@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/server.js

@@ -7,6 +7,21 @@ export { isAuthError } from "./utils/auth-error.js";
 // exported subpath, and a consumer page must not reach into it.
 export { searchEverything } from "./_internal/server/features/search/search-everything.js";
 export { SEARCH_SOURCES } from "./_internal/server/features/search/search-sources.js";
+export { SCOPED_SCAN_BUDGET } from "./_internal/server/features/search/search-everything.js";
+/*
+ * `buildTokensIndex` is server-only for the same reason `encryptPiiFields`
+ * is: it feeds `BaseRepository.buildTokensIndexFor`, which runs inside the
+ * write-hook chain that also calls `hmacBlindIndex` (a `node:crypto` HMAC).
+ * `seed-cli.mjs`'s own `encryptSeedPii` needs this exported here because the
+ * seed CLI writes directly to Firestore and does not go through any
+ * repository's `createWithId` — see the 🛑 on `PayoutRepository`'s
+ * `buildTokensIndexFor` for why that bypass is the one that matters.
+ */
+export { buildTokensIndex, tokensIndexQueryValue, BLIND_INDEX_KEY_VERSION_FIELD, CURRENT_BLIND_INDEX_KEY_VERSION, } from "./security/blind-index-tokens.js";
+// Tier 2 — viewer-scoped sources. Server-only by construction: they build an
+// owner clause from a session, and a client that could construct them could
+// construct somebody else's.
+export { scopedSourcesFor, scopedScanTotal, assertWithinScopedBudget, } from "./_internal/server/features/search/scoped-sources.js";
 // D12 — part + composition reads. Every one is by document id or ONE
 // indexed equality; none needs a composite index.
 export { getPartByKey, getModelsUsingPart, getCompositionById, getPartsForComposition, getCompositionsForCategory, listPartsBySlot, } from "./_internal/server/features/parts/data.js";
@@ -73,9 +88,6 @@ export { DEFAULT_CATEGORIES } from "./seed/index.js";
 // DEFAULT_FAQS - Constant used across modules.
 export { DEFAULT_FAQS } from "./seed/index.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// DEFAULT_HOMEPAGE_SECTIONS - Constant used across modules.
-export { DEFAULT_HOMEPAGE_SECTIONS } from "./seed/index.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // NOTIFICATION_FIXTURES - Constant used across modules.
 export { NOTIFICATION_FIXTURES } from "./seed/index.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
@@ -193,9 +205,6 @@ export { makeFullStore } from "./seed/index.js";
 // makeFullUser - Shared export for make full user.
 export { makeFullUser } from "./seed/index.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// makeHomepageSection - Shared export for make homepage section.
-export { makeHomepageSection } from "./seed/index.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // makeNotification - Shared export for make notification.
 export { makeNotification } from "./seed/index.js";
 export { sendNotification } from "./features/admin/actions/notification-actions.js";
@@ -815,7 +824,16 @@ export { getRelatedEvents } from "./features/events/server.js";
 // updateEvent - Helper for update event.
 export { updateEvent } from "./features/events/server.js";
 // [SERVER-ONLY] SB9-H — manual trigger + spin actions
-export { triggerEventRaffleAction, assignSpinPrizeAction, } from "./_internal/server/features/raffle/actions.js";
+export { triggerEventRaffleAction, assignSpinPrizeAction, 
+// resolveEventIdAction — slug-or-id → canonical doc id, so the spin route can
+// scope a guest's identity hash to a stable key (see the action's own note).
+resolveEventIdAction, } from "./_internal/server/features/raffle/actions.js";
+/*
+ * [SERVER-ONLY] The ONE reason → {status, code} map for the two event
+ * prize-draw cores, shared by both API routes and both Firebase handlers.
+ * Four hand-written copies disagreed before this (Root Cause #85).
+ */
+export { reasonToHttp, EVENT_DRAW_REASON, } from "./_internal/server/jobs/core/event-draw-reasons.js";
 // [SERVER-ONLY] S-SBUNI-RULES — refund action (Razorpay + manual paths)
 export { processRefundAction, } from "./_internal/server/features/refunds/actions.js";
 // [SERVER-ONLY] Shared fee calculator — platform/gateway/GST/COD handling/WhatsApp-addon fee math.
@@ -827,7 +845,7 @@ export { computeCheckoutFees, computePayoutDeduction, computeCodHandlingFee, com
 // only: it reads Firestore through two repositories, so it must never reach
 // client.ts (verify-entries would catch firebase-admin, but the import chain
 // is the thing to keep clean — Root Cause #6).
-export { searchPriceIndex, PRICE_INDEX_SEARCH_LIMIT, PRICE_INDEX_MIN_QUERY_LENGTH } from "./_internal/server/features/price-index/search.js";
+export { searchPriceIndex, getPriceIndexBandsForIds, PRICE_INDEX_SEARCH_LIMIT, PRICE_INDEX_MIN_QUERY_LENGTH } from "./_internal/server/features/price-index/search.js";
 export { protectionAvailability, computeProtectionFees, adjudicateClaim, badgesFor, showsRiskNotice, showsSafetyBadge, returnDestination, rtoDestination, PROTECTION_KINDS, } from "./_internal/shared/features/shipping/protections.js";
 // [SERVER-ONLY] Payout refund deduction action
 export { applyRefundDeductionAction, } from "./_internal/server/features/payouts/actions.js";
@@ -915,18 +933,6 @@ export { getCarouselSlideById } from "./features/homepage/server.js";
 // getHomepageSectionById - Helper for get homepage section by id.
 export { getHomepageSectionById } from "./features/homepage/server.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// homepageGET - Shared export for homepage get.
-export { homepageGET } from "./features/homepage/server.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// homepageSectionItemDELETE - Shared export for homepage section item delete.
-export { homepageSectionItemDELETE } from "./features/homepage/server.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// homepageSectionItemGET - Shared export for homepage section item get.
-export { homepageSectionItemGET } from "./features/homepage/server.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// homepageSectionItemPATCH - Shared export for homepage section item patch.
-export { homepageSectionItemPATCH } from "./features/homepage/server.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // listActiveCarouselSlides - Helper for list active carousel slides.
 export { listActiveCarouselSlides } from "./features/homepage/server.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
@@ -1108,12 +1114,6 @@ export { updateReview } from "./features/reviews/server.js";
 // voteReviewHelpful - Shared export for vote review helpful.
 export { voteReviewHelpful } from "./features/reviews/server.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// searchGET - Shared export for search get.
-export { searchGET } from "./features/search/server.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
-// searchProducts - Shared export for search products.
-export { searchProducts } from "./features/search/server.js";
-// [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // acceptCounterOffer - Shared export for accept counter offer.
 export { acceptCounterOffer } from "./features/seller/server.js";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
@@ -1320,8 +1320,6 @@ export { encryptPayoutDetails } from "./security/index.js";
 export { decryptPayoutDetails } from "./security/index.js";
 export { encryptShippingConfig } from "./security/index.js";
 export { decryptShippingConfig } from "./security/index.js";
-export { encryptPayoutBankAccount } from "./security/index.js";
-export { decryptPayoutBankAccount } from "./security/index.js";
 export { maskName } from "./security/index.js";
 export { maskEmail } from "./security/index.js";
 export { maskPublicReview } from "./security/index.js";
@@ -1383,6 +1381,7 @@ export { toPublicGroupMember, toPublicGroupMembers, } from "./_internal/server/f
 export { getAuctionForDetail, getProductFeaturesForAuction } from "./_internal/server/features/auctions/index.js";
 export { getPreOrderForDetail, getProductFeaturesForPreOrder } from "./_internal/server/features/pre-orders/index.js";
 export { getStoreForDetail, listStoreProductsInitial, listStoreAuctionsInitial, listStorePreOrdersInitial, listSitemapStores } from "./_internal/server/features/stores/index.js";
+export { getDefaultStoreTabPath } from "./_internal/server/features/stores/tabs.js";
 // Public-store allow-list projection — the ONLY sanctioned way a StoreDocument
 // may reach a client component or an HTTP response. See adapters.ts header.
 export { toStoreDetail, toStoreListItem, PUBLIC_STORE_FIELDS, PRIVATE_STORE_FIELDS, } from "./_internal/server/features/stores/adapters.js";
@@ -1485,6 +1484,9 @@ export { signDigitalContentUpload, finalizeDigitalContentUpload, contentKindForM
  */
 export { createOrOpenConversation, openConversationWithSeller, listConversationsForUser, listMessagesForConversation, sendMessage, markConversationRead, blockConversationParticipant, softDeleteOwnMessage, mintChatEventToken, getUnreadConversationCount, deleteAllMessages as deleteAllConversationMessages, listAllAttachmentUrls as listConversationAttachmentUrls, stripPii as stripChatPii, } from "./_internal/server/features/messages/actions.js";
 export { resolveCodeAssetForOrder, codeAssetHeaders, CODE_DOWNLOAD_STATUSES, } from "./_internal/server/features/digital-code/download.js";
+// ── Statutory business documents — admin-only, encrypted at rest ────────────
+export { resolveBusinessDocument, } from "./_internal/server/features/business-documents/download.js";
+export { businessDocumentsRepository, BusinessDocumentsRepository, } from "./features/business-documents/repository/business-documents.repository.js";
 // ── Live-item listing — data + adapters + metadata + OG ──────────────────────
 export { getLiveItemForDetail } from "./_internal/server/features/live/data.js";
 export { toClientLiveItem } from "./_internal/server/features/live/adapters.js";
@@ -1495,6 +1497,7 @@ export { getLotteryEventCached, listLotteryEvents, getLotteryEntriesForAdmin, ge
 export { toClientLotterySlot, toClientLotteryConfig } from "./_internal/server/features/lottery/adapters.js";
 export { toPublicEvent, toClientSpinPrize } from "./_internal/server/features/events/adapters.js";
 export { buildLotteryMetadata } from "./_internal/server/features/lottery/metadata.js";
+export { renderLotteryOg, renderLotteryOgImage } from "./_internal/server/features/lottery/og.js";
 export { submitLotteryPullAction, flagLotteryEntryAction, reopenLotterySlotAction, createLotteryEventAction, updateLotteryEventAction, setProductLotteryModeAction, } from "./_internal/server/features/lottery/actions.js";
 export { lotteryEntryRepository } from "./features/lottery/repository/lottery-entry.repository.js";
 /*
@@ -1528,3 +1531,58 @@ export { RETURN_CUSTODY_STATES, RETURN_CUSTODY_COPY, isTerminalCustody, canAdvan
 export { resolveReturnAddress, RTO_ENTRY_CUSTODY, rtoCostBearer, RETURN_ABUSE_SCAM_TYPES, RETURN_ABUSE_THRESHOLDS, returnAbuseSignals, enforcementFor, } from "./_internal/shared/features/returns/destination.js";
 // C5f — courier ratings. Two numbers, never blended; see the module header.
 export { COURIER_RATING_MIN_CONFIDENT_SAMPLES, courierRatingDisplay, isValidCourierVote, courierVoteId, rollUpCourierVotes, } from "./_internal/shared/features/shipping/courier-rating.js";
+/*
+ * The sticker-trace pipeline handlers. Exported because the Function bindings
+ * in functions/src/ are their only callers and cannot reach `_internal/*`,
+ * which is deliberately not an exported subpath — the same public-API case as
+ * the ImageCodec port above.
+ *
+ * 🛑 Each *Deps interface ships WITH its handler. A caller that can import the
+ * handler but not its dependency shape has to hand-write that object, and a
+ * hand-written copy of a contract drifts from it (Root Cause #42, one layer up).
+ */
+export { runCoordinator } from "./_internal/server/features/sticker-trace/coordinator.js";
+export { runShard } from "./_internal/server/features/sticker-trace/shard.js";
+export { runFinalizer } from "./_internal/server/features/sticker-trace/finalizer.js";
+/*
+ * The sticker-trace storage adapters the Function bindings inject.
+ *
+ * `writeRunArtifact` already matched the handlers' `writeArtifact` dependency
+ * exactly, so there is no wrapper for it — a pass-through named differently
+ * would be a second name for one thing, and the next reader would have to
+ * check whether they differ.
+ */
+export { readScanBytes, readRunGeometry, writeRunArtifact, } from "./_internal/server/features/sticker-trace/storage.js";
+/*
+ * The part rasteriser factory. Exported rather than the raw
+ * `rasterizePathAlpha` because `ShardDeps.rasterise` is keyed on ORDINAL and
+ * carries no path — the factory is what closes that gap, and handing a consumer
+ * the primitive instead would make every binding re-invent the lookup.
+ */
+export { rasterisePartToBox } from "./_internal/shared/features/sticker-trace/math/rasterize-path.js";
+/*
+ * The sticker-trace ROUTE layer's server surface.
+ *
+ * 🛑 These go in the WIDE barrel, not in `./features/sticker-trace/server`.
+ * That narrow entry exists because a Cloud Function cannot bundle this barrel
+ * at all (it drags in react-server-dom-webpack and @vercel/og's wasm — Root
+ * Cause #18, caught by tsup rather than by review). Next.js route handlers are
+ * the opposite case: they already import this barrel, and adding them to the
+ * narrow entry would widen exactly the thing the narrow entry exists to keep
+ * small.
+ *
+ * Each from its DEFINING module. The run lifecycle lives in `actions.ts`, the
+ * sheet lifecycle in `sheet-actions.ts`, and the projections in `adapters.ts`.
+ */
+export { startStickerTraceRun, retryStickerTraceRun, listStickerTraceRuns, } from "./_internal/server/features/sticker-trace/actions.js";
+export { buildCutFileForRun, buildCutFileBytes, } from "./_internal/server/features/sticker-trace/build-cut-file.js";
+export { promoteStickerTraceRun, isRunPromoted, } from "./_internal/server/features/sticker-trace/promote.js";
+export { createStickerSheet, attachStickerSheetScan, resolveStickerAssetUrl, measureStickerStorage, STICKER_ASSET_KINDS, STICKER_SHEET_MAX_BYTES, } from "./_internal/server/features/sticker-trace/sheet-actions.js";
+/*
+ * 🛑 A different module from `sheet-actions` on purpose. `promoteRun` there is
+ * run → sheet (render the full-res parts); this is sheet → marketplace (create
+ * the products). The names are close enough that keeping them in one file is
+ * how someone calls the wrong one.
+ */
+export { promoteStickerSheetToListings, } from "./_internal/server/features/sticker-trace/promote-to-listings.js";
+export { toClientStickerSheet, toClientTraceRun, } from "./_internal/server/features/sticker-trace/adapters.js";