@mohasinac/appkit 4.41.0 → 4.41.1

package/dist/features/admin/components/AdminFeatureFlagsView.js

@@ -1,109 +0,0 @@
-"use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useApiMutation } from "@mohasinac/appkit/client";
-import React from "react";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { Alert, Button, Div, Form, FormActions, Input, Row, Stack, StackedViewShell, Text, Toggle, useToast } from "../../../ui";
-import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
-import { apiClient } from "../../../http";
-import { featureFlagsUpdateSchema } from "../schemas/admin-ops-forms";
-import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary";
-const __O = {
-    hidden: "overflow-hidden",
-};
-// Platform feature keys (flat booleans with rollout % support)
-const PLATFORM_FLAGS = [
-    { key: "blog", label: "Blog Posts", desc: "Publish articles for admins / sellers" },
-    { key: "events", label: "Events", desc: "Raffles, spin wheels, polls" },
-    { key: "reviews", label: "Reviews", desc: "Product review system" },
-    { key: "wishlists", label: "Wishlists", desc: "Per-user saved lists" },
-    { key: "coupons", label: "Coupons", desc: "Discount code system" },
-    { key: "offers", label: "Buyer Offers", desc: "Make-an-offer price negotiation" },
-    { key: "notifications", label: "Notifications", desc: "In-app notification feed" },
-    { key: "chats", label: "Live Chat", desc: "Buyer-seller messaging" },
-    { key: "sellerRegistration", label: "Seller Reg.", desc: "New vendor registration" },
-    { key: "smsVerification", label: "SMS Verify", desc: "SMS OTP verification" },
-    { key: "translations", label: "Translations", desc: "Multi-language support" },
-    { key: "seedPanel", label: "Seed Panel", desc: "Dev seed data panel" },
-];
-// Listing type keys (nested under featureFlags.listingTypes — no rollout %)
-const LISTING_TYPE_FLAGS = [
-    { key: "standard", label: "Standard", desc: "Fixed-price products (Phase 1)" },
-    { key: "auction", label: "Auction", desc: "eBay-style bidding (Phase 1)" },
-    { key: "pre-order", label: "Pre-order", desc: "Future delivery + deposit (Phase 1)" },
-    { key: "prize-draw", label: "Prize Draw", desc: "Raffle reveal window (Phase 1)" },
-    { key: "classified", label: "Classified", desc: "Chat-only / no cart (Phase 2)" },
-    { key: "digital-code", label: "Digital Code", desc: "Steam-key instant delivery (Phase 2)" },
-    { key: "live", label: "Live Items", desc: "Animals / plants + verification (Phase 2)" },
-];
-// Category type keys (nested under featureFlags.categoryTypes — no rollout %)
-const CATEGORY_TYPE_FLAGS = [
-    { key: "category", label: "Categories", desc: "Standard hierarchy tier 1–3" },
-    { key: "sublisting", label: "Sublistings", desc: "Grading / card-number sub-tiers" },
-    { key: "brand", label: "Brands", desc: "Brand storefront pages" },
-    { key: "bundle", label: "Bundles", desc: "Curated product collections" },
-];
-function AccordionSection({ title, defaultOpen = true, children }) {
-    const [open, setOpen] = React.useState(defaultOpen);
-    return (_jsxs(Div, { className: `${__O.hidden}`, rounded: "lg", border: "default", children: [_jsx(Button, { type: "button", variant: "ghost", onClick: () => setOpen((v) => !v), paddingX: "md", paddingY: "md", className: "w-full text-left bg-[var(--appkit-color-surface-elevated)]/60", "aria-expanded": open, children: _jsxs(Row, { align: "center", justify: "between", className: "w-full", children: [_jsx(Text, { className: "tracking-widest", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: title }), _jsx("svg", { className: `h-4 w-4 text-zinc-400 transition-transform ${open ? "rotate-180" : ""} shrink-0`, fill: "none", stroke: "currentColor", strokeWidth: 2, viewBox: "0 0 24 24", "aria-hidden": "true", children: _jsx("path", { strokeLinecap: "round", strokeLinejoin: "round", d: "M19 9l-7 7-7-7" }) })] }) }), open && (_jsx(Div, { className: "divide-y divide-zinc-100 divide-[var(--appkit-color-border-subtle)]", children: children }))] }));
-}
-function FlagRow({ label, desc, checked, onChange, rollout, onRolloutChange, showRollout }) {
-    return (_jsxs(Row, { surface: "default", padding: "inline", align: "center", justify: "between", gap: "md", children: [_jsxs(Div, { className: "flex-1 min-w-0", children: [_jsx(Toggle, { checked: checked, onChange: onChange, label: label }), _jsx(Text, { className: "mt-0.5 ml-10 truncate", color: "faint", size: "xs", children: desc })] }), showRollout && (_jsxs(Stack, { className: "w-28 shrink-0", gap: "xs", children: [_jsx(Text, { size: "xs", color: "muted", children: "Rollout %" }), _jsx(Input, { type: "number", min: 0, max: 100, value: rollout ?? 100, onChange: (e) => onRolloutChange?.(Math.min(100, Math.max(0, Number(e.target.value)))), disabled: !checked, className: "w-full" })] }))] }));
-}
-export function AdminFeatureFlagsView({ labels = {}, renderFlags, ...rest }) {
-    const queryClient = useQueryClient();
-    const { showToast } = useToast();
-    const { data, isLoading, error } = useQuery({
-        queryKey: ["admin", "feature-flags"],
-        queryFn: async () => {
-            const res = await apiClient.get(ADMIN_ENDPOINTS.FEATURE_FLAGS);
-            return res.data ?? { flags: {}, rollouts: {} };
-        },
-    });
-    const [flags, setFlags] = React.useState({});
-    const [rollouts, setRollouts] = React.useState({});
-    React.useEffect(() => {
-        if (!data)
-            return;
-        setFlags(data.flags ?? {});
-        setRollouts(data.rollouts ?? {});
-    }, [data]);
-    const getPlatformFlag = (key) => Boolean(flags[key]);
-    const setPlatformFlag = (key, val) => setFlags((prev) => ({ ...prev, [key]: val }));
-    const getListingTypeFlag = (key) => {
-        const lt = flags.listingTypes;
-        return lt?.[key] ?? false;
-    };
-    const setListingTypeFlag = (key, val) => setFlags((prev) => ({
-        ...prev,
-        listingTypes: { ...(prev.listingTypes ?? {}), [key]: val },
-    }));
-    const getCategoryTypeFlag = (key) => {
-        const ct = flags.categoryTypes;
-        return ct?.[key] ?? false;
-    };
-    const setCategoryTypeFlag = (key, val) => setFlags((prev) => ({
-        ...prev,
-        categoryTypes: { ...(prev.categoryTypes ?? {}), [key]: val },
-    }));
-    const saveFlags = useApiMutation({
-        errorMessage: "Failed to save feature flags.",
-        mutationFn: async () => {
-            await apiClient.put(ADMIN_ENDPOINTS.FEATURE_FLAGS, { flags, rollouts });
-        },
-        onSuccess: async () => {
-            await queryClient.invalidateQueries({ queryKey: ["admin", "feature-flags"] });
-            showToast("Feature flags saved.", "success");
-        },
-    });
-    const defaultFlags = () => (_jsxs(Form, { schema: featureFlagsUpdateSchema, onSubmit: (event) => {
-            event.preventDefault();
-            saveFlags.mutate();
-        }, spacing: "md", children: [_jsx(FormErrorSummary, {}), _jsx(AccordionSection, { title: "Platform Features", children: PLATFORM_FLAGS.map(({ key, label, desc }) => (_jsx(FlagRow, { label: label, desc: desc, checked: getPlatformFlag(key), onChange: (val) => setPlatformFlag(key, val), rollout: rollouts[key], onRolloutChange: (val) => setRollouts((prev) => ({ ...prev, [key]: val })), showRollout: true }, key))) }), _jsx(AccordionSection, { title: "Listing Types", children: LISTING_TYPE_FLAGS.map(({ key, label, desc }) => (_jsx(FlagRow, { label: label, desc: desc, checked: getListingTypeFlag(key), onChange: (val) => setListingTypeFlag(key, val), showRollout: false }, key))) }), _jsx(AccordionSection, { title: "Category Types", children: CATEGORY_TYPE_FLAGS.map(({ key, label, desc }) => (_jsx(FlagRow, { label: label, desc: desc, checked: getCategoryTypeFlag(key), onChange: (val) => setCategoryTypeFlag(key, val), showRollout: false }, key))) }), _jsxs(FormActions, { align: "right", children: [_jsx(Button, { type: "button", variant: "secondary", onClick: () => {
-                            setFlags(data?.flags ?? {});
-                            setRollouts(data?.rollouts ?? {});
-                        }, disabled: saveFlags.isPending, children: "Reset" }), _jsx(Button, { type: "submit", isLoading: saveFlags.isPending, disabled: saveFlags.isPending, children: "Save All Flags" })] })] }));
-    const loadingAlert = isLoading ? (_jsx(Alert, { variant: "info", title: "Loading feature flags", children: "Fetching feature flags\u2026" })) : null;
-    const errorAlert = error ? (_jsx(Alert, { variant: "error", title: "Could not load feature flags", children: error instanceof Error ? error.message : "Unknown error" })) : null;
-    return (_jsx(StackedViewShell, { portal: "admin", ...rest, title: labels.title ?? "Feature Flags", sections: [loadingAlert, errorAlert, renderFlags?.() ?? defaultFlags()] }));
-}

package/dist/features/admin/components/AdminSiteView.d.ts

@@ -1,10 +0,0 @@
-import React from "react";
-import type { StackedViewShellProps } from "../../../ui";
-export interface AdminSiteViewProps extends Omit<StackedViewShellProps, "sections"> {
-    labels?: {
-        title?: string;
-    };
-    renderTabs?: () => React.ReactNode;
-    renderForm?: () => React.ReactNode;
-}
-export declare function AdminSiteView({ labels, renderTabs, renderForm, ...rest }: AdminSiteViewProps): React.JSX.Element;

package/dist/features/admin/components/AdminSiteView.js

@@ -1,52 +0,0 @@
-"use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useApiMutation } from "@mohasinac/appkit/client";
-import React from "react";
-import { useQueryClient } from "@tanstack/react-query";
-import { Alert, Button, Form, FormActions, Input, StackedViewShell, Toggle, } from "../../../ui";
-import { useSiteSettings } from "../../../core/hooks/useSiteSettings";
-import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
-import { apiClient } from "../../../http";
-import { announcementBarSchema } from "../schemas/admin-editor-forms";
-import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary";
-export function AdminSiteView({ labels = {}, renderTabs, renderForm, ...rest }) {
-    const queryClient = useQueryClient();
-    const { data, isLoading, error } = useSiteSettings();
-    const [announcementEnabled, setAnnouncementEnabled] = React.useState(true);
-    const [announcementMessage, setAnnouncementMessage] = React.useState("");
-    const [saveMessage, setSaveMessage] = React.useState(null);
-    React.useEffect(() => {
-        if (!data)
-            return;
-        setAnnouncementEnabled(data.announcementBar?.enabled ?? true);
-        setAnnouncementMessage(data.announcementBar?.message ?? "");
-    }, [data]);
-    const saveAnnouncement = useApiMutation({
-        mutationFn: async () => {
-            // Writes go to the admin endpoint. `PATCH /api/site-settings` was
-            // removed — that route is public-read-only now. The READ above still
-            // uses the public endpoint, which is fine: `announcementBar` is in its
-            // allow-list.
-            await apiClient.put(ADMIN_ENDPOINTS.ADMIN_SITE, {
-                announcementBar: {
-                    enabled: announcementEnabled,
-                    message: announcementMessage,
-                },
-            });
-        },
-        onSuccess: async () => {
-            await queryClient.invalidateQueries({ queryKey: ["site-settings"] });
-            setSaveMessage("Announcement settings saved.");
-        },
-        onError: () => {
-            setSaveMessage("Failed to save announcement settings.");
-        },
-    });
-    const defaultForm = () => (_jsxs(Form, { schema: announcementBarSchema, onSubmit: (event) => {
-            event.preventDefault();
-            saveAnnouncement.mutate();
-        }, spacing: "md", children: [_jsx(FormErrorSummary, {}), _jsx(Toggle, { checked: announcementEnabled, onChange: setAnnouncementEnabled, label: "Show announcement bar on homepage" }), _jsx(Input, { label: "Announcement message", value: announcementMessage, onChange: (event) => setAnnouncementMessage(event.target.value), placeholder: "Enter homepage announcement", disabled: !announcementEnabled, helperText: "This message is shown at the top of the homepage when enabled." }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", disabled: saveAnnouncement.isPending || (announcementEnabled && !announcementMessage.trim()), children: saveAnnouncement.isPending ? "Saving..." : "Save announcement" }) }), saveMessage ? (_jsx(Alert, { variant: saveMessage.startsWith("Failed") ? "error" : "success", title: saveMessage.startsWith("Failed") ? "Save failed" : "Saved", children: saveMessage })) : null] }));
-    const loadingAlert = isLoading ? (_jsx(Alert, { variant: "info", title: "Loading settings", children: "Fetching site settings..." })) : null;
-    const errorAlert = error ? (_jsx(Alert, { variant: "error", title: "Could not load settings", children: error instanceof Error ? error.message : "Unknown error" })) : null;
-    return (_jsx(StackedViewShell, { portal: "admin", ...rest, title: labels.title ?? "Site Settings", sections: [renderTabs?.(), loadingAlert, errorAlert, renderForm?.() ?? defaultForm()] }));
-}

package/dist/features/admin/hooks/useChat.d.ts

@@ -1,24 +0,0 @@
-import { type IClientRealtimeProvider } from "../../../contracts/client-realtime";
-export interface ChatMessage {
-    id: string;
-    userId: string;
-    userName: string;
-    message: string;
-    timestamp: number;
-}
-export interface UseChatReturn {
-    messages: ChatMessage[];
-    sendMessage: (text: string) => Promise<void>;
-    isConnected: boolean;
-    isLoading: boolean;
-    error: string | null;
-}
-export declare function useChat(chatId: string | null, options?: {
-    realtimeProvider?: IClientRealtimeProvider;
-}): UseChatReturn;
-export declare function useChatRooms(): import("@tanstack/react-query").UseQueryResult<unknown[], Error>;
-export declare function useCreateChatRoom(): import("@tanstack/react-query").UseMutationResult<unknown, import("@mohasinac/appkit/client").ApiError, {
-    orderId: string;
-    ownerId: string;
-}, unknown>;
-export declare function useDeleteChatRoom(): import("@tanstack/react-query").UseMutationResult<import("@mohasinac/appkit/client").JsonValue, import("@mohasinac/appkit/client").ApiError, string, unknown>;

package/dist/features/admin/hooks/useChat.js

@@ -1,100 +0,0 @@
-"use client";
-import { normalizeError } from "../../../errors/normalize";
-import { useApiMutation } from "@mohasinac/appkit/client";
-import { useEffect, useState, useCallback, useRef } from "react";
-import { useQuery } from "@tanstack/react-query";
-import { getClientRealtimeProvider, } from "../../../contracts/client-realtime";
-import { logger } from "../../../core/Logger";
-import { apiClient } from "../../../http";
-import { nowMs } from "../../../utils";
-import { ADMIN_ENDPOINTS, CHAT_ENDPOINTS, } from "../../../constants/api-endpoints";
-export function useChat(chatId, options) {
-    const [messages, setMessages] = useState([]);
-    const [isConnected, setIsConnected] = useState(false);
-    const [isLoading, setIsLoading] = useState(false);
-    const [error, setError] = useState(null);
-    const tokenExpiresAtRef = useRef(0);
-    const unsubscribeRef = useRef(null);
-    const connectAndSubscribe = useCallback(async () => {
-        if (!chatId)
-            return;
-        setIsLoading(true);
-        setError(null);
-        const provider = options?.realtimeProvider ?? getClientRealtimeProvider();
-        try {
-            const shouldRefresh = !tokenExpiresAtRef.current ||
-                tokenExpiresAtRef.current - nowMs() < 60000;
-            if (shouldRefresh) {
-                const tokenResponse = await apiClient.post(ADMIN_ENDPOINTS.REALTIME_TOKEN, {});
-                await provider.signInWithToken(tokenResponse.customToken);
-                tokenExpiresAtRef.current = tokenResponse.expiresAt;
-            }
-            if (unsubscribeRef.current) {
-                unsubscribeRef.current();
-                unsubscribeRef.current = null;
-            }
-            unsubscribeRef.current = provider.subscribe(`/chat/${chatId}/messages`, (snapshot) => {
-                if (snapshot.exists()) {
-                    const raw = snapshot.val();
-                    const parsed = Object.entries(raw)
-                        .map(([id, msg]) => ({ id, ...msg }))
-                        .sort((a, b) => a.timestamp - b.timestamp);
-                    setMessages(parsed);
-                }
-                else {
-                    setMessages([]);
-                }
-                setIsConnected(true);
-                setIsLoading(false);
-            }, (err) => {
-                logger.error("Chat RTDB subscription error", err);
-                setError("Could not connect to chat. Please try again.");
-                setIsConnected(false);
-                setIsLoading(false);
-            });
-        }
-        catch (err) {
-            void normalizeError(err);
-            logger.error("Failed to authenticate for chat RTDB", err);
-            setError("Failed to connect to chat.");
-            setIsLoading(false);
-        }
-    }, [chatId, options?.realtimeProvider]);
-    useEffect(() => {
-        connectAndSubscribe();
-        return () => {
-            if (unsubscribeRef.current) {
-                unsubscribeRef.current();
-                unsubscribeRef.current = null;
-            }
-        };
-    }, [connectAndSubscribe]);
-    const sendMessage = useCallback(async (text) => {
-        if (!chatId || !text.trim())
-            return;
-        await apiClient.post(CHAT_ENDPOINTS.MESSAGES(chatId), {
-            message: text.trim(),
-        });
-    }, [chatId]);
-    return { messages, sendMessage, isConnected, isLoading, error };
-}
-export function useChatRooms() {
-    return useQuery({
-        queryKey: ["chat", "rooms"],
-        queryFn: () => apiClient
-            .get(CHAT_ENDPOINTS.LIST)
-            .then((r) => r.rooms),
-    });
-}
-export function useCreateChatRoom() {
-    return useApiMutation({
-        mutationFn: (data) => apiClient
-            .post(CHAT_ENDPOINTS.LIST, data)
-            .then((r) => r.room),
-    });
-}
-export function useDeleteChatRoom() {
-    return useApiMutation({
-        mutationFn: (chatId) => apiClient.delete(CHAT_ENDPOINTS.BY_ID(chatId)),
-    });
-}

package/dist/features/admin/permission-map.d.ts

@@ -1,3 +0,0 @@
-import type { Permission } from "../../security";
-/** Required permission for each admin route path */
-export declare const ADMIN_PAGE_PERMISSIONS: Record<string, Permission>;

package/dist/features/admin/permission-map.js

@@ -1,26 +0,0 @@
-/** Required permission for each admin route path */
-export const ADMIN_PAGE_PERMISSIONS = {
-    "/admin": "admin:access",
-    "/admin/dashboard": "admin:analytics",
-    "/admin/users": "admin:users",
-    "/admin/orders": "admin:orders",
-    "/admin/products": "admin:products",
-    "/admin/reviews": "admin:reviews",
-    "/admin/payouts": "admin:payouts",
-    "/admin/shipments": "admin:shipments",
-    "/admin/catalogue-approvals": "admin:catalogue",
-    "/admin/kyc": "admin:kyc",
-    "/admin/analytics": "admin:analytics",
-    "/admin/activity": "admin:activity",
-    "/admin/sessions": "admin:sessions",
-    "/admin/newsletter": "admin:newsletter",
-    "/admin/search": "admin:search",
-    "/admin/feature-flags": "admin:feature-flags",
-    "/admin/site-settings": "admin:settings",
-    "/admin/navigation": "admin:cms:navigation",
-    "/admin/cms": "admin:cms",
-    "/admin/carousel": "admin:cms",
-    "/admin/homepage-sections": "admin:cms",
-    "/admin/copilot": "admin:settings",
-    "/admin/reports": "admin:analytics",
-};

package/dist/features/admin/repository/chat.repository.d.ts

@@ -1,50 +0,0 @@
-import { BaseRepository } from "../../../providers/db-firebase";
-import type { ChatRoomCreateInput, ChatRoomDocument } from "../schemas";
-export type { ChatRoomDocument, ChatRoomCreateInput } from "../schemas";
-export { CHAT_ROOM_COLLECTION } from "../schemas";
-declare class ChatRepository extends BaseRepository<ChatRoomDocument> {
-    constructor();
-    /** Override mapDoc to auto-decrypt PII on every chat room read */
-    protected mapDoc<D = ChatRoomDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
-    /**
-     * Create a new chat room (buyer ↔ seller for an order)
-     */
-    create(input: ChatRoomCreateInput): Promise<ChatRoomDocument>;
-    /**
-     * Find existing room by buyerId + ownerId + orderId (idempotent create)
-     */
-    findRoom(buyerId: string, ownerId: string, orderId: string): Promise<ChatRoomDocument | null>;
-    /**
-     * Get all chat room IDs that the user can currently access.
-     * Excludes rooms where the user has soft-deleted or where adminDeleted=true.
-     */
-    getChatIdsForUser(userId: string): Promise<string[]>;
-    /**
-     * List all visible rooms for a user (most recent first).
-     * Excludes rooms the user has deleted and admin-deleted group rooms.
-     */
-    listForUser(userId: string): Promise<ChatRoomDocument[]>;
-    /**
-     * Update last message preview (called after a new message is sent)
-     */
-    updateLastMessage(chatId: string, message: string): Promise<void>;
-    /**
-     * Soft-delete a 1-1 chat room for a single user.
-     *
-     * - Adds `uid` to `deletedBy`.
-     * - If both participants have now deleted → permanently deletes the
-     *   Firestore document and the RTDB subtree.
-     *
-     * @returns `"hidden"` if the room was only hidden for this user,
-     *          `"deleted"` if it was permanently purged.
-     */
-    softDeleteForUser(chatId: string, uid: string): Promise<"hidden" | "deleted">;
-    /**
-     * Admin hard-delete for group chats.
-     *
-     * Sets `adminDeleted: true` in Firestore (revokes all access) and
-     * removes the RTDB subtree.
-     */
-    adminHardDelete(chatId: string): Promise<void>;
-}
-export declare const chatRepository: ChatRepository;

package/dist/features/admin/repository/chat.repository.js

@@ -1,223 +0,0 @@
-import { normalizeError } from "../../../errors/normalize";
-/**
- * Chat Repository
- *
- * Manages Firestore chat room metadata documents.
- * Actual messages are stored in Realtime Database for live streaming.
- * This repository provides the persistent record of rooms and participants.
- *
- * Deletion semantics
- * ------------------
- * 1-1 rooms:
- *   - `softDeleteForUser(chatId, uid)` adds the uid to `deletedBy`.
- *   - When BOTH participants are in `deletedBy` the room is permanently deleted
- *     (Firestore doc + RTDB subtree) by the same method.
- *   - Until then the room is invisible only to the deleting user.
- *
- * Group rooms (admin-created):
- *   - Only an admin may delete via `adminHardDelete(chatId)`.
- *   - Sets `adminDeleted: true` and deletes the RTDB subtree.
- *   - All participants lose access on next token refresh.
- */
-import { getAdminRealtimeDb } from "../../../providers/db-firebase";
-import { BaseRepository } from "../../../providers/db-firebase";
-import { prepareForFirestore } from "../../../providers/db-firebase";
-import { DatabaseError } from "../../../errors";
-import { CONVERSATION_FIELDS, STORE_FIELDS } from "../../../constants/field-names";
-import { CHAT_ROOM_COLLECTION } from "../schemas";
-import { encryptPiiFields, decryptPiiFields, CHAT_PII_FIELDS, } from "../../../security";
-export { CHAT_ROOM_COLLECTION } from "../schemas";
-class ChatRepository extends BaseRepository {
-    constructor() {
-        super(CHAT_ROOM_COLLECTION);
-    }
-    /** Override mapDoc to auto-decrypt PII on every chat room read */
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return decryptPiiFields(raw, [
-            ...CHAT_PII_FIELDS,
-        ]);
-    }
-    /**
-     * Create a new chat room (buyer ↔ seller for an order)
-     */
-    async create(input) {
-        const id = input.isGroup
-            ? `chat_group_${Date.now()}`
-            : `chat_${input.buyerId}_${input.ownerId}_${input.orderId}`;
-        const doc = {
-            ...input,
-            deletedBy: [],
-            adminDeleted: false,
-            createdAt: new Date(),
-            updatedAt: new Date(),
-        };
-        const encrypted = encryptPiiFields({ ...doc }, [...CHAT_PII_FIELDS]);
-        await this.db
-            .collection(this.collection)
-            .doc(id)
-            .set(prepareForFirestore(encrypted));
-        return { id, ...doc }; // return plaintext to caller
-    }
-    /**
-     * Find existing room by buyerId + ownerId + orderId (idempotent create)
-     */
-    async findRoom(buyerId, ownerId, orderId) {
-        const id = `chat_${buyerId}_${ownerId}_${orderId}`;
-        return this.findById(id);
-    }
-    /**
-     * Get all chat room IDs that the user can currently access.
-     * Excludes rooms where the user has soft-deleted or where adminDeleted=true.
-     */
-    async getChatIdsForUser(userId) {
-        try {
-            const [asBuyer, asSeller] = await Promise.all([
-                this.getCollection()
-                    .where(CONVERSATION_FIELDS.BUYER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .get(),
-                this.getCollection()
-                    .where(STORE_FIELDS.OWNER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .get(),
-            ]);
-            const ids = new Set();
-            [...asBuyer.docs, ...asSeller.docs].forEach((d) => {
-                const deletedBy = d.data().deletedBy ?? [];
-                if (!deletedBy.includes(userId)) {
-                    ids.add(d.id);
-                }
-            });
-            return Array.from(ids);
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to get chatIds for user: ${userId}`, error);
-        }
-    }
-    /**
-     * List all visible rooms for a user (most recent first).
-     * Excludes rooms the user has deleted and admin-deleted group rooms.
-     */
-    async listForUser(userId) {
-        try {
-            const [asBuyer, asSeller] = await Promise.all([
-                this.getCollection()
-                    .where(CONVERSATION_FIELDS.BUYER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .orderBy(CONVERSATION_FIELDS.UPDATED_AT, "desc")
-                    .get(),
-                this.getCollection()
-                    .where(STORE_FIELDS.OWNER_ID, "==", userId)
-                    .where("adminDeleted", "==", false)
-                    .orderBy(CONVERSATION_FIELDS.UPDATED_AT, "desc")
-                    .get(),
-            ]);
-            const seen = new Set();
-            const rooms = [];
-            [...asBuyer.docs, ...asSeller.docs].forEach((d) => {
-                if (seen.has(d.id))
-                    return;
-                seen.add(d.id);
-                const data = d.data();
-                const deletedBy = data.deletedBy ?? [];
-                // Only include rooms the user hasn't personally deleted
-                if (!deletedBy.includes(userId)) {
-                    rooms.push(decryptPiiFields({ id: d.id, ...data }, [...CHAT_PII_FIELDS]));
-                }
-            });
-            rooms.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime());
-            return rooms;
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to list rooms for user: ${userId}`, error);
-        }
-    }
-    /**
-     * Update last message preview (called after a new message is sent)
-     */
-    async updateLastMessage(chatId, message) {
-        try {
-            await this.db
-                .collection(this.collection)
-                .doc(chatId)
-                .update(prepareForFirestore({
-                lastMessage: message.slice(0, 80),
-                lastMessageAt: new Date(),
-                updatedAt: new Date(),
-            }));
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to update last message for room: ${chatId}`, error);
-        }
-    }
-    /**
-     * Soft-delete a 1-1 chat room for a single user.
-     *
-     * - Adds `uid` to `deletedBy`.
-     * - If both participants have now deleted → permanently deletes the
-     *   Firestore document and the RTDB subtree.
-     *
-     * @returns `"hidden"` if the room was only hidden for this user,
-     *          `"deleted"` if it was permanently purged.
-     */
-    async softDeleteForUser(chatId, uid) {
-        try {
-            const docRef = this.db.collection(this.collection).doc(chatId);
-            const snap = await docRef.get();
-            if (!snap.exists)
-                return "deleted";
-            const data = snap.data();
-            const deletedBy = Array.from(new Set([...(data.deletedBy ?? []), uid]));
-            const bothDeleted = !data.isGroup &&
-                deletedBy.includes(data.buyerId) &&
-                deletedBy.includes(data.ownerId);
-            if (bothDeleted) {
-                // Permanently remove Firestore doc + RTDB messages
-                await docRef.delete();
-                try {
-                    await getAdminRealtimeDb().ref(`/chat/${chatId}`).remove();
-                }
-                catch (_err) {
-                    void normalizeError(_err); // RTDB cleanup is best-effort — Firestore doc already deleted
-                }
-                return "deleted";
-            }
-            // Otherwise just record this user's deletion
-            await docRef.update(prepareForFirestore({ deletedBy, updatedAt: new Date() }));
-            return "hidden";
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to soft-delete room ${chatId} for user ${uid}`, error);
-        }
-    }
-    /**
-     * Admin hard-delete for group chats.
-     *
-     * Sets `adminDeleted: true` in Firestore (revokes all access) and
-     * removes the RTDB subtree.
-     */
-    async adminHardDelete(chatId) {
-        try {
-            await this.db
-                .collection(this.collection)
-                .doc(chatId)
-                .update(prepareForFirestore({ adminDeleted: true, updatedAt: new Date() }));
-            try {
-                await getAdminRealtimeDb().ref(`/chat/${chatId}`).remove();
-            }
-            catch (_err) {
-                void normalizeError(_err); // RTDB cleanup is best-effort — adminDeleted flag already revokes access
-            }
-        }
-        catch (error) {
-            void normalizeError(error);
-            throw new DatabaseError(`Failed to admin-delete group room ${chatId}`, error);
-        }
-    }
-}
-export const chatRepository = new ChatRepository();

package/dist/features/auth/actions/password-change-otp-actions.d.ts

@@ -1,18 +0,0 @@
-/**
- * Password Change OTP Actions.
- *
- * Server-side gate for POST /api/user/change-password — see
- * ../password-change-otp.ts for the full incident writeup. Mirrors
- * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
- * separate Firestore namespace and copy).
- */
-/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
-export declare function sendPasswordChangeOtp(userId: string, userEmail: string): Promise<{
-    maskedEmail: string;
-}>;
-/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
-export declare function verifyPasswordChangeOtp(userId: string, code: string): Promise<void>;
-/** Whether the account has a currently-verified password-change OTP on file. */
-export declare function isPasswordChangeOtpVerified(userId: string): Promise<boolean>;
-/** Consumes the verified OTP so it can't be reused for a future password change. */
-export declare function consumePasswordChangeOtp(userId: string): Promise<void>;