@mohasinac/appkit 4.44.0 → 4.46.0

package/dist/_internal/server/features/seo/sitemap.js

@@ -1,16 +1,16 @@
-import { normalizeError } from "../../../../errors/normalize";
-import { getAdminDb } from "../../../../providers/db-firebase";
-import { ROUTES } from "../../../../next/routing/route-map";
-import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore";
-import { EVENTS_COLLECTION, EVENT_FIELDS } from "../../../../features/events";
-import { BLOG_POSTS_COLLECTION, BLOG_POST_FIELDS } from "../../../../features/blog";
-import { CATEGORIES_COLLECTION, CATEGORY_FIELDS } from "../../../../features/categories";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { getAdminDb } from "../../../../providers/db-firebase/index.js";
+import { ROUTES } from "../../../../next/routing/route-map.js";
+import { PRODUCT_COLLECTION } from "../../../../features/products/schemas/firestore.js";
+import { EVENTS_COLLECTION, EVENT_FIELDS } from "../../../../features/events/index.js";
+import { BLOG_POSTS_COLLECTION, BLOG_POST_FIELDS } from "../../../../features/blog/schemas/firestore.js";
+import { CATEGORIES_COLLECTION, CATEGORY_FIELDS } from "../../../../features/categories/schemas/firestore.js";
 // Imported from the DEFINING module, not the feature barrel (Root Cause #18).
-import { isListingCategory } from "../../../../features/categories/constants/listing-categories";
-import { STORE_COLLECTION, STORE_FIELDS } from "../../../../features/stores";
-import { SCAMMER_COLLECTION } from "../../../../features/scams/schemas/firestore";
-import { serverLogger } from "../../../../monitoring/server-logger";
-import { PRODUCT_FIELDS } from "../../../../constants/field-names";
+import { isListingCategory } from "../../../../features/categories/constants/listing-categories.js";
+import { STORE_COLLECTION, STORE_FIELDS } from "../../../../features/stores/schemas/firestore.js";
+import { SCAMMER_COLLECTION } from "../../../../features/scams/schemas/firestore.js";
+import { serverLogger } from "../../../../monitoring/server-logger.js";
+import { PRODUCT_FIELDS } from "../../../../constants/field-names.js";
 // Product field strings — matches consumer field-names.ts
 const PRODUCT_STATUS = "status";
 const PRODUCT_STATUS_PUBLISHED = "published";
@@ -371,7 +371,7 @@ const fetchBundleUrls = (baseUrl) => fetchCategoryTypeUrls(baseUrl, "bundle", (s
  */
 async function fetchGroupedListingUrls(baseUrl) {
     try {
-        const { listSitemapGroupedListings } = await import("../grouped/data");
+        const { listSitemapGroupedListings } = await import("../grouped/data.js");
         const groups = await listSitemapGroupedListings();
         return groups.map((g) => ({
             url: `${baseUrl}${ROUTES.PUBLIC.GROUP_DETAIL(g.slug)}`,

package/dist/_internal/server/features/shared/listing-data-factory.js

@@ -1,8 +1,8 @@
 import { cache } from "react";
-import { productRepository } from "../../../../repositories";
-import { safeRead } from "../../../../errors/safe-read";
-import { loadProductFeaturesForStore } from "../../../../features/products/repository/loadProductFeatures";
-import { isPubliclyVisible } from "../../../shared/listing-types/availability";
+import { productRepository } from "../../../../repositories/index.js";
+import { safeRead } from "../../../../errors/safe-read.js";
+import { loadProductFeaturesForStore } from "../../../../features/products/repository/loadProductFeatures.js";
+import { isPubliclyVisible } from "../../../shared/listing-types/availability.js";
 // Returns a React.cache()-wrapped fetch gated on one listing type.
 // The guard prevents cross-type URL collisions (e.g. /auctions/classified-slug returning wrong product).
 //

package/dist/_internal/server/features/site-settings/actions.js

@@ -1,4 +1,4 @@
-import { siteSettingsRepository } from "../../../../features/admin/repository/site-settings.repository";
+import { siteSettingsRepository } from "../../../../features/admin/repository/site-settings.repository.js";
 /**
  * Toggle a single action's enabled state in siteSettings.actionConfig.
  * Performs a sparse merge — only updates the one key.

package/dist/_internal/server/features/site-settings/index.js

@@ -1 +1 @@
-export { toPublicSiteSettings, PUBLIC_SITE_SETTINGS_FIELDS, PRIVATE_SITE_SETTINGS_FIELDS, } from "./adapters";
+export { toPublicSiteSettings, PUBLIC_SITE_SETTINGS_FIELDS, PRIVATE_SITE_SETTINGS_FIELDS, } from "./adapters.js";

package/dist/_internal/server/features/site-settings/safe-settings.js

@@ -1,6 +1,6 @@
-import { normalizeError } from "../../../../errors/normalize";
-import { serverLogger } from "../../../../monitoring/server-logger";
-import { getSiteSettingsGlobal } from "../../../../features/admin/utils/getSiteSettingsGlobal";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { serverLogger } from "../../../../monitoring/server-logger.js";
+import { getSiteSettingsGlobal } from "../../../../features/admin/utils/getSiteSettingsGlobal.js";
 /**
  * Null-safe wrapper around getSiteSettingsGlobal().
  *

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -25,9 +25,9 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  * Document fields that may reach an unauthenticated client. Keep in sync with
  * the object literals below — the audit asserts both directions.
  */
-export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "createdAt"];
+export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "supportsShippingProtection", "supportsSaleProtection", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["searchTxt", "updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["searchTxt", "updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "pricesIncludeGst", "shippingPricing", "returnsDirectToSeller", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -19,9 +19,20 @@ export const PUBLIC_STORE_FIELDS = [
     "website",
     "socialLinks",
     "returnPolicy",
+    // The seller's free-text shipping PROSE, rendered by StoreAboutView. Not to
+    // be confused with `shippingPricing` below, which is the rule that computes
+    // money and is private — the names are one word apart and mean opposite
+    // things about disclosure.
     "shippingPolicy",
     "isVacationMode",
     "vacationMessage",
+    // C5e, and the only two new store fields in this plan that are public. The
+    // safety badge and the pre-purchase risk notice are both rendered to an
+    // anonymous visitor on the listing and in the cart — withholding them would
+    // make "has not opted in" indistinguishable from "we did not tell you",
+    // which is the one outcome the tri-state rule forbids.
+    "supportsShippingProtection",
+    "supportsSaleProtection",
     "createdAt",
 ];
 /** Everything else, with the reason it stays server-side. */
@@ -52,6 +63,30 @@ export const PRIVATE_STORE_FIELDS = [
     // publishing it would invite a client to "correct" a price that is already
     // correct.
     "pricesIncludeGst",
+    /*
+     * C5b. A commercial setting, and `estimate` additionally reveals that this
+     * seller's parcels are booked through OUR carrier account — which is
+     * operational detail about us, not a fact about the store. A buyer sees the
+     * resulting amount at checkout; the rule that produced it is ours.
+     *
+     * 🛑 One word from `shippingPolicy` in the PUBLIC list above, and the
+     * opposite answer. That is a real hazard — a blind find-replace during this
+     * change swapped the two and `tsc` was silent, because both are valid
+     * strings in a `const` array. `audit-public-projection-parity` is what would
+     * have caught it: a PUBLIC field no projection emits fails.
+     */
+    "shippingPricing",
+    /*
+     * C5g. An ADMIN trust decision about this seller, and the opposite call from
+     * the two `supports*Protection` flags in the PUBLIC list — which is the point
+     * of them being different kinds of field.
+     *
+     * The `supports*` pair is a PROMISE the seller made and a buyer needs before
+     * purchase. This is an internal exemption from our inspection step: it tells
+     * a buyer nothing they can act on, and publishing it would advertise which
+     * sellers' returns we do not check — a map of where to try a swap.
+     */
+    "returnsDirectToSeller",
     "isFeatured", // ranking input; not part of the public store profile
     "vacationReturnDate", // not rendered by StoreAboutView; add to PUBLIC when a reader exists
     "isTestData", // tester-sandbox tagging; filtered by filterTestDataForViewer
@@ -88,6 +123,15 @@ export function toStoreListItem(doc, _opts) {
         itemsSold: stats?.itemsSold ?? doc.itemsSold,
         totalReviews: stats?.totalReviews ?? doc.totalReviews,
         averageRating: stats?.averageRating ?? doc.averageRating,
+        /*
+         * 🛑 `?? false` rather than passed through, which is the tri-state rule
+         * resolved once. An absent field must reach the client as a definite "not
+         * supported" so the risk notice renders; forwarding `undefined` would let a
+         * `!== false` test read it as supported, or a truthiness test render
+         * neither badge nor notice — the one outcome that tells the buyer nothing.
+         */
+        supportsShippingProtection: doc.supportsShippingProtection ?? false,
+        supportsSaleProtection: doc.supportsSaleProtection ?? false,
         createdAt: toIsoString(doc.createdAt),
     };
 }

package/dist/_internal/server/features/stores/data.js

@@ -1,10 +1,10 @@
 "use server";
 import { cache } from "react";
-import { storeRepository } from "../../../../repositories";
-import { STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, } from "../../../shared/features/stores/config";
-import { makeGetStoreListingsInitial } from "../shared/listing-data-factory";
-import { safeRead } from "../../../../errors/safe-read";
-import { hidePublicTestData } from "../tester/visibility";
+import { storeRepository } from "../../../../repositories/index.js";
+import { STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, } from "../../../shared/features/stores/config.js";
+import { makeGetStoreListingsInitial } from "../shared/listing-data-factory.js";
+import { safeRead } from "../../../../errors/safe-read.js";
+import { hidePublicTestData } from "../tester/visibility.js";
 /** Full store document by slug — deduped per request via React.cache(). */
 export const getStoreForDetail = cache(async (slug) => {
     return (await storeRepository.findBySlug(slug)) ?? null;

package/dist/_internal/server/features/stores/denormalize.js

@@ -19,8 +19,8 @@
  * which is still the correct last line of defence for carts built from products
  * that predate this. This module fixes the source instead.
  */
-import { storeRepository } from "../../../../features/stores/repository/store.repository";
-import { safeRead } from "../../../../errors/safe-read";
+import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
+import { safeRead } from "../../../../errors/safe-read.js";
 /**
  * Resolve the display fields for one store.
  *

package/dist/_internal/server/features/stores/index.js

@@ -1,5 +1,5 @@
-export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores, } from "./data";
-export { STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, } from "../../../shared/features/stores/config";
-export { renderStoreOgImage, renderStoreOg } from "./og";
-export { resolveStoreFields, resolveStoreFieldsMany, } from "./denormalize";
-export { toStoreDetail, toStoreListItem, PUBLIC_STORE_FIELDS, PRIVATE_STORE_FIELDS, } from "./adapters";
+export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores, } from "./data.js";
+export { STORES_PAGE_SIZE, STORES_PRODUCTS_PAGE_SIZE, STORES_SITEMAP_LIMIT, STORES_FEATURED_LIMIT, } from "../../../shared/features/stores/config.js";
+export { renderStoreOgImage, renderStoreOg } from "./og.js";
+export { resolveStoreFields, resolveStoreFieldsMany, } from "./denormalize.js";
+export { toStoreDetail, toStoreListItem, PUBLIC_STORE_FIELDS, PRIVATE_STORE_FIELDS, } from "./adapters.js";

package/dist/_internal/server/features/stores/og.js

@@ -1,5 +1,5 @@
-import { renderOgLayout } from "../seo/og-layout";
-import { resolveOgImageUrl } from "../seo/og";
+import { renderOgLayout } from "../seo/og-layout.js";
+import { resolveOgImageUrl } from "../seo/og.js";
 /** High-level OG renderer — accepts the raw store document from `getStoreForDetail`. */
 export function renderStoreOg(doc, opts) {
     return renderStoreOgImage({

package/dist/_internal/server/features/sublisting-categories/data.js

@@ -1,5 +1,5 @@
 import { cache } from "react";
-import { categoriesRepository } from "../../../../repositories";
+import { categoriesRepository } from "../../../../repositories/index.js";
 export const getSublistingCategoryForDetail = cache(async (slug) => {
     return categoriesRepository.findBySlugAndType(slug, "sublisting");
 });

package/dist/_internal/server/features/sublisting-categories/index.js

@@ -1,2 +1,2 @@
-export { getSublistingCategoryForDetail } from "./data";
-export { renderSublistingCategoryOgImage, renderSublistingCategoryOg } from "./og";
+export { getSublistingCategoryForDetail } from "./data.js";
+export { renderSublistingCategoryOgImage, renderSublistingCategoryOg } from "./og.js";

package/dist/_internal/server/features/sublisting-categories/og.js

@@ -1,5 +1,5 @@
-import { renderOgLayout } from "../seo/og-layout";
-import { resolveOgImageUrl } from "../seo/og";
+import { renderOgLayout } from "../seo/og-layout.js";
+import { resolveOgImageUrl } from "../seo/og.js";
 /** High-level OG renderer — accepts the raw sublisting-category doc from the repository. */
 export function renderSublistingCategoryOg(doc, opts) {
     const baseName = doc?.name ?? "Sub-listing";

package/dist/_internal/server/features/tester/visibility.js

@@ -7,7 +7,7 @@
  * (a `!=` clause) would silently exclude every pre-existing document that doesn't have
  * the field set at all, which is worse than the problem it solves.
  */
-import { isAdminUser, isTesterUser } from "../../../../features/auth/role-predicates";
+import { isAdminUser, isTesterUser } from "../../../../features/auth/role-predicates.js";
 /** True when the viewer is allowed to see isTestData:true documents. */
 export function canViewTestData(viewer) {
     return isTesterUser(viewer) || isAdminUser(viewer);

package/dist/_internal/server/features/wishlist/actions.js

@@ -1,10 +1,10 @@
 "use server";
-import { normalizeError } from "../../../../errors/normalize";
+import { normalizeError } from "../../../../errors/normalize.js";
 import { wrapAction } from "@mohasinac/appkit/server";
-import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
-import { wishlistRepository, WishlistFullError, } from "../../../../repositories";
-import { WISHLIST_MAX } from "../../../shared/features/wishlist/config";
-import { WishlistCapError } from "../../../shared/features/wishlist/errors";
+import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
+import { wishlistRepository, WishlistFullError, } from "../../../../repositories/index.js";
+import { WISHLIST_MAX } from "../../../shared/features/wishlist/config.js";
+import { WishlistCapError } from "../../../shared/features/wishlist/errors.js";
 export async function addToWishlistAction(productId, extras) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["user", "buyer", "seller", "admin"]);

package/dist/_internal/server/features/wishlist/data.js

@@ -1,5 +1,5 @@
 import { cache } from "react";
-import { wishlistRepository } from "../../../../repositories";
+import { wishlistRepository } from "../../../../repositories/index.js";
 export const getWishlistForUser = cache(async (userId) => {
     const items = await wishlistRepository.getWishlistItems(userId).catch(() => []);
     return { items, meta: { total: items.length } };

package/dist/_internal/server/features/wishlist/index.js

@@ -1,4 +1,4 @@
-export { getWishlistForUser, isProductInWishlist } from "./data";
-export { addToWishlistAction, removeFromWishlistAction, mergeGuestWishlistAction, } from "./actions";
-export { WISHLIST_MAX, WISHLIST_GUEST_STORAGE_KEY } from "../../../shared/features/wishlist/config";
-export { WishlistCapError } from "../../../shared/features/wishlist/errors";
+export { getWishlistForUser, isProductInWishlist } from "./data.js";
+export { addToWishlistAction, removeFromWishlistAction, mergeGuestWishlistAction, } from "./actions.js";
+export { WISHLIST_MAX, WISHLIST_GUEST_STORAGE_KEY } from "../../../shared/features/wishlist/config.js";
+export { WishlistCapError } from "../../../shared/features/wishlist/errors.js";

package/dist/_internal/server/functions/bind-all.d.ts

@@ -8,6 +8,31 @@
  * triggers, and the shared-secret check for HTTPS handlers. No re-implementation
  * happens here.
  *
+ * ## 🛑 Every handler is wrapped here, and this is the ONLY place it happens
+ *
+ * `wrapJobHandler` persists a `serverErrors` row with `source: "function"`
+ * before re-throwing, so `/admin/maintenance/function-errors` has something to
+ * show. It was written for that purpose and then had **ZERO call sites** — the
+ * tester checklist carries a case whose expected answer is literally "answer NO,
+ * because nothing in production writes a row with that source, so this page will
+ * be empty no matter what breaks".
+ *
+ * That mattered more each time a job was added. The price-index rollup, the
+ * alert evaluator and the counters reconciler can all fail silently today: the
+ * Cloud Functions log has the stack, the admin surface built to surface it has
+ * nothing, and nobody looks at a log for a job they do not know failed.
+ *
+ * 🛑 Wrapped HERE rather than at each `defineFunction`, because this is the one
+ * choke point all 28 registered functions pass through — so a new job is
+ * covered automatically and CANNOT be added unwrapped. Wrapping at the
+ * definition site would make coverage a matter of remembering, which is how the
+ * seam ended up dead in the first place.
+ *
+ * 🛑 It RE-THROWS. The recording is additive and must never swallow the error,
+ * or the runtime's retry semantics change — a failed scheduled job that looks
+ * successful is worse than one that is merely unobserved. `persist` has its own
+ * try/catch so a failure to record cannot become the failure.
+ *
  * Consumer usage (functions/src/index.ts):
  *   import { APPKIT_FUNCTIONS, bindAllFromRegistry, mergeFunctionRegistries } from "@mohasinac/appkit/jobs";
  *   import { CONSUMER_FUNCTIONS } from "./consumer-functions";

package/dist/_internal/server/functions/bind-all.js

@@ -8,13 +8,39 @@
  * triggers, and the shared-secret check for HTTPS handlers. No re-implementation
  * happens here.
  *
+ * ## 🛑 Every handler is wrapped here, and this is the ONLY place it happens
+ *
+ * `wrapJobHandler` persists a `serverErrors` row with `source: "function"`
+ * before re-throwing, so `/admin/maintenance/function-errors` has something to
+ * show. It was written for that purpose and then had **ZERO call sites** — the
+ * tester checklist carries a case whose expected answer is literally "answer NO,
+ * because nothing in production writes a row with that source, so this page will
+ * be empty no matter what breaks".
+ *
+ * That mattered more each time a job was added. The price-index rollup, the
+ * alert evaluator and the counters reconciler can all fail silently today: the
+ * Cloud Functions log has the stack, the admin surface built to surface it has
+ * nothing, and nobody looks at a log for a job they do not know failed.
+ *
+ * 🛑 Wrapped HERE rather than at each `defineFunction`, because this is the one
+ * choke point all 28 registered functions pass through — so a new job is
+ * covered automatically and CANNOT be added unwrapped. Wrapping at the
+ * definition site would make coverage a matter of remembering, which is how the
+ * seam ended up dead in the first place.
+ *
+ * 🛑 It RE-THROWS. The recording is additive and must never swallow the error,
+ * or the runtime's retry semantics change — a failed scheduled job that looks
+ * successful is worse than one that is merely unobserved. `persist` has its own
+ * try/catch so a failure to record cannot become the failure.
+ *
  * Consumer usage (functions/src/index.ts):
  *   import { APPKIT_FUNCTIONS, bindAllFromRegistry, mergeFunctionRegistries } from "@mohasinac/appkit/jobs";
  *   import { CONSUMER_FUNCTIONS } from "./consumer-functions";
  *   const REGISTRY = mergeFunctionRegistries(APPKIT_FUNCTIONS, CONSUMER_FUNCTIONS);
  *   Object.assign(exports, bindAllFromRegistry(REGISTRY));
  */
-import { bindDocumentCreated, bindDocumentUpdated, bindDocumentWritten, bindHttps, bindSchedule, } from "../jobs/runtime/adapters/firebase";
+import { bindDocumentCreated, bindDocumentUpdated, bindDocumentWritten, bindHttps, bindSchedule, } from "../jobs/runtime/adapters/firebase.js";
+import { wrapScheduleHandler, wrapTriggerHandler, wrapCallableHandler, } from "../jobs/core/wrapJobHandler.js";
 export function bindAllFromRegistry(registry) {
     const out = {};
     for (const def of registry) {
@@ -40,20 +66,21 @@ function bindScheduledDefinition(def) {
         ...(def.trigger.timeZone ? { timeZone: def.trigger.timeZone } : {}),
         ...sharedRuntimeOptions(def.options),
     };
-    return bindSchedule(def.name, def.handler, opts);
+    return bindSchedule(def.name, wrapScheduleHandler(def.name, def.handler), opts);
 }
 function bindDocumentDefinition(def) {
     const opts = {
         document: def.trigger.pathPattern,
         ...sharedRuntimeOptions(def.options),
     };
+    const handler = wrapTriggerHandler(def.name, def.handler);
     switch (def.trigger.kind) {
         case "documentCreated":
-            return bindDocumentCreated(def.name, def.handler, opts);
+            return bindDocumentCreated(def.name, handler, opts);
         case "documentUpdated":
-            return bindDocumentUpdated(def.name, def.handler, opts);
+            return bindDocumentUpdated(def.name, handler, opts);
         case "documentWritten":
-            return bindDocumentWritten(def.name, def.handler, opts);
+            return bindDocumentWritten(def.name, handler, opts);
     }
 }
 function bindHttpsDefinition(def) {
@@ -62,7 +89,15 @@ function bindHttpsDefinition(def) {
         ...(def.trigger.methods ? { methods: [...def.trigger.methods] } : {}),
         ...sharedRuntimeOptions(def.options),
     };
-    return bindHttps(def.name, def.handler, opts);
+    /*
+     * 🛑 Wrapped like the other two, and the HTTPS case is the one most worth
+     * recording — `gateway` and `listingProcessor` are reachable from the app, so
+     * a failure here is a user-visible 500 whose cause the maintenance UI should
+     * be able to name. Note the double-registration trap in Root Cause #85: the
+     * same handler is exposed twice (directly and via `gateway`), so a row's
+     * `route` is the DEFINITION name and tells you which entry point served it.
+     */
+    return bindHttps(def.name, wrapCallableHandler(def.name, def.handler), opts);
 }
 function sharedRuntimeOptions(options) {
     if (!options)

package/dist/_internal/server/functions/firestore.js

@@ -6,8 +6,8 @@
  * The path patterns mirror the original `functions/src/index.ts` declarations
  * to preserve identical deploy behavior.
  */
-import { onCategoryWriteHandler, onOrderCreateHandler, onOrderStatusChangeHandler, onProductStockChangeHandler, onProductWriteHandler, onReviewWriteHandler, onScamReportCreateHandler, onScamReportUpdateHandler, onStoreWriteHandler, onSupportTicketCreateHandler, onSupportTicketUpdateHandler, onUserBanChangeHandler, onShipmentItemWriteHandler, onShipmentLotWriteHandler, onShipmentHeaderWriteHandler, onShipmentDeletedHandler, onCatalogueSubmittedForApprovalHandler, onJobCreatedHandler, onPrizeDrawPaymentConfirmedHandler, prizeDrawSoldOutRevealHandler, } from "../jobs/handlers";
-import { defineFunction } from "./define";
+import { onCategoryWriteHandler, onOrderCreateHandler, onOrderStatusChangeHandler, onProductStockChangeHandler, onProductWriteHandler, onReviewWriteHandler, onScamReportCreateHandler, onScamReportUpdateHandler, onStoreWriteHandler, onSupportTicketCreateHandler, onSupportTicketUpdateHandler, onUserBanChangeHandler, onShipmentItemWriteHandler, onShipmentLotWriteHandler, onShipmentHeaderWriteHandler, onShipmentDeletedHandler, onCatalogueSubmittedForApprovalHandler, onJobCreatedHandler, onPrizeDrawPaymentConfirmedHandler, prizeDrawSoldOutRevealHandler, } from "../jobs/handlers/index.js";
+import { defineFunction } from "./define.js";
 const REGION = "asia-south1";
 export const onOrderCreate = defineFunction({
     name: "onOrderCreate",

package/dist/_internal/server/functions/https.js

@@ -9,8 +9,8 @@
  * single URL so callers only manage one env var. It dispatches by the
  * `action` field on the request body.
  */
-import { adminAnalyticsHandler, assignSpinPrizeHandler, listingProcessorHandler, promotionsHandler, storeAnalyticsHandler, triggerEventRaffleHandler, } from "../jobs/handlers";
-import { defineFunction } from "./define";
+import { adminAnalyticsHandler, assignSpinPrizeHandler, listingProcessorHandler, promotionsHandler, storeAnalyticsHandler, triggerEventRaffleHandler, } from "../jobs/handlers/index.js";
+import { defineFunction } from "./define.js";
 const REGION = "asia-south1";
 // Consumer-specific env var name — chosen at consumer install time, not appkit.
 // Format: <CONSUMER>_INTERNAL_SECRET

package/dist/_internal/server/functions/index.js

@@ -4,7 +4,7 @@
  * Re-exported from `@mohasinac/appkit/jobs` for consumer use in
  * `functions/src/index.ts`.
  */
-export { defineFunction } from "./define";
-export { mergeFunctionRegistries } from "./merge";
-export { bindAllFromRegistry } from "./bind-all";
-export { APPKIT_FUNCTIONS, APPKIT_FUNCTIONS_BY_NAME } from "./manifest";
+export { defineFunction } from "./define.js";
+export { mergeFunctionRegistries } from "./merge.js";
+export { bindAllFromRegistry } from "./bind-all.js";
+export { APPKIT_FUNCTIONS, APPKIT_FUNCTIONS_BY_NAME } from "./manifest.js";

package/dist/_internal/server/functions/manifest.js

@@ -10,9 +10,9 @@
  *   - `mergeFunctionRegistries` treats the second-and-later registries as
  *     overrides; appkit must be passed first so consumers may shadow.
  */
-import { FIRESTORE_TRIGGER_FUNCTIONS } from "./firestore";
-import { HTTPS_FUNCTIONS } from "./https";
-import { SCHEDULED_FUNCTIONS } from "./scheduled";
+import { FIRESTORE_TRIGGER_FUNCTIONS } from "./firestore.js";
+import { HTTPS_FUNCTIONS } from "./https.js";
+import { SCHEDULED_FUNCTIONS } from "./scheduled.js";
 export const APPKIT_FUNCTIONS = [
     ...SCHEDULED_FUNCTIONS,
     ...FIRESTORE_TRIGGER_FUNCTIONS,

package/dist/_internal/server/functions/scheduled.js

@@ -1,7 +1,7 @@
 // Scheduled function definitions (Cloud Scheduler triggers).
 // Cron syntax accepts both Firebase shorthand and standard cron expressions.
-import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, priceIndexRollupHandler, analyticsAlertEvaluateHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testDataCleanupHandler, } from "../jobs/handlers";
-import { defineFunction } from "./define";
+import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, priceIndexRollupHandler, analyticsAlertEvaluateHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testDataCleanupHandler, } from "../jobs/handlers/index.js";
+import { defineFunction } from "./define.js";
 const REGION = "asia-south1";
 const EVERY_5_MIN = "every 5 minutes";
 export const auctionSettlement = defineFunction({

package/dist/_internal/server/jobs/core/adminAnalytics.js

@@ -2,9 +2,9 @@
  * Core: aggregate admin analytics. Returns 12-month order totals + monthly
  * breakdown + top-5 products by revenue.
  */
-import { orderRepository, productRepository } from "../../../../repositories";
-import { formatMonthYear } from "../../../../utils/date.formatter";
-import { ProductStatusValues } from "../../../../features/products/schemas/firestore";
+import { orderRepository, productRepository } from "../../../../repositories/index.js";
+import { formatMonthYear } from "../../../../utils/date.formatter.js";
+import { ProductStatusValues } from "../../../../features/products/schemas/firestore.js";
 function normalizeDate(raw) {
     return raw instanceof Date ? raw : new Date(raw);
 }

package/dist/_internal/server/jobs/core/analyticsAlertEvaluate.js

@@ -33,12 +33,12 @@
  * index nobody declares (Root Cause #59) — so the window is bounded and the
  * predicate runs in memory, the same asymmetry § Availability describes.
  */
-import { serverLogger } from "../../../../monitoring";
-import { sendNotification } from "../../../../features/admin/actions/notification-actions";
-import { normalizeError } from "../../../../errors/normalize";
-import { ORDER_FIELDS, PAYOUT_FIELDS, PRODUCT_FIELDS, } from "../../../../constants/field-names";
-import { ProductStatusValues, PRODUCT_COLLECTION, } from "../../../../features/products/schemas/firestore";
-import { ALERT_METRICS, LOW_STOCK_THRESHOLD, } from "../../../../features/store-extensions/constants/alert-metrics";
+import { serverLogger } from "../../../../monitoring/index.js";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { ORDER_FIELDS, PAYOUT_FIELDS, PRODUCT_FIELDS, } from "../../../../constants/field-names.js";
+import { ProductStatusValues, PRODUCT_COLLECTION, } from "../../../../features/products/schemas/firestore.js";
+import { ALERT_METRICS, LOW_STOCK_THRESHOLD, } from "../../../../features/store-extensions/constants/alert-metrics.js";
 /** Bound on every count query. Reported when it saturates. */
 const QUERY_LIMIT = 500;
 /*

package/dist/_internal/server/jobs/core/assignSpinPrize.js

@@ -11,8 +11,8 @@
  * prize (the old read-then-`ref.update()` version had this race).
  */
 import crypto from "node:crypto";
-import { EVENT_ENTRY_FIELDS, COMMON_FIELDS } from "../../../../constants/field-names";
-import { resolveDate } from "../../../../utils";
+import { EVENT_ENTRY_FIELDS, COMMON_FIELDS } from "../../../../constants/field-names.js";
+import { resolveDate } from "../../../../utils/index.js";
 const EVENTS_COLLECTION = "events";
 const EVENT_ENTRIES_COLLECTION = "eventEntries";
 const COUPONS_COLLECTION = "coupons";

package/dist/_internal/server/jobs/core/auctionSettlement.js

@@ -1,10 +1,10 @@
-import { bidRepository, cartRepository, productRepository, storeRepository, } from "../../../../repositories";
-import { sendNotification } from "../../../../features/admin/actions/notification-actions";
-import { normalizeError } from "../../../../errors/normalize";
-import { safeRead } from "../../../../errors/safe-read";
-import { AUCTION_MESSAGES, BID_MESSAGES } from "../handlers/messages";
-import { ROUTES } from "../../../../next/routing/route-map";
-import { CART_LANE, LANE_CHECKOUT_WINDOW_MS } from "../../../shared/checkout/lanes";
+import { bidRepository, cartRepository, productRepository, storeRepository, } from "../../../../repositories/index.js";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { safeRead } from "../../../../errors/safe-read.js";
+import { AUCTION_MESSAGES, BID_MESSAGES } from "../handlers/messages.js";
+import { ROUTES } from "../../../../next/routing/route-map.js";
+import { CART_LANE, LANE_CHECKOUT_WINDOW_MS } from "../../../shared/checkout/lanes.js";
 /**
  * How long the winner has to pay before the locked cart line lapses. Mirrors
  * the accepted-offer window so both locked lanes behave the same.

package/dist/_internal/server/jobs/core/autoPayoutEligibility.js

@@ -1,8 +1,8 @@
-import { orderRepository, payoutRepository, storeRepository, userRepository, siteSettingsRepository, } from "../../../../repositories";
-import { getDefaultCurrency } from "../../../../core/index";
-import { computePayoutDeduction } from "../../../shared/fees/calculator";
-import { ordersTaxableValue } from "../../../shared/checkout/order-math";
-import { BATCH_LIMIT } from "../handlers/messages";
+import { orderRepository, payoutRepository, storeRepository, userRepository, siteSettingsRepository, } from "../../../../repositories/index.js";
+import { getDefaultCurrency } from "../../../../core/index.js";
+import { computePayoutDeduction } from "../../../shared/fees/calculator.js";
+import { ordersTaxableValue } from "../../../shared/checkout/order-math.js";
+import { BATCH_LIMIT } from "../handlers/messages.js";
 const AUTO_PAYOUT_WINDOW_DAYS = 7;
 function getBusinessDayCutoff(daysAgo) {
     const now = new Date();

package/dist/_internal/server/jobs/core/bundleStockSync.js

@@ -6,7 +6,7 @@
  * `bundleStockStatus`. This sweep recomputes `bundleStockStatus` for
  * every active bundle by inspecting its members' product status.
  */
-import { CATEGORY_FIELDS, PRODUCT_FIELDS, COMMON_FIELDS } from "../../../../constants/field-names";
+import { CATEGORY_FIELDS, PRODUCT_FIELDS, COMMON_FIELDS } from "../../../../constants/field-names.js";
 const CATEGORIES_COLLECTION = "categories";
 const PRODUCT_COLLECTION = "products";
 function isMemberAvailable(data) {

package/dist/_internal/server/jobs/core/cartPrune.js

@@ -1,6 +1,6 @@
-import { cartRepository } from "../../../../repositories";
-import { CART_TTL_DAYS } from "../handlers/messages";
-import { batchDelete } from "../handlers/_helpers";
+import { cartRepository } from "../../../../repositories/index.js";
+import { CART_TTL_DAYS } from "../handlers/messages.js";
+import { batchDelete } from "../handlers/_helpers.js";
 export async function runCartPrune(ctx) {
     ctx.logger.info(`Pruning carts idle for > ${CART_TTL_DAYS} days`);
     const refs = await cartRepository.getStaleRefs(CART_TTL_DAYS);

package/dist/_internal/server/jobs/core/catalogueImageStalenessReminder.js

@@ -1,7 +1,7 @@
-import { normalizeError } from "../../../../errors/normalize";
-import { sendNotification } from "../../../../features/admin/actions/notification-actions";
-import { catalogueRepository } from "../../../../repositories";
-import { CATALOGUE_IMAGE_FRESHNESS_DAYS } from "../../../../features/catalogue/schemas/firestore";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
+import { catalogueRepository } from "../../../../repositories/index.js";
+import { CATALOGUE_IMAGE_FRESHNESS_DAYS } from "../../../../features/catalogue/schemas/firestore.js";
 const REMINDER_LEAD_DAYS = 5;
 const DAY_MS = 86400000;
 /**