_jsxs(Div, { className: className, rounded: "xl", padding: "md", surface: "muted", border: "default", children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-2", children: [_jsx(Heading, { level: 3, size: "sm", weight: "semibold", color: "muted", children: "Payment" }), _jsx(Badge, { variant: order.paymentStatus === "paid" ? "success" : "default", children: order.paymentStatus ?? "pending" })] }), _jsxs(Stack, { gap: "xs", children: [_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Method" }), _jsx(Text, { size: "sm", weight: "medium", children: METHOD_LABEL[record.method] })] }), _jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Amount" }), _jsx(Text, { size: "sm", weight: "medium", children: formatCurrency(record.amount, order.currency ?? "INR") })] }), record.transactionId && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Reference" }), _jsx(Text, { size: "sm", weight: "medium", children: record.transactionId })] })), record.paidAt && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Paid at" }), _jsx(Text, { size: "sm", children: new Date(record.paidAt).toLocaleString() })] })), record.verifiedBy && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Verified by" }), _jsx(Text, { size: "sm", children: record.verifiedBy })] })), record.gatewayRef?.paymentId && (_jsxs(Row, { justify: "between", children: [_jsx(Text, { size: "sm", color: "muted", children: "Gateway payment ID" }), _jsx(Text, { size: "sm", children: record.gatewayRef.paymentId })] }))] })] }));
 }

package/dist/features/orders/components/OrderSiblingPayments.js

@@ -11,6 +11,6 @@ export function OrderSiblingPayments({ siblings, currentOrderId, className = "",
         return null;
     return (_jsxs(Div, { className: `${className}`, rounded: "xl", padding: "md", surface: "muted", border: "default", children: [_jsx(Heading, { level: 3, className: "mb-3", color: "muted", size: "sm", weight: "semibold", children: REFUND_COPY.siblingPayments.heading(others.length) }), _jsx(Stack, { gap: "xs", children: others.map((o) => {
                     const href = String(ROUTES.USER.ORDER_DETAIL(o.id));
-                    return (_jsxs(Row, { justify: "between", align: "center", gap: "sm", children: [_jsx(Link, { href: href, className: "text-[length:var(--appkit-text-sm)] font-medium text-[color:var(--appkit-color-primary)] hover:underline", children: o.id }), _jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { size: "xs", color: "muted", transform: "capitalize", children: o.status }), _jsx(Text, { size: "xs", weight: "semibold", children: formatCurrency(o.totalPrice / 100, o.currency ?? "INR") })] })] }, o.id));
+                    return (_jsxs(Row, { justify: "between", align: "center", gap: "sm", children: [_jsx(Link, { href: href, className: "text-[length:var(--appkit-text-sm)] font-medium text-[color:var(--appkit-color-primary)] hover:underline", children: o.id }), _jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { size: "xs", color: "muted", transform: "capitalize", children: o.status }), _jsx(Text, { size: "xs", weight: "semibold", children: formatCurrency(o.totalPrice, o.currency ?? "INR") })] })] }, o.id));
                 }) })] }));
 }

package/dist/features/orders/components/RefundHistoryTable.js

@@ -10,7 +10,7 @@ function formatDate(d) {
     return dt.toLocaleDateString("en-IN", { day: "numeric", month: "short", year: "numeric" });
 }
 function RefundRow({ event, currency }) {
-    return (_jsxs(Row, { border: "subtle", justify: "between", align: "start", gap: "sm", className: "border-b last:border-0", padding: "y-sm", children: [_jsxs(Stack, { gap: "xs", className: "flex-1", children: [_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Badge, { variant: event.type === "full" ? "danger" : "warning", children: event.type === "full" ? REFUND_COPY.history.badgeFull : REFUND_COPY.history.badgePartial }), _jsx(Text, { size: "xs", color: "muted", children: formatDate(event.refundedAt) })] }), _jsx(Text, { size: "sm", children: event.reason }), event.manualTransactionId && (_jsxs(Text, { size: "xs", color: "muted", children: [REFUND_COPY.history.labelTxn, " ", event.manualTransactionId] })), event.razorpayRefundId && (_jsxs(Text, { size: "xs", color: "muted", children: [REFUND_COPY.history.labelRazorpay, " ", event.razorpayRefundId] }))] }), _jsx(Text, { size: "sm", weight: "semibold", className: "shrink-0", children: formatCurrency(event.amount / 100, currency) })] }));
+    return (_jsxs(Row, { border: "subtle", justify: "between", align: "start", gap: "sm", className: "border-b last:border-0", padding: "y-sm", children: [_jsxs(Stack, { gap: "xs", className: "flex-1", children: [_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Badge, { variant: event.type === "full" ? "danger" : "warning", children: event.type === "full" ? REFUND_COPY.history.badgeFull : REFUND_COPY.history.badgePartial }), _jsx(Text, { size: "xs", color: "muted", children: formatDate(event.refundedAt) })] }), _jsx(Text, { size: "sm", children: event.reason }), event.manualTransactionId && (_jsxs(Text, { size: "xs", color: "muted", children: [REFUND_COPY.history.labelTxn, " ", event.manualTransactionId] })), event.razorpayRefundId && (_jsxs(Text, { size: "xs", color: "muted", children: [REFUND_COPY.history.labelRazorpay, " ", event.razorpayRefundId] }))] }), _jsx(Text, { size: "sm", weight: "semibold", className: "shrink-0", children: formatCurrency(event.amount, currency) })] }));
 }
 /** Warning triangle icon — inline SVG kept here since it's a single-use decorative element. */
 function WarningIcon() {

package/dist/features/orders/components/RefundRequestView.js

@@ -41,5 +41,5 @@ export function RefundRequestView({ order, onSubmitRequest, isLoading = false, c
             setError(err instanceof Error ? err.message : REFUND_COPY.request.errorFallback);
         }
     };
-    return (_jsxs(Stack, { gap: "md", className: className, children: [_jsxs(Text, { size: "sm", color: "muted", children: [REFUND_COPY.request.orderTotalLabel, " ", _jsx(Span, { weight: "bold", children: formatCurrency(order.totalPrice / 100, order.currency ?? "INR") })] }), _jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { size: "sm", weight: "semibold", children: [REFUND_COPY.request.reasonLabel, " ", _jsx(Span, { "aria-hidden": true, children: "*" })] }), _jsx(Textarea, { value: reason, onChange: (e) => setReason(e.target.value), placeholder: REFUND_COPY.request.reasonPlaceholder, rows: 3, "aria-required": "true", "aria-label": REFUND_COPY.request.reasonLabel })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "semibold", children: REFUND_COPY.request.acknowledgeHeading }), REFUND_COPY.request.acknowledgments.map((text, i) => (_jsx(Checkbox, { checked: acknowledged[i], onChange: () => handleToggle(i), label: _jsx(Text, { size: "sm", className: "leading-snug", children: text }), "aria-label": `Acknowledgment ${i + 1}` }, i)))] }), error && (_jsx(Text, { size: "sm", color: "danger", role: "alert", children: error })), _jsx(Button, { variant: "danger", onClick: handleSubmit, disabled: !canSubmit, "aria-busy": isLoading, children: isLoading ? REFUND_COPY.request.submittingLabel : REFUND_COPY.request.submitLabel })] }));
+    return (_jsxs(Stack, { gap: "md", className: className, children: [_jsxs(Text, { size: "sm", color: "muted", children: [REFUND_COPY.request.orderTotalLabel, " ", _jsx(Span, { weight: "bold", children: formatCurrency(order.totalPrice, order.currency ?? "INR") })] }), _jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { size: "sm", weight: "semibold", children: [REFUND_COPY.request.reasonLabel, " ", _jsx(Span, { "aria-hidden": true, children: "*" })] }), _jsx(Textarea, { value: reason, onChange: (e) => setReason(e.target.value), placeholder: REFUND_COPY.request.reasonPlaceholder, rows: 3, "aria-required": "true", "aria-label": REFUND_COPY.request.reasonLabel })] }), _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "semibold", children: REFUND_COPY.request.acknowledgeHeading }), REFUND_COPY.request.acknowledgments.map((text, i) => (_jsx(Checkbox, { checked: acknowledged[i], onChange: () => handleToggle(i), label: _jsx(Text, { size: "sm", className: "leading-snug", children: text }), "aria-label": `Acknowledgment ${i + 1}` }, i)))] }), error && (_jsx(Text, { size: "sm", color: "danger", role: "alert", children: error })), _jsx(Button, { variant: "danger", onClick: handleSubmit, disabled: !canSubmit, "aria-busy": isLoading, children: isLoading ? REFUND_COPY.request.submittingLabel : REFUND_COPY.request.submitLabel })] }));
 }

package/dist/features/orders/constants/payment-window.d.ts

@@ -0,0 +1,10 @@
+/**
+ * 15-minute payment window shared constant — imported by the checkout action
+ * (stamps `order.paymentDeadline`), the buyer countdown UI, and the
+ * `paymentWindowTimeout` sweep job, so they can never drift out of sync.
+ */
+export declare const PAYMENT_WINDOW_MINUTES = 15;
+export declare const PAYMENT_WINDOW_MS: number;
+/** Cancellation reasons this feature writes to `OrderDocument.cancellationReason` (a free-form string field). */
+export declare const PAYMENT_WINDOW_EXPIRED_REASON = "payment_window_expired";
+export declare const PAYMENT_FRAUD_REJECTED_REASON = "payment_fraud_rejected";

package/dist/features/orders/constants/payment-window.js

@@ -0,0 +1,10 @@
+/**
+ * 15-minute payment window shared constant — imported by the checkout action
+ * (stamps `order.paymentDeadline`), the buyer countdown UI, and the
+ * `paymentWindowTimeout` sweep job, so they can never drift out of sync.
+ */
+export const PAYMENT_WINDOW_MINUTES = 15;
+export const PAYMENT_WINDOW_MS = PAYMENT_WINDOW_MINUTES * 60 * 1000;
+/** Cancellation reasons this feature writes to `OrderDocument.cancellationReason` (a free-form string field). */
+export const PAYMENT_WINDOW_EXPIRED_REASON = "payment_window_expired";
+export const PAYMENT_FRAUD_REJECTED_REASON = "payment_fraud_rejected";

package/dist/features/orders/repository/orders.repository.d.ts

@@ -188,6 +188,31 @@ declare class OrderRepository extends BaseRepository<OrderDocument> {
         ref: DocumentReference;
         data: OrderDocument;
     }>>;
+    /**
+     * Cloud Functions: 15-minute payment-window sweep — orders past their
+     * `paymentDeadline` with no proof uploaded yet. Filters out orders that
+     * already have `paymentProofUrl` set in-memory (the 2-hour auto-approve
+     * sweep owns those instead) rather than as a Firestore inequality, since a
+     * `paymentProofUrl != null` filter would silently exclude every doc where
+     * the field isn't set at all — the opposite of what's needed here.
+     */
+    getExpiredPaymentDeadlines(): Promise<Array<{
+        id: string;
+        ref: DocumentReference;
+        data: OrderDocument;
+    }>>;
+    /**
+     * Cloud Functions: 2-hour auto-approve sweep — orders with a submitted
+     * proof that no admin has acted on yet (`paymentReviewOutcome` unset).
+     * Filters that in-memory rather than as a Firestore inequality for the
+     * same reason as `getExpiredPaymentDeadlines` — a `!= null` filter would
+     * silently exclude every doc where the field was never set at all.
+     */
+    getUnreviewedProofPastDeadline(hours?: number): Promise<Array<{
+        id: string;
+        ref: DocumentReference;
+        data: OrderDocument;
+    }>>;
     /**
      * Cloud Functions: find delivered orders eligible for the weekly payout sweep.
      *

package/dist/features/orders/repository/orders.repository.js

@@ -103,7 +103,7 @@ class OrderRepository extends BaseRepository {
             paymentRecord: {
                 method: "cod",
                 transactionId: note,
-                amountPaise: order.totalPrice,
+                amount: order.totalPrice,
                 paidAt: new Date(),
                 verifiedBy,
                 verificationMethod: "cod_collection",
@@ -291,6 +291,55 @@ class OrderRepository extends BaseRepository {
             data: this.decryptOrder({ id: d.id, ...d.data() }),
         }));
     }
+    /**
+     * Cloud Functions: 15-minute payment-window sweep — orders past their
+     * `paymentDeadline` with no proof uploaded yet. Filters out orders that
+     * already have `paymentProofUrl` set in-memory (the 2-hour auto-approve
+     * sweep owns those instead) rather than as a Firestore inequality, since a
+     * `paymentProofUrl != null` filter would silently exclude every doc where
+     * the field isn't set at all — the opposite of what's needed here.
+     */
+    async getExpiredPaymentDeadlines() {
+        const snap = await this.db
+            .collection(this.collection)
+            .where(ORDER_FIELDS.STATUS, "==", OrderStatusValues.PENDING)
+            .where(ORDER_FIELDS.PAYMENT_STATUS, "==", "pending")
+            .where(ORDER_FIELDS.PAYMENT_DEADLINE, "<=", new Date())
+            .limit(500)
+            .get();
+        return snap.docs
+            .map((d) => ({
+            id: d.id,
+            ref: d.ref,
+            data: this.decryptOrder({ id: d.id, ...d.data() }),
+        }))
+            .filter((entry) => !entry.data.paymentProofUrl);
+    }
+    /**
+     * Cloud Functions: 2-hour auto-approve sweep — orders with a submitted
+     * proof that no admin has acted on yet (`paymentReviewOutcome` unset).
+     * Filters that in-memory rather than as a Firestore inequality for the
+     * same reason as `getExpiredPaymentDeadlines` — a `!= null` filter would
+     * silently exclude every doc where the field was never set at all.
+     */
+    async getUnreviewedProofPastDeadline(hours = 2) {
+        const cutoff = new Date();
+        cutoff.setHours(cutoff.getHours() - hours);
+        const snap = await this.db
+            .collection(this.collection)
+            .where(ORDER_FIELDS.STATUS, "==", OrderStatusValues.PENDING)
+            .where(ORDER_FIELDS.PAYMENT_STATUS, "==", "pending")
+            .where(ORDER_FIELDS.PAYMENT_PROOF_UPLOADED_AT, "<=", cutoff)
+            .limit(500)
+            .get();
+        return snap.docs
+            .map((d) => ({
+            id: d.id,
+            ref: d.ref,
+            data: this.decryptOrder({ id: d.id, ...d.data() }),
+        }))
+            .filter((entry) => !!entry.data.paymentProofUrl && !entry.data.paymentReviewOutcome);
+    }
     /**
      * Cloud Functions: find delivered orders eligible for the weekly payout sweep.
      *

package/dist/features/orders/schemas/firestore.d.ts

@@ -100,6 +100,9 @@ export interface OrderDocumentItem {
     cancelledQuantity?: number;
     cancelledAt?: Date;
     cancelledReason?: string;
+    /** SB-UNI-5 — forwarded from the cart line when this order item is an expanded bundle, so the order-detail UI can collapse it back under a "Bundle: <name>" header and stock-restore logic can fan back out to member products. */
+    bundleCategorySlug?: string;
+    bundleProductIds?: string[];
     /** P-8 GST — snapshotted from the product at order time so the invoice stays accurate even if the product's HSN/rate later changes. */
     hsnCode?: string;
     gstRate?: 0 | 5 | 12 | 18 | 28;
@@ -178,7 +181,7 @@ export interface OrderDocument extends BaseDocument {
     platformFee?: number;
     depositAmount?: number;
     codRemainingAmount?: number;
-    /** COD handling fee charged to the buyer: max(codHandlingFeeMinInPaise, subtotal × codHandlingFeePercent / 100). Only set when paymentMethod === "cod". */
+    /** COD handling fee charged to the buyer: max(codHandlingFeeMin, subtotal × codHandlingFeePercent / 100). Only set when paymentMethod === "cod". */
     codHandlingFee?: number;
     /** Order subtotal before GST — the amount GST is computed on. */
     taxableAmount?: number;
@@ -274,6 +277,51 @@ export interface OrderDocument extends BaseDocument {
     paymentProofMimeType?: string;
     /** When the buyer submitted the proof. */
     paymentProofUploadedAt?: Date;
+    /**
+     * Deadline for the buyer to pay/upload proof. Set only at creation for
+     * `upi_manual`/`cash`/`emi` orders — never for `cod`, `razorpay`, or
+     * `admin_bypass` (those either pay before order creation or have no proof
+     * step). `paymentWindowTimeout` cancels + restocks any order still
+     * `pending`/`pending` with no `paymentProofUrl` past this timestamp.
+     * Extended by 15 more minutes when admin requests a proof re-upload.
+     */
+    paymentDeadline?: Date;
+    /** True once a cancellation path has restored `availableQuantity` for this order's items. Guards against double-restock. */
+    stockRestored?: boolean;
+    stockRestoredAt?: Date;
+    /**
+     * UPI VPA resolved and shown to the buyer at order-creation time — the
+     * seller's own `payoutDetails.upiId` for seller-owned stores (falling back
+     * to `siteSettings.contact.upiVpa` if unconfigured), or the site UPI
+     * directly for admin-owned stores. Immutable "ground truth" for the
+     * cross-check below; never client-supplied.
+     */
+    displayedUpiId?: string;
+    /** UPI VPA the buyer says they actually paid from/to, per their own UPI app — the real cross-check signal against `displayedUpiId`. */
+    buyerReportedUpiId?: string;
+    /** True when `buyerReportedUpiId` doesn't match `displayedUpiId` — surfaced prominently in the admin review UI. */
+    paymentUpiMismatch?: boolean;
+    /** Buyer's explicit "I have paid" declaration, distinct from admin's own verification. */
+    buyerMarkedPaid?: boolean;
+    buyerMarkedPaidAt?: Date;
+    /** Buyer's required "this payment is genuine, no fraudulent tricks/chargebacks" agreement — server-validated, not just a client-side disable. */
+    buyerFraudAgreementAccepted?: boolean;
+    buyerFraudAgreementAcceptedAt?: Date;
+    /** Which of the three admin review actions was taken on this order's payment proof. */
+    paymentReviewOutcome?: "approved" | "reupload_requested" | "rejected_fraud";
+    /** Admin's reason text — required for both `reupload_requested` and `rejected_fraud`. */
+    paymentReviewNote?: string;
+    paymentReviewedBy?: string;
+    paymentReviewedAt?: Date;
+    /** True when `paymentReviewAutoApprove` approved this order after 2 hours of no manual admin review. */
+    autoApproved?: boolean;
+    autoApprovedAt?: Date;
+    /** Buyer/seller/admin dispute raised against an auto-approved order — surfaces to the admin queue, does not itself reverse payment/order status. */
+    disputeRaised?: boolean;
+    disputeRaisedBy?: string;
+    disputeRaisedAt?: Date;
+    disputeReason?: string;
+    disputeStatus?: "open" | "resolved";
     /**
      * Same-shape payment record regardless of how the buyer paid — manual
      * (cash/UPI proof), Razorpay (webhook-verified), or COD (collected on
@@ -309,7 +357,7 @@ export interface OrderPaymentRecord {
     transactionId?: string;
     /** Manual proof upload | COD collection receipt photo (optional) | n/a for razorpay. */
     proofUrl?: string;
-    amountPaise: number;
+    amount: number;
     paidAt?: Date;
     /** Admin/seller uid (manual/COD) | "razorpay-webhook" (razorpay, automatic). */
     verifiedBy?: string;