@mohasinac/appkit 4.41.0 → 4.41.1

package/dist/features/auth/actions/password-change-otp-actions.js

@@ -1,88 +0,0 @@
-/**
- * Password Change OTP Actions.
- *
- * Server-side gate for POST /api/user/change-password — see
- * ../password-change-otp.ts for the full incident writeup. Mirrors
- * checkout-value-otp-actions.ts's shape exactly (same crypto primitives,
- * separate Firestore namespace and copy).
- */
-import { timingSafeEqual } from "crypto";
-import { ValidationError } from "../../../errors";
-import { serverLogger } from "../../../monitoring";
-import { sendEmail } from "../../contact/email";
-import { getAdminDb } from "../../../providers/db-firebase";
-import { resolveDate } from "../../../utils";
-import { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, passwordChangeOtpRef, enforcePasswordChangeOtpRateLimit, } from "../password-change-otp";
-/** Sends a password-change OTP to the account's registered email. Returns masked email so the UI can confirm which inbox to check. */
-export async function sendPasswordChangeOtp(userId, userEmail) {
-    const db = getAdminDb();
-    await enforcePasswordChangeOtpRateLimit(db, userId);
-    const code = generateOtpCode();
-    const codeHash = hashOtp(code);
-    const expiresAt = new Date(Date.now() + PASSWORD_CHANGE_OTP_EXPIRY_MS);
-    await passwordChangeOtpRef(db, userId).set({
-        codeHash,
-        expiresAt,
-        attempts: 0,
-        verified: false,
-        createdAt: new Date(),
-    });
-    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
-    const [local, domain] = userEmail.split("@");
-    const maskedEmail = domain
-        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
-        : "***";
-    await sendEmail({
-        to: userEmail,
-        subject: `${siteName}: Verify your password change`,
-        html: `
-      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
-        <h2 style="margin-bottom:8px">Confirm Password Change</h2>
-        <p style="color:#555">Someone requested to change this account's password. Enter this code to confirm it was you:</p>
-        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
-        <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, your password has NOT been changed — but consider securing your account.</p>
-      </div>
-    `,
-    });
-    serverLogger.info(`Password change OTP sent: uid=${userId}`);
-    return { maskedEmail };
-}
-/** Verifies the 6-digit password-change OTP and marks the Firestore record verified. */
-export async function verifyPasswordChangeOtp(userId, code) {
-    const db = getAdminDb();
-    const ref = passwordChangeOtpRef(db, userId);
-    const snap = await ref.get();
-    if (!snap.exists) {
-        throw new ValidationError("No verification code found. Please request a new code.");
-    }
-    const otpDoc = snap.data();
-    if (otpDoc.verified)
-        return;
-    if (otpDoc.attempts >= PASSWORD_CHANGE_OTP_MAX_ATTEMPTS) {
-        throw new ValidationError("Too many failed attempts. Please request a new code.");
-    }
-    if (Date.now() > (resolveDate(otpDoc.expiresAt)?.getTime() ?? 0)) {
-        throw new ValidationError("Code expired. Please request a new one.");
-    }
-    const inputHash = hashOtp(code);
-    if (!timingSafeEqual(Buffer.from(inputHash, "hex"), Buffer.from(otpDoc.codeHash, "hex"))) {
-        await ref.update({ attempts: otpDoc.attempts + 1 });
-        throw new ValidationError("Invalid code. Please check and try again.");
-    }
-    await ref.update({ verified: true, verifiedAt: new Date() });
-    serverLogger.info(`Password change OTP verified: uid=${userId}`);
-}
-/** Whether the account has a currently-verified password-change OTP on file. */
-export async function isPasswordChangeOtpVerified(userId) {
-    const db = getAdminDb();
-    const snap = await passwordChangeOtpRef(db, userId).get();
-    if (!snap.exists)
-        return false;
-    const otpDoc = snap.data();
-    return otpDoc.verified === true;
-}
-/** Consumes the verified OTP so it can't be reused for a future password change. */
-export async function consumePasswordChangeOtp(userId) {
-    const db = getAdminDb();
-    await passwordChangeOtpRef(db, userId).delete();
-}

package/dist/features/auth/actions/realtime-token-actions.d.ts

@@ -1,11 +0,0 @@
-/**
- * Realtime Token Domain Actions — appkit
- *
- * Issues a Firebase custom auth token for Realtime Database subscriptions.
- * Called by letitrip thin wrapper which handles auth + rate limiting.
- */
-export interface RealtimeTokenResult {
-    customToken: string;
-    expiresAt: number;
-}
-export declare function issueRealtimeToken(userId: string, userRole: string): Promise<RealtimeTokenResult>;

package/dist/features/auth/actions/realtime-token-actions.js

@@ -1,38 +0,0 @@
-/**
- * Realtime Token Domain Actions — appkit
- *
- * Issues a Firebase custom auth token for Realtime Database subscriptions.
- * Called by letitrip thin wrapper which handles auth + rate limiting.
- */
-import { getAdminAuth } from "../../../providers/db-firebase/index";
-import { conversationsRepository } from "../../messages/repository/conversations.repository";
-import { storeRepository } from "../../stores/repository/store.repository";
-import { serverLogger } from "../../../monitoring/index";
-import { normalizeError } from "../../../errors/normalize";
-export async function issueRealtimeToken(userId, userRole) {
-    const conversationIds = {};
-    try {
-        const buyerConvs = await conversationsRepository.listByBuyer(userId);
-        buyerConvs.forEach((c) => { conversationIds[c.id] = true; });
-        if (userRole === "seller") {
-            const store = await storeRepository.findByOwnerId(userId);
-            if (store?.id) {
-                const sellerConvs = await conversationsRepository.listByStore(store.id);
-                sellerConvs.forEach((c) => { conversationIds[c.id] = true; });
-            }
-        }
-    }
-    catch (err) {
-        void normalizeError(err);
-        serverLogger.warn("Could not resolve conversationIds for realtime token", { userId, err });
-    }
-    const customToken = await getAdminAuth().createCustomToken(userId, {
-        role: userRole,
-        conversationIds,
-    });
-    serverLogger.info("issueRealtimeToken: token issued", {
-        userId,
-        conversationCount: Object.keys(conversationIds).length,
-    });
-    return { customToken, expiresAt: Date.now() + 3600000 };
-}

package/dist/features/auth/password-change-otp.d.ts

@@ -1,34 +0,0 @@
-/**
- * Password Change OTP.
- *
- * Root-caused 2026-08-20: POST /api/user/change-password validated the
- * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
- * but the handler never read or verified it — `getAdminAuth().updateUser()`
- * overwrote the password unconditionally for whatever `uid` the session
- * cookie carried. The only real current-password check
- * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
- * the browser and is trivially bypassed by calling the API directly with a
- * stolen session cookie — a session hijack (XSS, log leak, etc.) was
- * enough to take over the account's password with zero server-enforced
- * identity check. This module gates the actual server-side write behind an
- * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
- * pattern exactly (same crypto primitives, reused not duplicated) so a
- * session-cookie thief also needs access to the account's inbox.
- */
-import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT } from "./checkout-value-otp";
-export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
-type Db = FirebaseFirestore.Firestore;
-/** Single-slot doc per user — a user can only be mid-password-change once. */
-export declare function passwordChangeOtpRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
-export declare function passwordChangeOtpRateLimitRef(db: Db, uid: string): FirebaseFirestore.DocumentReference<FirebaseFirestore.DocumentData, FirebaseFirestore.DocumentData>;
-export interface PasswordChangeOtpDoc {
-    codeHash: string;
-    expiresAt: FirebaseFirestore.Timestamp;
-    attempts: number;
-    verified: boolean;
-}
-/**
- * Enforce the per-user send rate-limit.
- * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
- */
-export declare function enforcePasswordChangeOtpRateLimit(db: Db, uid: string): Promise<void>;

package/dist/features/auth/password-change-otp.js

@@ -1,56 +0,0 @@
-/**
- * Password Change OTP.
- *
- * Root-caused 2026-08-20: POST /api/user/change-password validated the
- * *shape* of `currentPassword` (Zod: non-empty, differs from newPassword)
- * but the handler never read or verified it — `getAdminAuth().updateUser()`
- * overwrote the password unconditionally for whatever `uid` the session
- * cookie carried. The only real current-password check
- * (`reauthenticateWithCredential` in the Firebase client SDK) happens in
- * the browser and is trivially bypassed by calling the API directly with a
- * stolen session cookie — a session hijack (XSS, log leak, etc.) was
- * enough to take over the account's password with zero server-enforced
- * identity check. This module gates the actual server-side write behind an
- * email OTP, verified server-side, mirroring the Tier PP checkout-value-OTP
- * pattern exactly (same crypto primitives, reused not duplicated) so a
- * session-cookie thief also needs access to the account's inbox.
- */
-import { AuthorizationError } from "../../errors";
-import { resolveDate } from "../../utils";
-import { USER_COLLECTION } from "./schemas";
-import { hashOtp, generateOtpCode, CHECKOUT_VALUE_OTP_EXPIRY_MS as PASSWORD_CHANGE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_EXPIRY_MINUTES as PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, CHECKOUT_VALUE_OTP_COOLDOWN_MS as PASSWORD_CHANGE_OTP_COOLDOWN_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS as PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, CHECKOUT_VALUE_OTP_VERIFY_RATE_LIMIT as PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, } from "./checkout-value-otp";
-export { hashOtp, generateOtpCode, PASSWORD_CHANGE_OTP_EXPIRY_MS, PASSWORD_CHANGE_OTP_EXPIRY_MINUTES, PASSWORD_CHANGE_OTP_COOLDOWN_MS, PASSWORD_CHANGE_OTP_MAX_ATTEMPTS, PASSWORD_CHANGE_OTP_VERIFY_RATE_LIMIT, };
-/** Single-slot doc per user — a user can only be mid-password-change once. */
-export function passwordChangeOtpRef(db, uid) {
-    return db
-        .collection(USER_COLLECTION)
-        .doc(uid)
-        .collection("passwordChangeOtps")
-        .doc("current");
-}
-export function passwordChangeOtpRateLimitRef(db, uid) {
-    return db
-        .collection(USER_COLLECTION)
-        .doc(uid)
-        .collection("passwordChangeOtpRateLimit")
-        .doc("meta");
-}
-/**
- * Enforce the per-user send rate-limit.
- * Throws AuthorizationError("passwordChangeOtpRateLimit") when throttled.
- */
-export async function enforcePasswordChangeOtpRateLimit(db, uid) {
-    const metaRef = passwordChangeOtpRateLimitRef(db, uid);
-    await db.runTransaction(async (tx) => {
-        const metaSnap = await tx.get(metaRef);
-        const meta = metaSnap.exists
-            ? metaSnap.data()
-            : null;
-        const lastSentMs = resolveDate(meta?.lastSentAt)?.getTime() ?? 0;
-        const elapsed = Date.now() - lastSentMs;
-        if (elapsed < PASSWORD_CHANGE_OTP_COOLDOWN_MS) {
-            throw new AuthorizationError("passwordChangeOtpRateLimit");
-        }
-        tx.set(metaRef, { lastSentAt: new Date() }, { merge: true });
-    });
-}

package/dist/features/classified/components/ClassifiedContactSellerPanel.d.ts

@@ -1,12 +0,0 @@
-import React from "react";
-import type { startClassifiedConversationAction } from "../../../_internal/server/features/classified/actions";
-export interface ClassifiedContactSellerPanelProps {
-    productId: string;
-    onContactSeller: typeof startClassifiedConversationAction;
-}
-/**
- * The only purchase-path CTA on a classified listing — no cart, no checkout.
- * Extracted from the old ClassifiedDetailView so the richer, full-parity
- * ClassifiedDetailPageView can slot this into a `renderBuyBar` prop.
- */
-export declare function ClassifiedContactSellerPanel({ productId, onContactSeller }: ClassifiedContactSellerPanelProps): React.JSX.Element;

package/dist/features/classified/components/ClassifiedContactSellerPanel.js

@@ -1,49 +0,0 @@
-"use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { normalizeError } from "../../../errors/normalize";
-import { useState } from "react";
-import Link from "next/link";
-import { Button, Div, Stack, Text } from "../../../ui";
-import { ROUTES } from "../../../next/routing/route-map";
-const __P = {
-    p4: "p-[var(--appkit-space-4)]",
-};
-/**
- * The only purchase-path CTA on a classified listing — no cart, no checkout.
- * Extracted from the old ClassifiedDetailView so the richer, full-parity
- * ClassifiedDetailPageView can slot this into a `renderBuyBar` prop.
- */
-export function ClassifiedContactSellerPanel({ productId, onContactSeller }) {
-    const [pending, setPending] = useState(false);
-    const [conversation, setConversation] = useState(null);
-    const [error, setError] = useState(null);
-    async function handleContactSeller() {
-        setPending(true);
-        setError(null);
-        try {
-            const result = await onContactSeller({ productId });
-            if (result && typeof result === "object" && "ok" in result) {
-                if (result.ok) {
-                    setConversation(result.data);
-                }
-                else {
-                    setError(result.error);
-                }
-            }
-            else {
-                setConversation(result);
-            }
-        }
-        catch (e) {
-            void normalizeError(e);
-            setError("Something went wrong");
-        }
-        finally {
-            setPending(false);
-        }
-    }
-    if (conversation) {
-        return (_jsxs(Div, { className: `border border-border bg-muted/40 ${__P.p4}`, rounded: "lg", children: [_jsx(Text, { className: "mb-2", weight: "medium", children: "Conversation started!" }), _jsx(Link, { href: ROUTES.USER.MESSAGES, className: "text-primary underline underline-offset-2", children: "Go to your messages \u2192" })] }));
-    }
-    return (_jsxs(Stack, { gap: "sm", children: [error && (_jsx(Text, { className: "text-destructive", size: "sm", children: error })), _jsx(Button, { type: "button", variant: "primary", size: "lg", isLoading: pending, disabled: pending, onClick: handleContactSeller, className: "w-full", children: "Contact Seller" })] }));
-}

package/dist/features/events/api/route.d.ts

@@ -1,12 +0,0 @@
-/**
- * feat-events — Next.js App Router API handler (GET /api/events)
- *
- * Consuming projects can create a 2-line stub:
- *
- * ```ts
- * // app/api/events/route.ts
- * export { GET } from "@mohasinac/feat-events";
- * ```
- */
-import { NextResponse } from "next/server.js";
-export declare function GET(request: Request): Promise<NextResponse>;

package/dist/features/events/api/route.js

@@ -1,90 +0,0 @@
-/**
- * feat-events — Next.js App Router API handler (GET /api/events)
- *
- * Consuming projects can create a 2-line stub:
- *
- * ```ts
- * // app/api/events/route.ts
- * export { GET } from "@mohasinac/feat-events";
- * ```
- */
-import { NextResponse } from "next/server.js";
-import { getProviders } from "../../../contracts";
-import { normalizeError } from "../../../errors/normalize";
-function param(url, key) {
-    return url.searchParams.get(key);
-}
-function numParam(url, key, fallback) {
-    const v = url.searchParams.get(key);
-    const n = v !== null ? Number(v) : NaN;
-    return Number.isFinite(n) ? n : fallback;
-}
-const SAFE_EVENT_FILTER_FIELDS = new Set([
-    "status",
-    "title",
-    "type",
-    "startsAt",
-    "endsAt",
-    "createdAt",
-]);
-function validateSieveFilters(raw, allowedFields) {
-    return raw
-        .split(",")
-        .map((c) => c.trim())
-        .filter((c) => {
-        const m = c.match(/^([^<>=!@]+)\s*(?:==|!=|<=|>=|<|>|@=\*?)/);
-        return m ? allowedFields.has(m[1].trim()) : false;
-    })
-        .join(",");
-}
-// ——— GET /api/events ————————————————————————————————
-export async function GET(request) {
-    try {
-        const url = new URL(request.url);
-        const page = numParam(url, "page", 1);
-        const pageSize = numParam(url, "pageSize", 24);
-        const sort = param(url, "sorts") ?? param(url, "sort") ?? "-startsAt";
-        const q = param(url, "q");
-        const raw = param(url, "filters");
-        const safe = raw ? validateSieveFilters(raw, SAFE_EVENT_FILTER_FIELDS) : "";
-        // Only default to active events when no explicit status filter is provided.
-        const hasStatusFilter = safe.includes("status==");
-        const parts = hasStatusFilter ? [] : ["status==active"];
-        if (q)
-            parts.push(`title@=*${q}`);
-        if (safe)
-            parts.push(safe);
-        const filters = parts.join(",");
-        const { db } = getProviders();
-        if (!db) {
-            return NextResponse.json({ success: false, error: "Database provider not registered" }, { status: 503 });
-        }
-        const repo = db.getRepository("events");
-        const result = await repo.findAll({
-            filters,
-            sort,
-            page,
-            perPage: pageSize,
-        });
-        const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
-        // Strip internal fields (createdBy) before returning
-        const items = result.data.map((event) => {
-            const { createdBy: _createdBy, ...publicEvent } = event;
-            return publicEvent;
-        });
-        const body = {
-            items: items,
-            total: result.total,
-            page: result.page,
-            pageSize,
-            totalPages,
-            hasMore: result.page < totalPages,
-        };
-        return NextResponse.json({ success: true, data: body });
-    }
-    catch (error) {
-        void normalizeError(error);
-        console.error("[feat-events] GET /api/events failed", error);
-        return NextResponse.json({ success: false, error: "Failed to fetch events" }, { status: 500 });
-    }
-}

package/dist/features/faq/api/route.d.ts

@@ -1,11 +0,0 @@
-/**
- * feat-faq — Next.js App Router API handler (GET /api/faq)
- *
- * 2-line stub:
- * ```ts
- * // app/api/faq/route.ts
- * export { GET } from "@mohasinac/feat-faq";
- * ```
- */
-import { NextResponse } from "next/server.js";
-export declare function GET(request: Request): Promise<NextResponse>;

package/dist/features/faq/api/route.js

@@ -1,52 +0,0 @@
-/**
- * feat-faq — Next.js App Router API handler (GET /api/faq)
- *
- * 2-line stub:
- * ```ts
- * // app/api/faq/route.ts
- * export { GET } from "@mohasinac/feat-faq";
- * ```
- */
-import { NextResponse } from "next/server.js";
-import { getProviders } from "../../../contracts";
-import { normalizeError } from "../../../errors/normalize";
-function param(url, key) {
-    return url.searchParams.get(key);
-}
-export async function GET(request) {
-    try {
-        const url = new URL(request.url);
-        const parts = ["isActive==true"];
-        const category = param(url, "category");
-        if (category)
-            parts.push(`category==${category}`);
-        const homepage = param(url, "homepage");
-        if (homepage === "true")
-            parts.push("showOnHomepage==true");
-        const q = param(url, "q");
-        if (q)
-            parts.push(`question@=*${q}`);
-        const filters = parts.join(",");
-        const { db } = getProviders();
-        if (!db) {
-            return NextResponse.json({ success: false, error: "Database provider not registered" }, { status: 503 });
-        }
-        const repo = db.getRepository("faqs");
-        const result = await repo.findAll({
-            filters,
-            sort: "order",
-            order: "asc",
-            perPage: 100,
-        });
-        const body = {
-            items: result.data,
-            total: result.total,
-        };
-        return NextResponse.json({ success: true, data: body });
-    }
-    catch (error) {
-        void normalizeError(error);
-        console.error("[feat-faq] GET /api/faq failed", error);
-        return NextResponse.json({ success: false, error: "Failed to fetch FAQs" }, { status: 500 });
-    }
-}

package/dist/features/faq/hooks/useFAQs.d.ts

@@ -1,22 +0,0 @@
-import type { FAQ, FAQListResponse, FAQListParams } from "../types";
-interface UseFAQsOptions {
-    initialData?: FAQListResponse;
-    enabled?: boolean;
-    endpoint?: string;
-}
-export declare function useFAQs(params?: FAQListParams, opts?: UseFAQsOptions): {
-    faqs: FAQ[];
-    total: number;
-    isLoading: boolean;
-    error: Error | null;
-};
-export declare function useFAQ(id: string, opts?: {
-    initialData?: FAQ;
-    enabled?: boolean;
-    endpoint?: string;
-}): {
-    faq: FAQ | undefined;
-    isLoading: boolean;
-    error: Error | null;
-};
-export {};

package/dist/features/faq/hooks/useFAQs.js

@@ -1,41 +0,0 @@
-import { useQuery } from "@tanstack/react-query";
-import { apiClient } from "../../../http";
-import { FAQ_ENDPOINTS } from "../../../constants/api-endpoints";
-export function useFAQs(params = {}, opts) {
-    const sp = new URLSearchParams();
-    if (params.category)
-        sp.set("category", params.category);
-    if (params.homepage !== undefined)
-        sp.set("homepage", String(params.homepage));
-    if (params.q)
-        sp.set("q", params.q);
-    if (params.page)
-        sp.set("page", String(params.page));
-    if (params.perPage)
-        sp.set("perPage", String(params.perPage));
-    const qs = sp.toString();
-    const endpoint = opts?.endpoint ?? `${FAQ_ENDPOINTS.LIST}${qs ? `?${qs}` : ""}`;
-    const query = useQuery({
-        queryKey: ["faqs", qs],
-        queryFn: () => apiClient.get(endpoint),
-        initialData: opts?.initialData,
-        enabled: opts?.enabled,
-        staleTime: 10 * 60 * 1000,
-    });
-    return {
-        faqs: query.data?.items ?? [],
-        total: query.data?.total ?? 0,
-        isLoading: query.isLoading,
-        error: query.error,
-    };
-}
-export function useFAQ(id, opts) {
-    const endpoint = opts?.endpoint ?? FAQ_ENDPOINTS.BY_ID(id);
-    const query = useQuery({
-        queryKey: ["faqs", id],
-        queryFn: () => apiClient.get(endpoint),
-        initialData: opts?.initialData,
-        enabled: opts?.enabled !== false && !!id,
-    });
-    return { faq: query.data, isLoading: query.isLoading, error: query.error };
-}

package/dist/features/media/upload/video-poster.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/features/media/upload/video-poster.test.js

@@ -1,42 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { buildPosterFilename, extractVideoPosterFrame, posterBlobAsFile, } from "./video-poster";
-describe("buildPosterFilename", () => {
-    it("strips the extension and appends .poster.jpg", () => {
-        expect(buildPosterFilename("vid-123.mp4")).toBe("vid-123.poster.jpg");
-        expect(buildPosterFilename("hero.webm")).toBe("hero.poster.jpg");
-        expect(buildPosterFilename("Sunset.MOV")).toBe("Sunset.poster.jpg");
-    });
-    it("handles names with multiple dots — only the last segment is the extension", () => {
-        expect(buildPosterFilename("clip.v2.mp4")).toBe("clip.v2.poster.jpg");
-        expect(buildPosterFilename("2026.01.01-recap.webm")).toBe("2026.01.01-recap.poster.jpg");
-    });
-    it("works when the source has no extension", () => {
-        expect(buildPosterFilename("untitled")).toBe("untitled.poster.jpg");
-    });
-});
-describe("posterBlobAsFile", () => {
-    it("wraps the blob as an image/jpeg File with the derived filename", () => {
-        const blob = new Blob([new Uint8Array([0xff, 0xd8, 0xff])], {
-            type: "image/jpeg",
-        });
-        const file = posterBlobAsFile({ blob, width: 320, height: 180, duration: 12.5 }, "promo-reel.mp4");
-        expect(file).toBeInstanceOf(File);
-        expect(file.name).toBe("promo-reel.poster.jpg");
-        expect(file.type).toBe("image/jpeg");
-        expect(file.size).toBe(3);
-    });
-});
-describe("extractVideoPosterFrame — early-return paths", () => {
-    it("returns null for a non-video File without touching the DOM", async () => {
-        const file = new File([new Uint8Array([1, 2, 3])], "photo.jpg", {
-            type: "image/jpeg",
-        });
-        const result = await extractVideoPosterFrame(file);
-        expect(result).toBeNull();
-    });
-    it("returns null when the File has an empty MIME type", async () => {
-        const file = new File([new Uint8Array([1])], "mystery.bin", { type: "" });
-        const result = await extractVideoPosterFrame(file);
-        expect(result).toBeNull();
-    });
-});

package/dist/features/messages/actions/index.d.ts

@@ -1,2 +0,0 @@
-export * from "./messages-actions";
-export * from "./ping-rtdb";

package/dist/features/messages/actions/index.js

@@ -1,2 +0,0 @@
-export * from "./messages-actions";
-export * from "./ping-rtdb";

package/dist/features/messages/actions/messages-actions.d.ts

@@ -1,15 +0,0 @@
-import { type ConversationsRepository } from "../repository/conversations.repository";
-import type { ConversationDocument, ConversationMessage } from "../schemas/firestore";
-export declare const MESSAGE_MAX_LENGTH = 2000;
-export declare function listConversationsForBuyer(buyerId: string): Promise<ConversationDocument[]>;
-export declare function listConversationsForStore(storeId: string): Promise<ConversationDocument[]>;
-export declare function getConversation(conversationId: string): Promise<ConversationDocument | null>;
-export interface SendMessageInput {
-    conversationId: string;
-    senderId: string;
-    senderRole: "buyer" | "seller";
-    body: string;
-}
-export declare function sendMessage(input: SendMessageInput): Promise<ConversationDocument>;
-export declare function markConversationRead(conversationId: string, role: "buyer" | "seller"): Promise<void>;
-export type { ConversationsRepository, ConversationDocument, ConversationMessage };

package/dist/features/messages/actions/messages-actions.js

@@ -1,33 +0,0 @@
-/**
- * Messages domain actions — pure business functions; auth/rate-limit is the
- * caller's responsibility.
- */
-import { ValidationError } from "../../../errors";
-import { ERROR_MESSAGES } from "../../../errors/messages";
-import { conversationsRepository, } from "../repository/conversations.repository";
-export const MESSAGE_MAX_LENGTH = 2000;
-export async function listConversationsForBuyer(buyerId) {
-    return conversationsRepository.listByBuyer(buyerId);
-}
-export async function listConversationsForStore(storeId) {
-    return conversationsRepository.listByStore(storeId);
-}
-export async function getConversation(conversationId) {
-    return conversationsRepository.findById(conversationId);
-}
-export async function sendMessage(input) {
-    const body = input.body?.trim();
-    if (!body)
-        throw new ValidationError(ERROR_MESSAGES.CONVERSATIONS.BODY_REQUIRED);
-    if (body.length > MESSAGE_MAX_LENGTH) {
-        throw new ValidationError(`${ERROR_MESSAGES.CONVERSATIONS.BODY_TOO_LONG} (max ${MESSAGE_MAX_LENGTH} characters)`);
-    }
-    return conversationsRepository.appendMessage(input.conversationId, {
-        senderId: input.senderId,
-        senderRole: input.senderRole,
-        body,
-    });
-}
-export async function markConversationRead(conversationId, role) {
-    await conversationsRepository.markRead(conversationId, role);
-}

package/dist/features/messages/actions/ping-rtdb.d.ts

@@ -1,2 +0,0 @@
-import { type ConversationPingTargets } from "../realtime";
-export declare function pingConversationRtdb(targets: ConversationPingTargets): Promise<void>;