@mohasinac/appkit 4.40.1 → 4.41.1

package/dist/features/admin/permission-map.js

@@ -1,26 +0,0 @@
-/** Required permission for each admin route path */
-export const ADMIN_PAGE_PERMISSIONS = {
-    "/admin": "admin:access",
-    "/admin/dashboard": "admin:analytics",
-    "/admin/users": "admin:users",
-    "/admin/orders": "admin:orders",
-    "/admin/products": "admin:products",
-    "/admin/reviews": "admin:reviews",
-    "/admin/payouts": "admin:payouts",
-    "/admin/shipments": "admin:shipments",
-    "/admin/catalogue-approvals": "admin:catalogue",
-    "/admin/kyc": "admin:kyc",
-    "/admin/analytics": "admin:analytics",
-    "/admin/activity": "admin:activity",
-    "/admin/sessions": "admin:sessions",
-    "/admin/newsletter": "admin:newsletter",
-    "/admin/search": "admin:search",
-    "/admin/feature-flags": "admin:feature-flags",
-    "/admin/site-settings": "admin:settings",
-    "/admin/navigation": "admin:cms:navigation",
-    "/admin/cms": "admin:cms",
-    "/admin/carousel": "admin:cms",
-    "/admin/homepage-sections": "admin:cms",
-    "/admin/copilot": "admin:settings",
-    "/admin/reports": "admin:analytics",
-};

package/dist/features/admin/repository/chat.repository.d.ts

@@ -1,50 +0,0 @@
-import { BaseRepository } from "../../../providers/db-firebase";
-import type { ChatRoomCreateInput, ChatRoomDocument } from "../schemas";
-export type { ChatRoomDocument, ChatRoomCreateInput } from "../schemas";
-export { CHAT_ROOM_COLLECTION } from "../schemas";
-declare class ChatRepository extends BaseRepository<ChatRoomDocument> {
-    constructor();
-    /** Override mapDoc to auto-decrypt PII on every chat room read */
-    protected mapDoc<D = ChatRoomDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
-    /**
-     * Create a new chat room (buyer ↔ seller for an order)
-     */
-    create(input: ChatRoomCreateInput): Promise<ChatRoomDocument>;
-    /**
-     * Find existing room by buyerId + ownerId + orderId (idempotent create)
-     */
-    findRoom(buyerId: string, ownerId: string, orderId: string): Promise<ChatRoomDocument | null>;
-    /**
-     * Get all chat room IDs that the user can currently access.
-     * Excludes rooms where the user has soft-deleted or where adminDeleted=true.
-     */
-    getChatIdsForUser(userId: string): Promise<string[]>;
-    /**
-     * List all visible rooms for a user (most recent first).
-     * Excludes rooms the user has deleted and admin-deleted group rooms.
-     */
-    listForUser(userId: string): Promise<ChatRoomDocument[]>;
-    /**
-     * Update last message preview (called after a new message is sent)
-     */
-    updateLastMessage(chatId: string, message: string): Promise<void>;
-    /**
-     * Soft-delete a 1-1 chat room for a single user.
-     *
-     * - Adds `uid` to `deletedBy`.
-     * - If both participants have now deleted → permanently deletes the
-     *   Firestore document and the RTDB subtree.
-     *
-     * @returns `"hidden"` if the room was only hidden for this user,
-     *          `"deleted"` if it was permanently purged.
-     */
-    softDeleteForUser(chatId: string, uid: string): Promise<"hidden" | "deleted">;
-    /**
-     * Admin hard-delete for group chats.
-     *
-     * Sets `adminDeleted: true` in Firestore (revokes all access) and
-     * removes the RTDB subtree.
-     */
-    adminHardDelete(chatId: string): Promise<void>;
-}
-export declare const chatRepository: ChatRepository;

package/dist/features/admin/repository/chat.repository.js

@@ -1,223 +0,0 @@
-import { normalizeError } from "../../../errors/normalize";
-/**
- * Chat Repository
- *
- * Manages Firestore chat room metadata documents.
- * Actual messages are stored in Realtime Database for live streaming.
- * This repository provides the persistent record of rooms and participants.
- *
- * Deletion semantics
- * ------------------
- * 1-1 rooms:
- *   - `softDeleteForUser(chatId, uid)` adds the uid to `deletedBy`.
- *   - When BOTH participants are in `deletedBy` the room is permanently deleted
- *     (Firestore doc + RTDB subtree) by the same method.
- *   - Until then the room is invisible only to the deleting user.
- *
- * Group rooms (admin-created):
- *   - Only an admin may delete via `adminHardDelete(chatId)`.
- *   - Sets `adminDeleted: true` and deletes the RTDB subtree.
- *   - All participants lose access on next token refresh.
- */
-import { getAdminRealtimeDb } from "../../../providers/db-firebase";
-import { BaseRepository } from "../../../providers/db-firebase";
-import { prepareForFirestore } from "../../../providers/db-firebase";
-import { DatabaseError } from "../../../errors";
-import { CONVERSATION_FIELDS, STORE_FIELDS } from "../../../constants/field-names";
-import { CHAT_ROOM_COLLECTION } from "../schemas";
-import { encryptPiiFields, decryptPiiFields, CHAT_PII_FIELDS, } from "../../../security";
-export { CHAT_ROOM_COLLECTION } from "../schemas";
-class ChatRepository extends BaseRepository {
-    constructor() {
-        super(CHAT_ROOM_COLLECTION);
-    }
-    /** Override mapDoc to auto-decrypt PII on every chat room read */
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return decryptPiiFields(raw, [
-            ...CHAT_PII_FIELDS,
-        ]);
-    }
-    /**
-     * Create a new chat room (buyer ↔ seller for an order)
-     */
-    async create(input) {
-        const id = input.isGroup
-            ? `chat_group_${Date.now()}`
-            : `chat_${input.buyerId}_${input.ownerId}_${input.orderId}`;
-        const doc = {
-            ...input,
-            deletedBy: [],
-            adminDeleted: false,
-            createdAt: new Date(),
-            updatedAt: new Date(),
-        };
-        const encrypted = encryptPiiFields({ ...doc }, [...CHAT_PII_FIELDS]);
-        await this.db
-            .collection(this.collection)
-            .doc(id)
-            .set(prepareForFirestore(encrypted));
-        return { id, ...doc }; // return plaintext to caller
-    }
-    /**
-     * Find existing room by buyerId + ownerId + orderId (idempotent create)
-     */
-    async findRoom(buyerId, ownerId, orderId) {
-        const id = `chat_${buyerId}_${ownerId}_${orderId}`;
-        return this.findById(id);
-    }
-    /**
-     * Get all chat room IDs that the user can currently access.
-     * Excludes rooms where the user has soft-deleted or where adminDeleted=true.
-     */
-    async getChatIdsForUser(userId) {
-        try {
-            const [asBuyer, asSeller] = await Promise.all([
-                this.getCollection()
-                    .where(CONVERSATION_FIELDS.BUYER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .get(),
-                this.getCollection()
-                    .where(STORE_FIELDS.OWNER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .get(),
-            ]);
-            const ids = new Set();
-            [...asBuyer.docs, ...asSeller.docs].forEach((d) => {
-                const deletedBy = d.data().deletedBy ?? [];
-                if (!deletedBy.includes(userId)) {
-                    ids.add(d.id);
-                }
-            });
-            return Array.from(ids);
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to get chatIds for user: ${userId}`, error);
-        }
-    }
-    /**
-     * List all visible rooms for a user (most recent first).
-     * Excludes rooms the user has deleted and admin-deleted group rooms.
-     */
-    async listForUser(userId) {
-        try {
-            const [asBuyer, asSeller] = await Promise.all([
-                this.getCollection()
-                    .where(CONVERSATION_FIELDS.BUYER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .orderBy(CONVERSATION_FIELDS.UPDATED_AT, "desc")
-                    .get(),
-                this.getCollection()
-                    .where(STORE_FIELDS.OWNER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .orderBy(CONVERSATION_FIELDS.UPDATED_AT, "desc")
-                    .get(),
-            ]);
-            const seen = new Set();
-            const rooms = [];
-            [...asBuyer.docs, ...asSeller.docs].forEach((d) => {
-                if (seen.has(d.id))
-                    return;
-                seen.add(d.id);
-                const data = d.data();
-                const deletedBy = data.deletedBy ?? [];
-                // Only include rooms the user hasn't personally deleted
-                if (!deletedBy.includes(userId)) {
-                    rooms.push(decryptPiiFields({ id: d.id, ...data }, [...CHAT_PII_FIELDS]));
-                }
-            });
-            rooms.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
-            return rooms;
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to list rooms for user: ${userId}`, error);
-        }
-    }
-    /**
-     * Update last message preview (called after a new message is sent)
-     */
-    async updateLastMessage(chatId, message) {
-        try {
-            await this.db
-                .collection(this.collection)
-                .doc(chatId)
-                .update(prepareForFirestore({
-                lastMessage: message.slice(0, 80),
-                lastMessageAt: new Date(),
-                updatedAt: new Date(),
-            }));
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to update last message for room: ${chatId}`, error);
-        }
-    }
-    /**
-     * Soft-delete a 1-1 chat room for a single user.
-     *
-     * - Adds `uid` to `deletedBy`.
-     * - If both participants have now deleted → permanently deletes the
-     *   Firestore document and the RTDB subtree.
-     *
-     * @returns `"hidden"` if the room was only hidden for this user,
-     *          `"deleted"` if it was permanently purged.
-     */
-    async softDeleteForUser(chatId, uid) {
-        try {
-            const docRef = this.db.collection(this.collection).doc(chatId);
-            const snap = await docRef.get();
-            if (!snap.exists)
-                return "deleted";
-            const data = snap.data();
-            const deletedBy = Array.from(new Set([...(data.deletedBy ?? []), uid]));
-            const bothDeleted = !data.isGroup &&
-                deletedBy.includes(data.buyerId) &&
-                deletedBy.includes(data.ownerId);
-            if (bothDeleted) {
-                // Permanently remove Firestore doc + RTDB messages
-                await docRef.delete();
-                try {
-                    await getAdminRealtimeDb().ref(`/chat/${chatId}`).remove();
-                }
-                catch (_err) {
-                    void normalizeError(_err); // RTDB cleanup is best-effort — Firestore doc already deleted
-                }
-                return "deleted";
-            }
-            // Otherwise just record this user's deletion
-            await docRef.update(prepareForFirestore({ deletedBy, updatedAt: new Date() }));
-            return "hidden";
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to soft-delete room ${chatId} for user ${uid}`, error);
-        }
-    }
-    /**
-     * Admin hard-delete for group chats.
-     *
-     * Sets `adminDeleted: true` in Firestore (revokes all access) and
-     * removes the RTDB subtree.
-     */
-    async adminHardDelete(chatId) {
-        try {
-            await this.db
-                .collection(this.collection)
-                .doc(chatId)
-                .update(prepareForFirestore({ adminDeleted: true, updatedAt: new Date() }));
-            try {
-                await getAdminRealtimeDb().ref(`/chat/${chatId}`).remove();
-            }
-            catch (_err) {
-                void normalizeError(_err); // RTDB cleanup is best-effort — adminDeleted flag already revokes access
-            }
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to admin-delete group room ${chatId}`, error);
-        }
-    }
-}
-export const chatRepository = new ChatRepository();

package/dist/features/auth/actions/password-change-otp-actions.d.ts

@@ -1,18 +0,0 @@
-/**
- * Password Change OTP Actions.
- *
- * Server-side gate for POST /api/user/change-password — see
- * ../password-change-otp.ts for the full incident writeup. Mirrors
- * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
- * separate Firestore namespace and copy).
- */
-/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
-export declare function sendPasswordChangeOtp(userId: string, userEmail: string): Promise<{
-    maskedEmail: string;
-}>;
-/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
-export declare function verifyPasswordChangeOtp(userId: string, code: string): Promise<void>;
-/** Whether the account has a currently-verified password-change OTP on file. */
-export declare function isPasswordChangeOtpVerified(userId: string): Promise<boolean>;
-/** Consumes the verified OTP so it can't be reused for a future password change. */
-export declare function consumePasswordChangeOtp(userId: string): Promise<void>;

package/dist/features/auth/actions/password-change-otp-actions.js

@@ -1,88 +0,0 @@
-/**
- * Password Change OTP Actions.
- *
- * Server-side gate for POST /api/user/change-password — see
- * ../password-change-otp.ts for the full incident writeup. Mirrors
- * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
- * separate Firestore namespace and copy).
- */
-import { timingSafeEqual } from "crypto";
-import { ValidationError } from "../../../errors";
-import { serverLogger } from "../../../monitoring";
-import { sendEmail } from "../../contact/email";
-import { getAdminDb } from "../../../providers/db-firebase";
-import { resolveDate } from "../../../utils";
-import { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, passwordChangeOtpRef, enforcePasswordChangeOtpRateLimit, } from "../password-change-otp";
-/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
-export async function sendPasswordChangeOtp(userId, userEmail) {
-    const db = getAdminDb();
-    await enforcePasswordChangeOtpRateLimit(db, userId);
-    const code = generateOtpCode();
-    const codeHash = hashOtp(code);
-    const expiresAt = new Date(Date.now() + PASSWORD_CHANGE_OTP_EXPIRY_MS);
-    await passwordChangeOtpRef(db, userId).set({
-        codeHash,
-        expiresAt,
-        attempts: 0,
-        verified: false,
-        createdAt: new Date(),
-    });
-    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
-    const [local, domain] = userEmail.split("@");
-    const maskedEmail = domain
-        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
-        : "***";
-    await sendEmail({
-        to: userEmail,
-        subject: `${siteName}: Verify your password change`,
-        html: `
-      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
-        <h2 style="margin-bottom:8px">Confirm Password Change</h2>
-        <p style="color:#555">Someone requested to change this account's password. Enter this code to confirm it was you:</p>
-        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
-        <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, your password has NOT been changed — but consider securing your account.</p>
-      </div>
-    `,
-    });
-    serverLogger.info(`Password change OTP sent: uid=${userId}`);
-    return { maskedEmail };
-}
-/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
-export async function verifyPasswordChangeOtp(userId, code) {
-    const db = getAdminDb();
-    const ref = passwordChangeOtpRef(db, userId);
-    const snap = await ref.get();
-    if (!snap.exists) {
-        throw new ValidationError("No verification code found. Please request a new code.");
-    }
-    const otpDoc = snap.data();
-    if (otpDoc.verified)
-        return;
-    if (otpDoc.attempts >= PASSWORD_CHANGE_OTP_MAX_ATTEMPTS) {
-        throw new ValidationError("Too many failed attempts. Please request a new code.");
-    }
-    if (Date.now() > (resolveDate(otpDoc.expiresAt)?.getTime() ?? 0)) {
-        throw new ValidationError("Code expired. Please request a new one.");
-    }
-    const inputHash = hashOtp(code);
-    if (!timingSafeEqual(Buffer.from(inputHash, "hex"), Buffer.from(otpDoc.codeHash, "hex"))) {
-        await ref.update({ attempts: otpDoc.attempts + 1 });
-        throw new ValidationError("Invalid code. Please check and try again.");
-    }
-    await ref.update({ verified: true, verifiedAt: new Date() });
-    serverLogger.info(`Password change OTP verified: uid=${userId}`);
-}
-/** Whether the account has a currently-verified password-change OTP on file. */
-export async function isPasswordChangeOtpVerified(userId) {
-    const db = getAdminDb();
-    const snap = await passwordChangeOtpRef(db, userId).get();
-    if (!snap.exists)
-        return false;
-    const otpDoc = snap.data();
-    return otpDoc.verified === true;
-}
-/** Consumes the verified OTP so it can't be reused for a future password change. */
-export async function consumePasswordChangeOtp(userId) {
-    const db = getAdminDb();
-    await passwordChangeOtpRef(db, userId).delete();
-}

package/dist/features/auth/actions/realtime-token-actions.d.ts

@@ -1,11 +0,0 @@
-/**
- * Realtime Token Domain Actions — appkit
- *
- * Issues a Firebase custom auth token for Realtime Database subscriptions.
- * Called by letitrip thin wrapper which handles auth + rate limiting.
- */
-export interface RealtimeTokenResult {
-    customToken: string;
-    expiresAt: number;
-}
-export declare function issueRealtimeToken(userId: string, userRole: string): Promise<RealtimeTokenResult>;

package/dist/features/auth/actions/realtime-token-actions.js

@@ -1,38 +0,0 @@
-/**
- * Realtime Token Domain Actions — appkit
- *
- * Issues a Firebase custom auth token for Realtime Database subscriptions.
- * Called by letitrip thin wrapper which handles auth + rate limiting.
- */
-import { getAdminAuth } from "../../../providers/db-firebase/index";
-import { conversationsRepository } from "../../messages/repository/conversations.repository";
-import { storeRepository } from "../../stores/repository/store.repository";
-import { serverLogger } from "../../../monitoring/index";
-import { normalizeError } from "../../../errors/normalize";
-export async function issueRealtimeToken(userId, userRole) {
-    const conversationIds = {};
-    try {
-        const buyerConvs = await conversationsRepository.listByBuyer(userId);
-        buyerConvs.forEach((c) => { conversationIds[c.id] = true; });
-        if (userRole === "seller") {
-            const store = await storeRepository.findByOwnerId(userId);
-            if (store?.id) {
-                const sellerConvs = await conversationsRepository.listByStore(store.id);
-                sellerConvs.forEach((c) => { conversationIds[c.id] = true; });
-            }
-        }
-    }
-    catch (err) {
-        void normalizeError(err);
-        serverLogger.warn("Could not resolve conversationIds for realtime token", { userId, err });
-    }
-    const customToken = await getAdminAuth().createCustomToken(userId, {
-        role: userRole,
-        conversationIds,
-    });
-    serverLogger.info("issueRealtimeToken: token issued", {
-        userId,
-        conversationCount: Object.keys(conversationIds).length,
-    });
-    return { customToken, expiresAt: Date.now() + 3600000 };
-}

package/dist/features/auth/password-change-otp.d.ts

@@ -1,34 +0,0 @@
-/**
- * Password Change OTP.
- *
- * Root-caused 2026-08-20: POST /api/user/change-password validated the
- * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
- * but the handler never read or verified it — `getAdminAuth().updateUser()`
- * overwrote the password unconditionally for whatever `uid` the session
- * cookie carried. The only real current-password check
- * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
- * the browser and is trivially bypassed by calling the API directly with a
- * stolen session cookie — a session hijack (XSS, log leak, etc.) was
- * enough to take over the account's password with zero server-enforced
- * identity check. This module gates the actual server-side write behind an
- * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
- * pattern exactly (same crypto primitives, reused not duplicated) so a
- * session-cookie thief also needs access to the account's inbox.
- */
-import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./checkout-value-otp";
-export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
-type Db = FirebaseFirestore.Firestore;
-/** Single-slot doc per user — a user can only be mid-password-change once. */
-export declare function passwordChangeOtpRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
-export declare function passwordChangeOtpRateLimitRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
-export interface PasswordChangeOtpDoc {
-    codeHash: string;
-    expiresAt: FirebaseFirestore.Timestamp;
-    attempts: number;
-    verified: boolean;
-}
-/**
- * Enforce the per-user send rate-limit.
- * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
- */
-export declare function enforcePasswordChangeOtpRateLimit(db: Db, uid: string): Promise<void>;

package/dist/features/auth/password-change-otp.js

@@ -1,56 +0,0 @@
-/**
- * Password Change OTP.
- *
- * Root-caused 2026-08-20: POST /api/user/change-password validated the
- * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
- * but the handler never read or verified it — `getAdminAuth().updateUser()`
- * overwrote the password unconditionally for whatever `uid` the session
- * cookie carried. The only real current-password check
- * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
- * the browser and is trivially bypassed by calling the API directly with a
- * stolen session cookie — a session hijack (XSS, log leak, etc.) was
- * enough to take over the account's password with zero server-enforced
- * identity check. This module gates the actual server-side write behind an
- * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
- * pattern exactly (same crypto primitives, reused not duplicated) so a
- * session-cookie thief also needs access to the account's inbox.
- */
-import { AuthorizationError } from "../../errors";
-import { resolveDate } from "../../utils";
-import { USER_COLLECTION } from "./schemas";
-import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, } from "./checkout-value-otp";
-export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
-/** Single-slot doc per user — a user can only be mid-password-change once. */
-export function passwordChangeOtpRef(db, uid) {
-    return db
-        .collection(USER_COLLECTION)
-        .doc(uid)
-        .collection("passwordChangeOtps")
-        .doc("current");
-}
-export function passwordChangeOtpRateLimitRef(db, uid) {
-    return db
-        .collection(USER_COLLECTION)
-        .doc(uid)
-        .collection("passwordChangeOtpRateLimit")
-        .doc("meta");
-}
-/**
- * Enforce the per-user send rate-limit.
- * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
- */
-export async function enforcePasswordChangeOtpRateLimit(db, uid) {
-    const metaRef = passwordChangeOtpRateLimitRef(db, uid);
-    await db.runTransaction(async (tx) => {
-        const metaSnap = await tx.get(metaRef);
-        const meta = metaSnap.exists
-            ? metaSnap.data()
-            : null;
-        const lastSentMs = resolveDate(meta?.lastSentAt)?.getTime() ?? 0;
-        const elapsed = Date.now() - lastSentMs;
-        if (elapsed < PASSWORD_CHANGE_OTP_COOLDOWN_MS) {
-            throw new AuthorizationError("passwordChangeOtpRateLimit");
-        }
-        tx.set(metaRef, { lastSentAt: new Date() }, { merge: true });
-    });
-}

package/dist/features/classified/components/ClassifiedContactSellerPanel.d.ts

@@ -1,12 +0,0 @@
-import React from "react";
-import type { startClassifiedConversationAction } from "../../../_internal/server/features/classified/actions";
-export interface ClassifiedContactSellerPanelProps {
-    productId: string;
-    onContactSeller: typeof startClassifiedConversationAction;
-}
-/**
- * The only purchase-path CTA on a classified listing — no cart, no checkout.
- * Extracted from the old ClassifiedDetailView so the richer, full-parity
- * ClassifiedDetailPageView can slot this into a `renderBuyBar` prop.
- */
-export declare function ClassifiedContactSellerPanel({ productId, onContactSeller }: ClassifiedContactSellerPanelProps): React.JSX.Element;

package/dist/features/classified/components/ClassifiedContactSellerPanel.js

@@ -1,49 +0,0 @@
-"use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { normalizeError } from "../../../errors/normalize";
-import { useState } from "react";
-import Link from "next/link";
-import { Button, Div, Stack, Text } from "../../../ui";
-import { ROUTES } from "../../../next/routing/route-map";
-const __P = {
-    p4: "p-[var(--appkit-space-4)]",
-};
-/**
- * The only purchase-path CTA on a classified listing — no cart, no checkout.
- * Extracted from the old ClassifiedDetailView so the richer, full-parity
- * ClassifiedDetailPageView can slot this into a `renderBuyBar` prop.
- */
-export function ClassifiedContactSellerPanel({ productId, onContactSeller }) {
-    const [pending, setPending] = useState(false);
-    const [conversation, setConversation] = useState(null);
-    const [error, setError] = useState(null);
-    async function handleContactSeller() {
-        setPending(true);
-        setError(null);
-        try {
-            const result = await onContactSeller({ productId });
-            if (result && typeof result === "object" && "ok" in result) {
-                if (result.ok) {
-                    setConversation(result.data);
-                }
-                else {
-                    setError(result.error);
-                }
-            }
-            else {
-                setConversation(result);
-            }
-        }
-        catch (e) {
-            void normalizeError(e);
-            setError("Something went wrong");
-        }
-        finally {
-            setPending(false);
-        }
-    }
-    if (conversation) {
-        return (_jsxs(Div, { className: `border border-border bg-muted/40 ${__P.p4}`, rounded: "lg", children: [_jsx(Text, { className: "mb-2", weight: "medium", children: "Conversation started!" }), _jsx(Link, { href: ROUTES.USER.MESSAGES, className: "text-primary underline underline-offset-2", children: "Go to your messages \u2192" })] }));
-    }
-    return (_jsxs(Stack, { gap: "sm", children: [error && (_jsx(Text, { className: "text-destructive", size: "sm", children: error })), _jsx(Button, { type: "button", variant: "primary", size: "lg", isLoading: pending, disabled: pending, onClick: handleContactSeller, className: "w-full", children: "Contact Seller" })] }));
-}

package/dist/features/events/api/route.d.ts

@@ -1,12 +0,0 @@
-/**
- * feat-events — Next.js App Router API handler (GET /api/events)
- *
- * Consuming projects can create a 2-line stub:
- *
- * ```ts
- * // app/api/events/route.ts
- * export { GET } from "@mohasinac/feat-events";
- * ```
- */
-import { NextResponse } from "next/server.js";
-export declare function GET(request: Request): Promise<NextResponse>;