@mohasinac/appkit 4.62.1 → 4.63.0

package/dist/security/pii-schemas.js

@@ -41,6 +41,51 @@ export const ORDER_PII_FIELDS = [
     "userName",
     "userEmail",
     "sellerEmail",
+    /*
+     * ── The delivery snapshot (Part 14) ──────────────────────────────────────
+     *
+     * 🛑 **CORRECTED 2026-10-23.** These were first written as flat keys on the
+     * argument that "`encryptPiiFields` is a flat top-level loop that never
+     * descends" — CLAUDE.md's wording, and it is FALSE. Read the function: it
+     * handles dotted paths (`lastMessage.body`, already live above) AND
+     * `array[].key` via `encryptInArray`, in both directions.
+     *
+     * Flat keys stay, on a smaller and true argument: city / state / pincode /
+     * country must remain unencrypted and QUERYABLE, so a single
+     * `deliveryAddress` object would be half-encrypted — and a half-encrypted
+     * object is the shape nobody can reason about at a glance. Flat keys make
+     * each field's treatment visible in this list.
+     *
+     * What the encryptor does NOT do is infer. A field is covered only if it is
+     * NAMED, in the right notation — and `"fullName"` does not cover
+     * `deliveryAmendments[].fullName`. That is the real failure mode, and what
+     * `audit-snapshot-integrity` R1 checks.
+     *
+     * 🛑 `shippingAddress` is deliberately NOT added. It is legacy free text on
+     * existing rows; encrypting the field now would encrypt it on the next
+     * write of an old order while every other old row stays plaintext, giving
+     * one field two formats and no way to tell which a given row holds.
+     * Forward-only means the new fields carry the protection.
+     *
+     * city / state / pincode / country are absent on purpose — they decide tax
+     * and serviceability and must stay QUERYABLE.
+     */
+    "deliveryFullName",
+    "deliveryPhone",
+    "deliveryAddressLine1",
+    "deliveryAddressLine2",
+    "deliveryLandmark",
+    /*
+     * The amendment array, in the `array[].key` notation `encryptInArray`
+     * implements. Declared HERE rather than encrypted by hand at the write
+     * site: the repository's write hook already runs this list, and a second
+     * mechanism doing the same job is the drift this codebase keeps paying for.
+     */
+    "deliveryAmendments[].fullName",
+    "deliveryAmendments[].phone",
+    "deliveryAmendments[].addressLine1",
+    "deliveryAmendments[].addressLine2",
+    "deliveryAmendments[].landmark",
 ];
 /** PII fields in payouts */
 export const PAYOUT_PII_FIELDS = ["sellerEmail", "upiId"];

package/dist/server.d.ts

@@ -429,6 +429,8 @@ export { piiBlindIndex } from "./security/index";
 export { piiIndicesFor } from "./security/index";
 export { reserveUserSlug, userSlugBase, USER_SLUGS_COLLECTION } from "./features/auth/actions/user-slug";
 export { resolveProfileUser } from "./features/auth/actions/profile-actions";
+export { getBuyerActivityStats, getProfileStats, } from "./features/auth/actions/profile-actions";
+export type { BuyerActivityStats } from "./features/auth/actions/profile-actions";
 export { getPiiConfigError } from "./security/index";
 export { encryptPayoutDetails } from "./security/index";
 export { decryptPayoutDetails } from "./security/index";
@@ -574,7 +576,7 @@ export { REFUND_COPY } from "./_internal/shared/features/orders/refund-copy";
 export { RETURN_REASON, FINAL_SALE_EXEMPT_REASONS, RETURN_REASON_LABEL, RETURN_REASON_GROUP_LABEL, isFinalSaleExempt, isReturnReason, selectableReturnReasons, } from "./_internal/shared/features/orders/return-reasons";
 export type { ReturnReason } from "./_internal/shared/features/orders/return-reasons";
 export { INTEGRATIONS, INTEGRATION_ORDER, readIntegrationStates, integrationPatch, allIntegrationsPatch, } from "./_internal/shared/features/admin/integrations";
-export type { IntegrationId, IntegrationDescriptor, IntegrationState, } from "./_internal/shared/features/admin/integrations";
+export type { IntegrationId, IntegrationDescriptor, IntegrationState, IntegrationPatch, } from "./_internal/shared/features/admin/integrations";
 export { draftToProductInput, productToDraft, } from "./features/seller/utils/product-draft-mapping";
 export { RETURN_CUSTODY_STATES, RETURN_CUSTODY_COPY, isTerminalCustody, canAdvanceCustody, nextCustodyState, custodyOwner, isActionableBy, } from "./_internal/shared/features/returns/custody";
 export type { ReturnCustodyState } from "./_internal/shared/features/returns/custody";
@@ -613,3 +615,27 @@ export { financialYearLabel, formatSeriesNumber, INVOICE_PREFIX, CREDIT_NOTE_PRE
 export type { InvoiceCounterDocument, InvoiceAllocationDocument, InvoiceSeriesKind, } from "./features/invoicing/schemas/firestore";
 export { buildGstr1Export, gstr1ToCsv, type Gstr1Export, type Gstr1Row, } from "./_internal/server/features/invoicing/gstr1";
 export { quoteSharedPurchase, countDestinations, type SharedPurchaseRates, type SharedPurchaseQuote, type SharedPurchaseQuoteInput, } from "./_internal/shared/features/shipping/shared-purchase";
+export { RATE_REGISTRY, RATE_TIER_ORDER, rateByPath, canEditRate, rejectRateChange, type RateDescriptor, type RateTier, type RateUnit, type RateChange, } from "./_internal/shared/features/pricing/rate-registry";
+export { applyRateChange, RATE_CHANGE_LOG_MAX, type ApplyRateChangeInput, type ApplyRateChangeResult, } from "./_internal/server/features/pricing/actions";
+export { SHARED_PURCHASE_MAX_MEMBERS, rejectCoordination, destinationIds, type CoordinationMember, type OfferCoordination, } from "./_internal/shared/features/offers/coordination";
+export { assertOwnedAddresses } from "./_internal/server/features/offers/destinations";
+export { checkDestinations, assertAllServiceable, planParcels, type DestinationCheck, type ParcelPlan, } from "./_internal/server/features/shipping/book-split";
+export { snapshotDeliveryAddress, deliveryPartyFor, placeOfSupplyFrom, type DeliverySnapshot, type DeliveryParty, } from "./_internal/shared/features/orders/delivery-snapshot";
+export { amendDeliveryAddress, revealAmendments, DELIVERY_AMENDMENT_MAX, type AmendDeliveryInput, } from "./_internal/server/features/orders/amend-delivery";
+export { bookShipment, type BookShipmentInput, type BookShipmentResult, } from "./_internal/server/features/shipping/book";
+export { journalRepository, JournalRepository, JOURNAL_PERIOD_SCAN_LIMIT } from "./features/ledger/repository/journal.repository";
+export { assertBalanced, buildReversal, resolvePostingPeriod, periodOf, UnbalancedEntryError, BALANCE_TOLERANCE, type PostingInput, type BalancedPosting, } from "./_internal/shared/features/ledger/posting";
+export { trialBalance, profitAndLoss, signedBalance, type TrialBalance, type ProfitAndLoss, type AccountTotals, } from "./_internal/shared/features/ledger/reports";
+export { ACCOUNT, orderPlacedPosting, settlementPosting, payoutPosting, refundPosting, type OrderPostingInput, type SettlementPostingInput, type PayoutPostingInput, type RefundPostingInput, expensePosting, type ExpensePostingInput, } from "./_internal/shared/features/ledger/rules";
+export { VENDORS_COLLECTION, EXPENSES_COLLECTION, EXPENSE_FIELDS, type VendorDocument, type ExpenseDocument, type ExpenseCategory, } from "./features/ledger/schemas/expenses";
+export { BALANCE_WINDOW_DAYS, balanceDueOn, openBalanceCollection, submitBalanceProof, reviewBalanceProof, } from "./_internal/server/features/orders/balance";
+export { reserveStock, releaseReservation, releaseReservationsForHolder, consumeReservation, expireDueReservations, activeReservationsForProduct, } from "./_internal/server/features/inventory/reservations";
+export type { ReserveStockInput } from "./_internal/server/features/inventory/reservations";
+export { RESERVATION_DEFAULT_TTL_HOURS, RESERVATION_MAX_TTL_HOURS, RESERVATION_HOLDER_KINDS, RESERVATION_STATUSES, STOCK_RESERVATION_COLLECTION, isReservationActive, } from "./features/inventory/schemas/stock-reservation";
+export type { ReservationHolderKind, ReservationStatus, StockReservationDocument, } from "./features/inventory/schemas/stock-reservation";
+export { assertCheckoutValueOtp } from "./_internal/server/features/checkout/value-otp-gate";
+export type { CheckoutValueOtpGateInput } from "./_internal/server/features/checkout/value-otp-gate";
+export { bookAdSlot, moderateAdCreative, resubmitAdCreative, cancelAdBooking, releaseAdSlot, liveBookingForPlacement, pendingAdBookings, adBookingsForAdvertiser, adSlotOffers, } from "./_internal/server/features/ads/booking";
+export type { BookAdSlotInput, AdSlotOffer } from "./_internal/server/features/ads/booking";
+export { AD_BOOKING_COLLECTION, AD_BOOKING_PAYMENT_STATES, AD_MODERATION_STATES, adBookingId, adPeriodOf, adPeriodStart, adPeriodEnd, isAdPeriod, isAdBookingLive, } from "./features/ads/schemas/firestore";
+export type { AdBookingDocument, AdBookingCreative, AdBookingPaymentState, AdModerationState, AdPeriod, } from "./features/ads/schemas/firestore";

package/dist/server.js

@@ -1327,6 +1327,7 @@ export { piiBlindIndex } from "./security/index.js";
 export { piiIndicesFor } from "./security/index.js";
 export { reserveUserSlug, userSlugBase, USER_SLUGS_COLLECTION } from "./features/auth/actions/user-slug.js";
 export { resolveProfileUser } from "./features/auth/actions/profile-actions.js";
+export { getBuyerActivityStats, getProfileStats, } from "./features/auth/actions/profile-actions.js";
 export { getPiiConfigError } from "./security/index.js";
 export { encryptPayoutDetails } from "./security/index.js";
 export { decryptPayoutDetails } from "./security/index.js";
@@ -1676,3 +1677,146 @@ export { buildGstr1Export, gstr1ToCsv, } from "./_internal/server/features/invoi
  * settings read; the rates are passed in snapshotted.
  */
 export { quoteSharedPurchase, countDestinations, } from "./_internal/shared/features/shipping/shared-purchase.js";
+/*
+ * [SERVER-ONLY] The pricing registry and its one write path.
+ *
+ * 🛑 The REGISTRY is pure data with no Firestore and no `node:` import, so it
+ * could sit in the main barrel — and deliberately does not. Its only consumer
+ * outside appkit is `/api/admin/pricing`, and putting it in `index.ts` would
+ * add sixteen descriptors and four symbols to every client bundle that imports
+ * anything at all, to serve one route (Root Cause #18 — a re-export is a
+ * public API contract, not a convenience).
+ *
+ * `applyRateChange` belongs here regardless: it reaches firebase-admin.
+ */
+export { RATE_REGISTRY, RATE_TIER_ORDER, rateByPath, canEditRate, rejectRateChange, } from "./_internal/shared/features/pricing/rate-registry.js";
+export { applyRateChange, RATE_CHANGE_LOG_MAX, } from "./_internal/server/features/pricing/actions.js";
+/*
+ * [SERVER-ONLY] Coordinated purchase — a SPECIALISED OFFER, not a new flow.
+ *
+ * `assertOwnedAddresses` is the one piece that must run server-side: a
+ * destination is a REFERENCE, and an id is guessable in a way an address is
+ * not, so an unverified one ships a parcel to a stranger's house with nothing
+ * erroring. The shared half (the member shape, the member-count rule) is pure
+ * and could sit in the main barrel — it stays here beside its checker so a
+ * caller cannot reach for one without meeting the other.
+ */
+export { SHARED_PURCHASE_MAX_MEMBERS, rejectCoordination, destinationIds, } from "./_internal/shared/features/offers/coordination.js";
+export { assertOwnedAddresses } from "./_internal/server/features/offers/destinations.js";
+/*
+ * S5a — N destinations is N parcels, so N carrier quotes.
+ *
+ * 🛑 `checkDestinations` + `assertAllServiceable` are a PRE-FLIGHT and are
+ * exported as a pair for that reason: booking as you go and failing on the
+ * fourth leaves three parcels the carrier has already accepted and the
+ * coordinator cannot undo. It is not a transaction — a booking has no
+ * rollback — it just moves the common failure to the point where rolling
+ * back is still free.
+ */
+export { checkDestinations, assertAllServiceable, planParcels, } from "./_internal/server/features/shipping/book-split.js";
+/*
+ * [SERVER-ONLY] Part 14 — the delivery snapshot and its corrections.
+ *
+ * `amendDeliveryAddress` is server-only (Firestore + the addresses
+ * repository). The pure readers ship with it rather than from the main
+ * barrel so a caller cannot reach `deliveryPartyFor` without the module that
+ * explains why it reads the amendment while `placeOfSupplyFrom` reads the
+ * snapshot — getting those two the wrong way round sends a parcel to the old
+ * address, or restates tax on a filed invoice.
+ */
+export { snapshotDeliveryAddress, deliveryPartyFor, placeOfSupplyFrom, } from "./_internal/shared/features/orders/delivery-snapshot.js";
+export { amendDeliveryAddress, revealAmendments, DELIVERY_AMENDMENT_MAX, } from "./_internal/server/features/orders/amend-delivery.js";
+/*
+ * [SERVER-ONLY] Part 1′ — parcel booking.
+ *
+ * 🛑 Exported for the ENQUEUE route only. The booking itself runs in the
+ * `bookShipment` job runner, because a carrier call on a 10s sync ceiling
+ * times out in the one way that cannot be retried safely: the carrier may
+ * have accepted, so a retry double-books and a non-retry leaves a parcel
+ * nobody collects.
+ */
+export { bookShipment, } from "./_internal/server/features/shipping/book.js";
+/*
+ * [SERVER-ONLY] Part 4 — the double-entry books.
+ *
+ * 🛑 The repository is server-only (Firestore), and the posting rules ship
+ * beside it rather than from the main barrel even though they are pure: a
+ * caller who can reach `assertBalanced` without reaching `journalRepository`
+ * can compute a balanced entry and write it some other way, which is exactly
+ * the "every entry is machine-generated through one path" constraint the
+ * whole design rests on. Same stance `assertOwnedAddresses` takes.
+ *
+ * 🛑 The LEDGER IS A PROJECTION. Orders, payouts and expenses are truth —
+ * never read a balance to make an operational decision.
+ */
+export { journalRepository, JournalRepository, JOURNAL_PERIOD_SCAN_LIMIT } from "./features/ledger/repository/journal.repository.js";
+export { assertBalanced, buildReversal, resolvePostingPeriod, periodOf, UnbalancedEntryError, BALANCE_TOLERANCE, } from "./_internal/shared/features/ledger/posting.js";
+export { trialBalance, profitAndLoss, signedBalance, } from "./_internal/shared/features/ledger/reports.js";
+/*
+ * The per-event posting rules. These are WHERE the "every entry is
+ * machine-generated" constraint lives — a caller posts an order by handing
+ * `orderPlacedPosting(order)` to `journalRepository.post`, never by writing
+ * legs. A backwards entry balances, so nothing downstream would object;
+ * `verify-posting-rules` R7 checks the SIDES, with controls proving it
+ * catches a credited bank, an un-reclaimed refund GST and an inverted
+ * output-GST liability.
+ */
+export { ACCOUNT, orderPlacedPosting, settlementPosting, payoutPosting, refundPosting, expensePosting, } from "./_internal/shared/features/ledger/rules.js";
+/*
+ * Vendors and expenses. `ShipmentDocument.supplierId` joins to a vendor row;
+ * `supplierName` stays as typed, because deriving the name on read would let
+ * a vendor rename rewrite what every past shipment says it was bought from.
+ */
+export { VENDORS_COLLECTION, EXPENSES_COLLECTION, EXPENSE_FIELDS, } from "./features/ledger/schemas/expenses.js";
+/*
+ * [SERVER-ONLY] D55 — the pre-order balance collector.
+ *
+ * `balanceDue` has been computed and rendered since Part 2 with nothing to
+ * collect it. These three are the whole collection path: the seller opens it
+ * when stock lands, the buyer submits a proof, staff review it. Manual only —
+ * the auto path is blocked on RBI mandate requirements, not on effort.
+ */
+export { BALANCE_WINDOW_DAYS, balanceDueOn, openBalanceCollection, submitBalanceProof, reviewBalanceProof, } from "./_internal/server/features/orders/balance.js";
+/*
+ * [SERVER-ONLY] Stock reservation with a TTL.
+ *
+ * A hold on units that is NOT an order. The only mechanism before this was
+ * `onOrderCreate`'s decrement plus `pendingOrderTimeout`'s 15-minute restore,
+ * both keyed to an order — which cannot serve a multi-day shared purchase
+ * without either starting a payment clock on day one or letting an ordinary
+ * buyer take the item out from under the arrangement.
+ *
+ * 🛑 Every one of these moves the reservation row and `availableQuantity`
+ * inside ONE transaction. A caller that writes either half itself has
+ * reintroduced exactly the drift this primitive exists to remove.
+ */
+export { reserveStock, releaseReservation, releaseReservationsForHolder, consumeReservation, expireDueReservations, activeReservationsForProduct, } from "./_internal/server/features/inventory/reservations.js";
+export { RESERVATION_DEFAULT_TTL_HOURS, RESERVATION_MAX_TTL_HOURS, RESERVATION_HOLDER_KINDS, RESERVATION_STATUSES, STOCK_RESERVATION_COLLECTION, isReservationActive, } from "./features/inventory/schemas/stock-reservation.js";
+/*
+ * [SERVER-ONLY] The high-value checkout OTP gate.
+ *
+ * 🛑 It takes the AMOUNT it judges. There were two hand-rolled copies of
+ * this rule — `createOrderForGroup` summing the cart, the gateway route
+ * using its own `subtotalRs` — which is Root Cause #75's shape, and they
+ * had already drifted on what they measured.
+ *
+ * Taking the amount is also Part 6's prerequisite: `otpCheckoutThreshold`
+ * is per CHECKOUT, so an N-party arrangement clears ₹12,000 in three
+ * ₹4,000 pieces with no OTP unless it can present its own total.
+ */
+export { assertCheckoutValueOtp } from "./_internal/server/features/checkout/value-otp-gate.js";
+/*
+ * [SERVER-ONLY] D56 — self-serve ad bookings.
+ *
+ * 🛑 Availability is a DOCUMENT COLLISION, never a query. The booking id
+ * is `${placementId}__${period}` and creation uses `tx.create`, so a second
+ * booking of the same slot fails on an existing document inside its own
+ * transaction. Query-then-write would let two concurrent requests both read
+ * "free" and sell the slot twice, with nothing erroring.
+ *
+ * 🛑 Flat fee per period, explicitly NOT CPM — impression counting is a
+ * write per page view, which is the cost pattern that suspended this
+ * project (Root Cause #104).
+ */
+export { bookAdSlot, moderateAdCreative, resubmitAdCreative, cancelAdBooking, releaseAdSlot, liveBookingForPlacement, pendingAdBookings, adBookingsForAdvertiser, adSlotOffers, } from "./_internal/server/features/ads/booking.js";
+export { AD_BOOKING_COLLECTION, AD_BOOKING_PAYMENT_STATES, AD_MODERATION_STATES, adBookingId, adPeriodOf, adPeriodStart, adPeriodEnd, isAdPeriod, isAdBookingLive, } from "./features/ads/schemas/firestore.js";