@mohasinac/appkit 4.30.15 → 4.30.17

package/dist/react/hooks/useRealtimeEvent.js

@@ -2,6 +2,7 @@
 import { normalizeError } from "../../errors/normalize";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { getClientRealtimeProvider, } from "../../contracts/client-realtime";
+import { acquireExternalRealtimeLease } from "../../contracts/realtime-session";
 import { RealtimeEventType, RealtimeEventStatus, RTDBPayloadStatus, } from "./realtime-event-constants";
 // Re-exported for existing client import paths — the canonical definitions
 // now live in realtime-event-constants.ts (a plain, non-"use client" module)
@@ -31,6 +32,8 @@ export function useRealtimeEvent(config) {
     const unsubscribeRef = useRef(null);
     const timeoutRef = useRef(null);
     const eventIdRef = useRef(null);
+    /** Lease on the shared realtime session — see cleanup() for why. */
+    const releaseSessionRef = useRef(null);
     const cleanup = useCallback(() => {
         if (unsubscribeRef.current) {
             unsubscribeRef.current();
@@ -40,10 +43,20 @@ export function useRealtimeEvent(config) {
             clearTimeout(timeoutRef.current);
             timeoutRef.current = null;
         }
-        const provider = configRef.current.realtimeProvider ?? getClientRealtimeProvider();
-        provider.signOut().catch(() => {
-            // no-op
-        });
+        // 🛑 Deliberately NO provider.signOut() here.
+        //
+        // `FirebaseClientRealtimeProvider` is a SINGLETON on the shared
+        // "letitrip-realtime" app, so signing out is a global act. When a bulk job
+        // finished, this line tore the session out from under any admin chat or
+        // conversation subscription that was still open — and in reverse, those
+        // channels' tokens overwrote an in-flight bulk token. Whoever finished
+        // last broke whoever was still working.
+        //
+        // Sessions are reference-counted now (contracts/realtime-session.ts); the
+        // release returned by `acquireRealtimeSession` is the only thing that may
+        // end one, and only once the last consumer has let go.
+        releaseSessionRef.current?.();
+        releaseSessionRef.current = null;
     }, []);
     const subscribe = useCallback((eventId, customToken) => {
         const { type, rtdbPath, realtimeProvider, timeoutMs = DEFAULT_TIMEOUT_MS, extractData, messages, onLogError, } = configRef.current;
@@ -60,6 +73,11 @@ export function useRealtimeEvent(config) {
         (async () => {
             try {
                 await provider.signInWithToken(customToken);
+                // Hold a lease for as long as this subscription lives. This hook owns
+                // its own sign-in (the token carries a job-scoped `bulkJobId` claim),
+                // but it must still participate in the ref-count so its cleanup
+                // cannot end a session another channel is relying on.
+                releaseSessionRef.current = acquireExternalRealtimeLease();
             }
             catch (authErr) {
                 void normalizeError(authErr);

package/dist/security/pii-schemas.d.ts

@@ -5,7 +5,25 @@
  * encrypted before storage and decrypted on read.
  */
 /** PII fields in the users collection (top-level string fields) */
-export declare const USER_PII_FIELDS: readonly ["email", "phoneNumber"];
+/**
+ * `googleLinkedEmail` was added 2026-08-28, found by audit-pii-coverage.
+ *
+ * It is a real email address, written in cleartext by the Google OAuth callback
+ * (`api/auth/google/callback`, three write sites) and stored on the user
+ * document beside `email` — which has always been encrypted. So one user's two
+ * email addresses sat in the same document, one ciphertext and one plaintext,
+ * and nothing pointed at the difference.
+ *
+ * No blind index: nothing queries by it. Its only reader is the account
+ * holder's own profile ("Signed in as …"), which is a legitimate plaintext read.
+ *
+ * Existing rows stay plaintext until backfilled and keep reading correctly —
+ * `decryptValue` passes a non-`enc:v1:` string through unchanged — so new
+ * writes encrypt while old rows converge, never diverge. Add
+ * `googleLinkedEmail` to the `users` target in `backfill-pii.mjs` when that
+ * backfill is next run.
+ */
+export declare const USER_PII_FIELDS: readonly ["email", "phoneNumber", "googleLinkedEmail"];
 /** Blind-index mapping for queryable user PII: source → index field name */
 export declare const USER_PII_INDEX_MAP: Record<string, string>;
 /** PII fields in the addresses subcollection */

package/dist/security/pii-schemas.js

@@ -5,7 +5,25 @@
  * encrypted before storage and decrypted on read.
  */
 /** PII fields in the users collection (top-level string fields) */
-export const USER_PII_FIELDS = ["email", "phoneNumber"];
+/**
+ * `googleLinkedEmail` was added 2026-08-28, found by audit-pii-coverage.
+ *
+ * It is a real email address, written in cleartext by the Google OAuth callback
+ * (`api/auth/google/callback`, three write sites) and stored on the user
+ * document beside `email` — which has always been encrypted. So one user's two
+ * email addresses sat in the same document, one ciphertext and one plaintext,
+ * and nothing pointed at the difference.
+ *
+ * No blind index: nothing queries by it. Its only reader is the account
+ * holder's own profile ("Signed in as …"), which is a legitimate plaintext read.
+ *
+ * Existing rows stay plaintext until backfilled and keep reading correctly —
+ * `decryptValue` passes a non-`enc:v1:` string through unchanged — so new
+ * writes encrypt while old rows converge, never diverge. Add
+ * `googleLinkedEmail` to the `users` target in `backfill-pii.mjs` when that
+ * backfill is next run.
+ */
+export const USER_PII_FIELDS = ["email", "phoneNumber", "googleLinkedEmail"];
 /** Blind-index mapping for queryable user PII: source → index field name */
 export const USER_PII_INDEX_MAP = {
     email: "emailIndex",

package/dist/server.d.ts

@@ -6,6 +6,8 @@ export { SERVER_ERRORS_COLLECTION, SERVER_ERROR_FIELDS, SERVER_ERROR_STACK_MAX_B
 export type { ServerErrorDocument, ServerErrorSource, } from "./features/server-errors/schemas/firestore";
 export { wrapAction, isOk, unwrap, } from "./_internal/shared/types/action-result";
 export type { ActionResult } from "./_internal/shared/types/action-result";
+export { setActionErrorReporter, hasActionErrorReporter, } from "./_internal/shared/types/action-error-reporter";
+export type { ActionErrorReport, ActionErrorReporter, } from "./_internal/shared/types/action-error-reporter";
 export { attachPaymentProofAction, adminVerifyPaymentAction, adminRequestProofReuploadAction, adminRejectPaymentAsFraudAction, raiseOrderDisputeAction, } from "./_internal/server/features/orders/actions";
 export { wrapJobHandler, wrapScheduleHandler, wrapTriggerHandler, wrapCallableHandler, } from "./_internal/server/jobs/core/wrapJobHandler";
 export { analyzeLogs } from "./_internal/server/features/maintenance/analyze";

package/dist/server.js

@@ -11,6 +11,11 @@ export { SERVER_ERRORS_COLLECTION, SERVER_ERROR_FIELDS, SERVER_ERROR_STACK_MAX_B
 // [SERVER-ONLY] ActionResult envelope + wrapAction helper for "use server" functions.
 // Mirrors the routeHandler envelope so client wrappers consume both surfaces uniformly.
 export { wrapAction, isOk, unwrap, } from "./_internal/shared/types/action-result";
+// [SERVER-ONLY] Registration seam for recording server-action failures.
+// Must be called once from src/instrumentation.ts — see the module docstring
+// for why it is a hook rather than a direct import, and why it is registered
+// server-side rather than from a client bootstrap.
+export { setActionErrorReporter, hasActionErrorReporter, } from "./_internal/shared/types/action-error-reporter";
 // [SERVER-ONLY] P-1 manual payment proof server actions.
 export { attachPaymentProofAction, adminVerifyPaymentAction, adminRequestProofReuploadAction, adminRejectPaymentAsFraudAction, raiseOrderDisputeAction, } from "./_internal/server/features/orders/actions";
 // [SERVER-ONLY] Cloud Function handler wrappers — persist exceptions to