orbitx-core-models 11.175.0 → 11.176.0

package/dist/helpers/invoiceDocument.d.ts

@@ -0,0 +1,63 @@
+/** Who the invoice is from (owner, 2026-09-29). */
+export declare const INVOICE_ISSUER: {
+    name: string;
+    addressLines: string[];
+    email: string;
+};
+/** The statuses a client can see; drafts and invoices waiting for approval stay inside Ops. */
+export declare const CLIENT_VISIBLE_INVOICE_STATUSES: string[];
+/** Approved invoices are charged together on the 5th of the month. */
+export declare function nextInvoiceChargeDate(from?: Date): Date;
+export declare function createInvoiceDocuments({ stripe }: {
+    stripe: any;
+}): {
+    ISSUER: {
+        name: string;
+        addressLines: string[];
+        email: string;
+    };
+    nextInvoiceNumber: (at?: Date) => Promise<string>;
+    ensureInvoiceNumber: (invoice: any) => Promise<string>;
+    nextChargeDate: typeof nextInvoiceChargeDate;
+    buildInvoiceDocument: (invoiceId: any, { companyId, clientView }?: {
+        companyId?: any;
+        clientView?: boolean;
+    }) => Promise<{
+        invoice: {
+            _id: any;
+            number: string;
+            status: any;
+            issueDate: any;
+            periodStart: any;
+            periodEnd: any;
+            subtotal: any;
+            adjustments: any;
+            totalDue: any;
+            approvedAt: any;
+            paidAt: any;
+            chargeDate: Date | null;
+            stripeInvoiceUrl: any;
+        };
+        from: {
+            name: string;
+            addressLines: string[];
+            email: string;
+        };
+        billTo: {
+            name: any;
+            companyId: any;
+            address: any;
+            city: any;
+            state: any;
+            zip: any;
+            country: any;
+            email: any;
+        };
+        items: any;
+        card: {
+            brand: any;
+            last4: any;
+        } | null;
+    }>;
+};
+//# sourceMappingURL=invoiceDocument.d.ts.map

package/dist/helpers/invoiceDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoiceDocument.d.ts","sourceRoot":"","sources":["../../src/helpers/invoiceDocument.ts"],"names":[],"mappings":"AAaA,mDAAmD;AACnD,eAAO,MAAM,cAAc;;;;CAI1B,CAAC;AAEF,+FAA+F;AAC/F,eAAO,MAAM,+BAA+B,UAA8D,CAAC;AAE3G,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,IAAI,OAAa,GAAG,IAAI,CAI7D;AAED,wBAAgB,sBAAsB,CAAC,EAAE,MAAM,EAAE,EAAE;IAAE,MAAM,EAAE,GAAG,CAAA;CAAE;;;;;;sCAOb,OAAO,CAAC,MAAM,CAAC;mCAOtB,GAAG,KAAG,OAAO,CAAC,MAAM,CAAC;;sCAmClB,GAAG,8BAAqC;QAAE,SAAS,CAAC,EAAE,GAAG,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoEjI"}

package/dist/helpers/invoiceDocument.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_VISIBLE_INVOICE_STATUSES = exports.INVOICE_ISSUER = void 0;
+exports.nextInvoiceChargeDate = nextInvoiceChargeDate;
+exports.createInvoiceDocuments = createInvoiceDocuments;
+/**
+ * The invoice as a document: what the invoice page in Ops and the Client dashboard shows (and what prints as the
+ * PDF), plus invoice numbers. Shared by the Ops and Client backends; each passes its Stripe client:
+ *   const invoices = createInvoiceDocuments({ stripe });
+ *   invoices.buildInvoiceDocument(invoiceId)                                   // Ops: any invoice
+ *   invoices.buildInvoiceDocument(invoiceId, { companyId, clientView: true })  // Client: its own, past approval
+ */
+const company_model_1 = require("../models/company.model");
+const counter_model_1 = require("../models/counter.model");
+const invoice_model_1 = require("../models/invoice.model");
+const leadLedger_model_1 = require("../models/leadLedger.model");
+const errors_1 = require("./errors");
+/** Who the invoice is from (owner, 2026-09-29). */
+exports.INVOICE_ISSUER = {
+    name: "ORBITXPRO LLC",
+    addressLines: ["4926 Winding View Ln", "Humble, TX 77346"],
+    email: "billing@orbitxpro.com",
+};
+/** The statuses a client can see; drafts and invoices waiting for approval stay inside Ops. */
+exports.CLIENT_VISIBLE_INVOICE_STATUSES = ["approved", "pending_payment", "paid", "void", "disputed"];
+/** Approved invoices are charged together on the 5th of the month. */
+function nextInvoiceChargeDate(from = new Date()) {
+    const date = new Date(from.getFullYear(), from.getMonth(), 5, 12, 0, 0);
+    if (from.getDate() > 5)
+        date.setMonth(date.getMonth() + 1);
+    return date;
+}
+function createInvoiceDocuments({ stripe }) {
+    const InvoiceModel = invoice_model_1.Invoice;
+    const CompanyModel = company_model_1.Company;
+    const CounterModel = counter_model_1.Counter;
+    const LeadLedgerModel = leadLedger_model_1.LeadLedger;
+    /** "INV-2026-0001": sequential across OrbitXPro, starting again each year. */
+    async function nextInvoiceNumber(at = new Date()) {
+        const year = at.getFullYear();
+        const counter = await CounterModel.findByIdAndUpdate(`invoiceNumber_${year}`, { $inc: { seq: 1 } }, { new: true, upsert: true });
+        return `INV-${year}-${String(counter.seq).padStart(4, "0")}`;
+    }
+    /** Invoices made before numbering get theirs the first time they're shown. */
+    async function ensureInvoiceNumber(invoice) {
+        if (invoice.invoiceNumber)
+            return invoice.invoiceNumber;
+        const number = await nextInvoiceNumber(new Date(invoice.createdAt || Date.now()));
+        const updated = await InvoiceModel.findOneAndUpdate({ _id: invoice._id, invoiceNumber: { $exists: false } }, { $set: { invoiceNumber: number } }, { new: true }).lean();
+        if (updated === null || updated === void 0 ? void 0 : updated.invoiceNumber)
+            return updated.invoiceNumber;
+        const current = await InvoiceModel.findById(invoice._id).select("invoiceNumber").lean();
+        return (current === null || current === void 0 ? void 0 : current.invoiceNumber) || number;
+    }
+    async function cardFor(invoice, company) {
+        var _a, _b, _c, _d;
+        try {
+            if (invoice.stripeInvoiceId) {
+                const si = await stripe.invoices.retrieve(invoice.stripeInvoiceId, { expand: ["payment_intent.payment_method"] });
+                const card = (_b = (_a = si === null || si === void 0 ? void 0 : si.payment_intent) === null || _a === void 0 ? void 0 : _a.payment_method) === null || _b === void 0 ? void 0 : _b.card;
+                if (card)
+                    return { brand: card.brand, last4: card.last4 };
+            }
+            if (company === null || company === void 0 ? void 0 : company.stripeCustomerId) {
+                const customer = await stripe.customers.retrieve(company.stripeCustomerId, { expand: ["invoice_settings.default_payment_method"] });
+                const card = (_d = (_c = customer === null || customer === void 0 ? void 0 : customer.invoice_settings) === null || _c === void 0 ? void 0 : _c.default_payment_method) === null || _d === void 0 ? void 0 : _d.card;
+                if (card)
+                    return { brand: card.brand, last4: card.last4 };
+            }
+        }
+        catch (err) {
+            console.error(`[invoice] card for ${invoice._id} not read:`, err.message);
+        }
+        return null;
+    }
+    /**
+     * Everything the invoice page shows. `companyId` limits it to that company's own invoices; `clientView` also
+     * hides drafts/unapproved invoices and the Stripe link (Client dashboard).
+     */
+    async function buildInvoiceDocument(invoiceId, { companyId, clientView = false } = {}) {
+        var _a, _b;
+        const invoice = clientView
+            ? await InvoiceModel.findOne({ _id: invoiceId, companyId, status: { $in: exports.CLIENT_VISIBLE_INVOICE_STATUSES } }).lean().catch(() => null)
+            : await InvoiceModel.findById(invoiceId).lean().catch(() => null);
+        if (!invoice || (companyId && String(invoice.companyId) !== String(companyId)))
+            throw new errors_1.AppError("Invoice not found", 404);
+        const [company, number, entries] = await Promise.all([
+            CompanyModel.findById(invoice.companyId).select("contactInfo basicInfo.companyId stripeCustomerId").lean(),
+            ensureInvoiceNumber(invoice),
+            LeadLedgerModel.find({ invoiceId: invoice._id, status: { $ne: "discarded" } })
+                .sort({ createdAt: 1 })
+                .populate({ path: "leadId", select: "chatId data.name", populate: { path: "chatId", select: "chatId chatNumber" } })
+                .lean(),
+        ]);
+        const card = await cardFor(invoice, company);
+        const contact = (company === null || company === void 0 ? void 0 : company.contactInfo) || {};
+        const items = entries.map((e) => {
+            var _a, _b, _c;
+            const quantity = e.quantity || 1;
+            const sign = e.type === "deduct" ? -1 : 1;
+            let description;
+            if (e.type === "lead") {
+                const chat = (_a = e.leadId) === null || _a === void 0 ? void 0 : _a.chatId;
+                const ref = (chat === null || chat === void 0 ? void 0 : chat.chatId) || ((chat === null || chat === void 0 ? void 0 : chat.chatNumber) != null ? String(chat.chatNumber) : "");
+                const name = (_c = (_b = e.leadId) === null || _b === void 0 ? void 0 : _b.data) === null || _c === void 0 ? void 0 : _c.name;
+                description = `Lead${ref ? ` ${ref}` : ""}${name ? ` · ${name}` : ""}`;
+            }
+            else {
+                description = e.note || (e.type === "add" ? "Additional charge" : "Credit");
+            }
+            return { date: e.createdAt, type: e.type, description, quantity, unitPrice: e.unitPrice, amount: sign * e.unitPrice * quantity };
+        });
+        const chargeStatuses = clientView ? ["approved"] : ["draft", "pending_approval", "approved"];
+        return {
+            invoice: {
+                _id: invoice._id,
+                number,
+                status: invoice.status,
+                issueDate: invoice.createdAt,
+                periodStart: invoice.billingPeriodStart,
+                periodEnd: invoice.billingPeriodEnd,
+                subtotal: invoice.subtotal,
+                adjustments: invoice.adjustments,
+                totalDue: invoice.totalDue,
+                approvedAt: invoice.approvedAt || null,
+                paidAt: invoice.paidAt || null,
+                chargeDate: chargeStatuses.includes(invoice.status)
+                    ? nextInvoiceChargeDate(invoice.approvedAt ? new Date(invoice.approvedAt) : new Date())
+                    : null,
+                stripeInvoiceUrl: clientView ? null : invoice.stripeInvoiceUrl || null,
+            },
+            from: exports.INVOICE_ISSUER,
+            billTo: {
+                name: contact.officialBusinessName || ((_a = company === null || company === void 0 ? void 0 : company.basicInfo) === null || _a === void 0 ? void 0 : _a.companyId) || "",
+                companyId: ((_b = company === null || company === void 0 ? void 0 : company.basicInfo) === null || _b === void 0 ? void 0 : _b.companyId) || "",
+                address: contact.address || "",
+                city: contact.city || "",
+                state: contact.state || "",
+                zip: contact.zipcode || "",
+                country: contact.country || "",
+                email: contact.email || "",
+            },
+            items,
+            card,
+        };
+    }
+    return { ISSUER: exports.INVOICE_ISSUER, nextInvoiceNumber, ensureInvoiceNumber, nextChargeDate: nextInvoiceChargeDate, buildInvoiceDocument };
+}

package/dist/helpers/myUpdates.d.ts

@@ -0,0 +1,16 @@
+export declare function createMyUpdatesController({ dashboard, audience, ownerKey, sse }: {
+    dashboard: string;
+    audience: string;
+    ownerKey: string;
+    sse: {
+        addClient: (res: any) => void;
+        removeClient: (res: any) => void;
+    };
+}): {
+    getMyUpdates: (req: any, res: any, next: any) => void;
+    markRead: (req: any, res: any, next: any) => void;
+    markAllRead: (req: any, res: any, next: any) => void;
+    markReadByLink: (req: any, res: any, next: any) => void;
+    streamUpdates: (req: any, res: any) => void;
+};
+//# sourceMappingURL=myUpdates.d.ts.map

package/dist/helpers/myUpdates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"myUpdates.d.ts","sourceRoot":"","sources":["../../src/helpers/myUpdates.ts"],"names":[],"mappings":"AAYA,wBAAgB,yBAAyB,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE;QAAE,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;QAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAA;KAAE,CAAC;CAC1E;;;;;yBA2D6B,GAAG,OAAO,GAAG;EAyB1C"}

package/dist/helpers/myUpdates.js

@@ -0,0 +1,94 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMyUpdatesController = createMyUpdatesController;
+/**
+ * A portal user's Updates feed (the bell/Updates page): list with unread counts, mark read, mark all read, mark
+ * read by link, and the live "something changed" stream. Shared by the Client and Partner backends:
+ *   module.exports = createMyUpdatesController({ dashboard: "client", audience: "company", ownerKey: "companyId", sse });
+ *   module.exports = createMyUpdatesController({ dashboard: "partner", audience: "partner", ownerKey: "partnerId", sse });
+ * `sse` is the backend's own stream service ({ addClient(res), removeClient(res) }).
+ */
+const mongoose_1 = __importDefault(require("mongoose"));
+const update_model_1 = require("../models/update.model");
+const errors_1 = require("./errors");
+const _http_1 = require("./_http");
+function createMyUpdatesController({ dashboard, audience, ownerKey, sse }) {
+    const UpdateModel = update_model_1.Update;
+    // Mine: a broadcast to every user of this dashboard, something aimed at my whole account (company or partner),
+    // or aimed at me.
+    const myUpdatesQuery = (userId, ownerId) => ({
+        dashboard,
+        $or: [{ audience: "broadcast" }, { audience, [ownerKey]: ownerId }, { audience: "user", userId }],
+    });
+    const getMyUpdates = (0, _http_1.catchAsync)(async (req, res) => {
+        const query = myUpdatesQuery(req.user._id, req.user.owner);
+        const unreadQuery = { ...query, readBy: { $ne: req.user._id } };
+        const [updates, unreadCount, unreadGroups] = await Promise.all([
+            UpdateModel.find(query).sort({ createdAt: -1 }).limit(100).lean(),
+            UpdateModel.countDocuments(unreadQuery),
+            // Unread count per type, so the sidebar can badge Tickets and Requests separately from Updates.
+            UpdateModel.aggregate([{ $match: unreadQuery }, { $group: { _id: "$type", count: { $sum: 1 } } }]),
+        ]);
+        const unreadByType = Object.fromEntries(unreadGroups.map((g) => [g._id, g.count]));
+        res.status(_http_1.HTTP.OK).json({
+            success: true,
+            results: updates.length,
+            data: {
+                updates: updates.map((u) => ({
+                    ...u,
+                    isRead: (u.readBy || []).some((id) => String(id) === String(req.user._id)),
+                })),
+                unreadCount,
+                unreadByType,
+            },
+        });
+    });
+    const markRead = (0, _http_1.catchAsync)(async (req, res, next) => {
+        if (!mongoose_1.default.Types.ObjectId.isValid(req.params.id))
+            return next(new errors_1.AppError("Invalid update id", _http_1.HTTP.BAD_REQUEST));
+        const update = await UpdateModel.findByIdAndUpdate(req.params.id, { $addToSet: { readBy: req.user._id } }, { new: true });
+        if (!update)
+            return next(new errors_1.AppError("Update not found", _http_1.HTTP.NOT_FOUND));
+        res.status(_http_1.HTTP.OK).json({ success: true, message: "Marked read" });
+    });
+    const markAllRead = (0, _http_1.catchAsync)(async (req, res) => {
+        await UpdateModel.updateMany(myUpdatesQuery(req.user._id, req.user.owner), { $addToSet: { readBy: req.user._id } });
+        res.status(_http_1.HTTP.OK).json({ success: true, message: "All updates marked read" });
+    });
+    // Opening a ticket/request marks its updates read, so its sidebar badge clears. Body: { link: "/tickets/view/<id>" }.
+    const markReadByLink = (0, _http_1.catchAsync)(async (req, res, next) => {
+        var _a;
+        const link = typeof ((_a = req.body) === null || _a === void 0 ? void 0 : _a.link) === "string" ? req.body.link.trim() : "";
+        if (!link || link.length > 300)
+            return next(new errors_1.AppError("A link is required", _http_1.HTTP.BAD_REQUEST));
+        const result = await UpdateModel.updateMany({ ...myUpdatesQuery(req.user._id, req.user.owner), link, readBy: { $ne: req.user._id } }, { $addToSet: { readBy: req.user._id } });
+        res.status(_http_1.HTTP.OK).json({ success: true, data: { marked: result.modifiedCount || 0 } });
+    });
+    // A bare "something changed" ping; the page reacts by reloading its own feed.
+    const streamUpdates = (req, res) => {
+        res.writeHead(_http_1.HTTP.OK, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            Connection: "keep-alive",
+            "X-Accel-Buffering": "no",
+        });
+        res.write("\n");
+        sse.addClient(res);
+        const heartbeat = setInterval(() => {
+            try {
+                res.write(": ping\n\n");
+            }
+            catch {
+                clearInterval(heartbeat);
+            }
+        }, 25000);
+        req.on("close", () => {
+            clearInterval(heartbeat);
+            sse.removeClient(res);
+        });
+    };
+    return { getMyUpdates, markRead, markAllRead, markReadByLink, streamUpdates };
+}

package/dist/helpers/ownActivity.d.ts

@@ -0,0 +1,8 @@
+export declare function createOwnActivityController({ kind }: {
+    kind: "client" | "partner";
+}): {
+    getAccess: (req: any, res: any, next: any) => void;
+    listActivity: (req: any, res: any, next: any) => void;
+    recordExport: (req: any, res: any, next: any) => void;
+};
+//# sourceMappingURL=ownActivity.d.ts.map

package/dist/helpers/ownActivity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownActivity.d.ts","sourceRoot":"","sources":["../../src/helpers/ownActivity.ts"],"names":[],"mappings":"AA2BA,wBAAgB,2BAA2B,CAAC,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAA;CAAE;;;;EAmFnF"}

package/dist/helpers/ownActivity.js

@@ -0,0 +1,114 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOwnActivityController = createOwnActivityController;
+/**
+ * A portal's own Activity log: everything done on its account, by its own users and by OrbitXPro staff (HIPAA: an
+ * account must be able to see everyone who touched its data). Shown only after Ops turns on the account's access
+ * (activityLogAccess). Shared by the Client and Partner backends:
+ *   createOwnActivityController({ kind: "client" })   // Company accounts, logs filed under `company`
+ *   createOwnActivityController({ kind: "partner" })  // Partner accounts, logs filed under `partner`
+ */
+const mongoose_1 = __importDefault(require("mongoose"));
+const company_model_1 = require("../models/company.model");
+const partner_model_1 = require("../models/partner.model");
+const activityLog_model_1 = require("../models/activityLog.model");
+const recorder_1 = require("../activity/recorder");
+const errors_1 = require("./errors");
+const _http_1 = require("./_http");
+const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const list = (v) => String(v || "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+const KINDS = {
+    client: { Account: company_model_1.Company, field: "company", searchFields: ["actor.name", "actor.email", "details", "action", "record.label"] },
+    partner: { Account: partner_model_1.Partner, field: "partner", searchFields: ["actor.name", "actor.email", "details", "action"] },
+};
+function createOwnActivityController({ kind }) {
+    const { field, searchFields } = KINDS[kind];
+    const Account = KINDS[kind].Account;
+    const ActivityLogModel = activityLog_model_1.ActivityLog;
+    const accountIdOf = (req) => { var _a, _b, _c; return ((_b = (_a = req.user) === null || _a === void 0 ? void 0 : _a.owner) === null || _b === void 0 ? void 0 : _b._id) || ((_c = req.user) === null || _c === void 0 ? void 0 : _c.owner); };
+    const getAccess = (0, _http_1.catchAsync)(async (req, res) => {
+        const account = await Account.findById(accountIdOf(req)).select("activityLogAccess").lean();
+        res.status(_http_1.HTTP.OK).json({ success: true, data: { enabled: !!(account === null || account === void 0 ? void 0 : account.activityLogAccess) } });
+    });
+    const listActivity = (0, _http_1.catchAsync)(async (req, res, next) => {
+        const account = await Account.findById(accountIdOf(req)).select("activityLogAccess").lean();
+        if (!(account === null || account === void 0 ? void 0 : account.activityLogAccess)) {
+            return next(new errors_1.AppError("Your Activity log isn't turned on. Please ask OrbitXPro support to turn it on.", _http_1.HTTP.FORBIDDEN));
+        }
+        const q = req.query;
+        const page = Math.max(1, Number(q.page) || 1);
+        const limit = Math.min(200, Math.max(1, Number(q.limit) || 25));
+        const filter = { [field]: new mongoose_1.default.Types.ObjectId(String(account._id)) };
+        const actions = list(q.action);
+        if (actions.length)
+            filter.action = { $in: actions };
+        const outcomes = list(q.outcome).map((o) => o.toLowerCase());
+        if (outcomes.length)
+            filter.outcome = { $in: outcomes };
+        if (q.from || q.to) {
+            filter.at = {};
+            if (q.from)
+                filter.at.$gte = new Date(q.from);
+            if (q.to)
+                filter.at.$lte = new Date(q.to);
+        }
+        const and = [];
+        if (q.user)
+            and.push({ $or: ["actor.name", "actor.email"].map((f) => ({ [f]: { $regex: escape(String(q.user)), $options: "i" } })) });
+        if (q.details)
+            and.push({ details: { $regex: escape(String(q.details)), $options: "i" } });
+        if (q.search) {
+            const re = { $regex: escape(String(q.search)), $options: "i" };
+            and.push({ $or: searchFields.map((f) => ({ [f]: re })) });
+        }
+        if (and.length)
+            filter.$and = and;
+        const [rows, total] = await Promise.all([
+            ActivityLogModel.find(filter)
+                .sort({ at: -1 })
+                .skip((page - 1) * limit)
+                .limit(limit)
+                .select("at actor dashboard action details record outcome sensitive changes ip")
+                .lean(),
+            ActivityLogModel.countDocuments(filter),
+        ]);
+        // OrbitXPro staff show by name and team; their work email and network address stay internal.
+        const items = rows.map((r) => {
+            var _a, _b, _c;
+            return ((_a = r.actor) === null || _a === void 0 ? void 0 : _a.kind) === kind
+                ? r
+                : { ...r, actor: { kind: (_b = r.actor) === null || _b === void 0 ? void 0 : _b.kind, name: ((_c = r.actor) === null || _c === void 0 ? void 0 : _c.name) || "OrbitXPro", team: "OrbitXPro" }, ip: undefined };
+        });
+        res.status(_http_1.HTTP.OK).json({
+            success: true,
+            data: { items },
+            pagination: { page, limit, total, totalPages: Math.max(1, Math.ceil(total / limit)) },
+        });
+    });
+    const recordExport = (0, _http_1.catchAsync)(async (req, res) => {
+        var _a, _b;
+        const what = String(((_a = req.body) === null || _a === void 0 ? void 0 : _a.what) || "a table").slice(0, 120);
+        const rows = Number((_b = req.body) === null || _b === void 0 ? void 0 : _b.rows);
+        (0, recorder_1.recordActivity)({
+            actor: { kind, id: req.user._id, name: req.user.name, email: req.user.email, role: req.user.role },
+            dashboard: kind,
+            action: "Exported",
+            details: `Exported ${what}${Number.isFinite(rows) ? ` (CSV, ${rows} row${rows === 1 ? "" : "s"})` : ""}`,
+            [field]: accountIdOf(req),
+            sensitive: true,
+            ip: (0, recorder_1.clientIp)(req),
+            userAgent: req.headers["user-agent"],
+            method: req.method,
+            path: req.originalUrl.split("?")[0],
+            status: 200,
+        });
+        res.status(_http_1.HTTP.OK).json({ success: true });
+    });
+    return { getAccess, listActivity, recordExport };
+}

package/dist/helpers/ownTickets.d.ts

@@ -0,0 +1,21 @@
+export declare function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthorName, uploadAttachments, raiseDispute }: {
+    ownerType: "Company" | "Partner";
+    categoryOptions: any[];
+    fallbackAuthorName: string;
+    uploadAttachments: (files: any[], ownerId: any) => Promise<any[]>;
+    /** Client only: opens the financial dispute behind a lead-dispute ticket. */
+    raiseDispute?: (input: {
+        leadId: any;
+        reason: string;
+        companyId: any;
+        raisedBy: any;
+        ticketId: any;
+    }) => Promise<any>;
+}): {
+    getTicketCategories: (req: any, res: any, next: any) => void;
+    createTicket: (req: any, res: any, next: any) => void;
+    getMyTickets: (req: any, res: any, next: any) => void;
+    getMyTicketById: (req: any, res: any, next: any) => void;
+    addTicketMessage: (req: any, res: any, next: any) => void;
+};
+//# sourceMappingURL=ownTickets.d.ts.map

package/dist/helpers/ownTickets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownTickets.d.ts","sourceRoot":"","sources":["../../src/helpers/ownTickets.ts"],"names":[],"mappings":"AAuBA,wBAAgB,0BAA0B,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,EAAE;IAC9H,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IACjC,eAAe,EAAE,GAAG,EAAE,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,GAAG,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE,GAAG,CAAA;KAAE,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;CACvH;;;;;;EAoJA"}

package/dist/helpers/ownTickets.js

@@ -0,0 +1,169 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOwnTicketsController = createOwnTicketsController;
+/**
+ * A portal's own support tickets: category list, submit (auto-routed to Ops at once), list, view, reply. Shared by
+ * the Client and Partner backends:
+ *   createOwnTicketsController({ ownerType: "Company", categoryOptions: CLIENT_TICKET_CATEGORY_OPTIONS,
+ *     fallbackAuthorName: "Client", uploadAttachments, raiseDispute })   // Client: lead disputes too
+ *   createOwnTicketsController({ ownerType: "Partner", categoryOptions: PARTNER_TICKET_CATEGORY_OPTIONS,
+ *     fallbackAuthorName: "Partner", uploadAttachments })
+ * uploadAttachments(files, ownerId) stores the request's files and resolves the ticket attachment list.
+ */
+const mongoose_1 = __importDefault(require("mongoose"));
+const ticket_model_1 = require("../models/ticket.model");
+const update_model_1 = require("../models/update.model");
+const ticketCategoryOverride_model_1 = require("../models/ticketCategoryOverride.model");
+const ticketCategories_1 = require("../constants/ticketCategories");
+const ticketRouting_1 = require("../routing/ticketRouting");
+const ticketSanitize_1 = require("../utils/ticketSanitize");
+const errors_1 = require("./errors");
+const _http_1 = require("./_http");
+// Categories where a client disputes one lead/chat: the only ones with a real LeadDispute behind them.
+// "chat-dispute" is a legacy value (no longer offered) kept so an old ticket behaves as it always did.
+const LEAD_DISPUTE_CATEGORIES = ["chat-dispute", "dispute-billable-lead"];
+function createOwnTicketsController({ ownerType, categoryOptions, fallbackAuthorName, uploadAttachments, raiseDispute }) {
+    const TicketModel = ticket_model_1.Ticket;
+    const UpdateModel = update_model_1.Update;
+    const OverrideModel = ticketCategoryOverride_model_1.TicketSubCategoryOverride;
+    const VALID_CATEGORY_VALUES = new Set(categoryOptions.map((o) => o.value));
+    // The effective category list: the defaults plus any sub-categories Ops set in Settings.
+    const getTicketCategories = (0, _http_1.catchAsync)(async (req, res) => {
+        const overrides = await OverrideModel.find({ ownerType }).lean();
+        res.status(_http_1.HTTP.OK).json({ success: true, data: { categories: (0, ticketCategories_1.applySubCategoryOverrides)(categoryOptions, overrides) } });
+    });
+    // Fire-and-forget: a missed feed notification never fails the ticket creation that triggered it.
+    async function notifyAssignee(userId, ticket) {
+        if (!userId)
+            return;
+        try {
+            await UpdateModel.create({
+                dashboard: "ops",
+                audience: "user",
+                userId,
+                type: "ticket_assigned",
+                title: `Ticket ${ticket.ticketId} assigned to you`,
+                body: ticket.description ? ticket.description.slice(0, 200) : undefined,
+                link: `/tickets/view/${ticket._id}`,
+                readBy: [],
+            });
+        }
+        catch (err) {
+            console.error(`[Ticket ${ticket._id}] Failed to write assignment update:`, err.message);
+        }
+    }
+    // Routes a new ticket the same way Ops's own triage does. Routing is a convenience: an unrouted ticket just waits
+    // for Ops to pick it up.
+    async function routeNewTicket(ticket) {
+        try {
+            const routing = await (0, ticketRouting_1.resolveTicketRouting)(ticket);
+            if (!routing.assigneeId && routing.followerIds.length === 0)
+                return;
+            const update = { $push: {} };
+            if (routing.assigneeId) {
+                update.$set = { assigneeId: routing.assigneeId };
+                update.$push.activityLog = { action: "assigned", actorName: "Routing Engine", to: String(routing.assigneeId), createdAt: new Date() };
+            }
+            if (routing.followerIds.length)
+                update.$push.followerIds = { $each: routing.followerIds };
+            await TicketModel.updateOne({ _id: ticket._id }, update);
+            await notifyAssignee(routing.assigneeId, ticket);
+        }
+        catch (err) {
+            console.error(`[Ticket ${ticket._id}] Auto-routing failed:`, err.message);
+        }
+    }
+    // Body (multipart): category, subCategory, description, disputeReason, chatId, invoiceId (+ leadId on Client).
+    // File field: attachments (optional, several).
+    const createTicket = (0, _http_1.catchAsync)(async (req, res, next) => {
+        const { category, subCategory, description, disputeReason, chatId, invoiceId } = req.body;
+        const leadId = raiseDispute ? req.body.leadId : undefined;
+        const ownerId = req.user.owner;
+        if (!category)
+            return next(new errors_1.AppError("category is required", _http_1.HTTP.BAD_REQUEST));
+        if (!VALID_CATEGORY_VALUES.has(category))
+            return next(new errors_1.AppError("Invalid category", _http_1.HTTP.BAD_REQUEST));
+        // A sub-category an admin added from Settings must be accepted here, not just displayed.
+        const override = await OverrideModel.findOne({ ownerType, categoryValue: category }).lean();
+        const categoryDef = (0, ticketCategories_1.applySubCategoryOverrides)(categoryOptions, override ? [override] : []).find((o) => o.value === category);
+        if (subCategory && (categoryDef === null || categoryDef === void 0 ? void 0 : categoryDef.subCategories) && !categoryDef.subCategories.some((s) => s.value === subCategory)) {
+            return next(new errors_1.AppError("Invalid sub-category for this category", _http_1.HTTP.BAD_REQUEST));
+        }
+        const attachments = await uploadAttachments(req.files || [], ownerId);
+        const ticket = await TicketModel.create({
+            ownerType,
+            ownerId,
+            source: "dashboard",
+            category,
+            subCategory: subCategory || undefined,
+            description,
+            disputeReason,
+            chatId,
+            leadId: leadId && mongoose_1.default.Types.ObjectId.isValid(leadId) ? leadId : undefined,
+            invoiceId,
+            attachments,
+            requestedBy: req.user._id,
+            requesterEmail: req.user.email,
+        });
+        // A real lead dispute also opens the financial dispute Ops resolves. Never fails the ticket itself.
+        let disputeWarning;
+        if (raiseDispute && LEAD_DISPUTE_CATEGORIES.includes(category) && leadId) {
+            try {
+                await raiseDispute({ leadId, reason: disputeReason || description, companyId: ownerId, raisedBy: req.user._id, ticketId: ticket._id });
+            }
+            catch (err) {
+                console.error(`[Ticket ${ticket._id}] Failed to create linked dispute for lead ${leadId}:`, err.message);
+                disputeWarning = err.message;
+            }
+        }
+        await routeNewTicket(ticket);
+        res.status(_http_1.HTTP.CREATED).json({ success: true, message: "Ticket submitted successfully", data: { ticket, disputeWarning } });
+    });
+    const withPeople = (query) => query.populate("requestedBy", "name email").populate("resolvedBy", "name email");
+    const getMyTickets = (0, _http_1.catchAsync)(async (req, res) => {
+        const { status, category } = req.query;
+        const queryObj = { ownerType, ownerId: req.user.owner };
+        if (status)
+            queryObj.status = status;
+        if (category)
+            queryObj.category = category;
+        const tickets = await withPeople(TicketModel.find(queryObj)).sort({ createdAt: -1 }).lean();
+        tickets.forEach(ticketSanitize_1.sanitizeTicketForRequester);
+        res.status(_http_1.HTTP.OK).json({ success: true, results: tickets.length, data: { tickets } });
+    });
+    const getMyTicketById = (0, _http_1.catchAsync)(async (req, res, next) => {
+        const ticket = await withPeople(TicketModel.findOne({ _id: req.params.id, ownerType, ownerId: req.user.owner })).lean();
+        if (!ticket)
+            return next(new errors_1.AppError("Ticket not found", _http_1.HTTP.NOT_FOUND));
+        res.status(_http_1.HTTP.OK).json({ success: true, data: { ticket: (0, ticketSanitize_1.sanitizeTicketForRequester)(ticket) } });
+    });
+    // A reply from the requester: always visible to them (they can never post an internal note).
+    // Body: { body }. File field: attachments (optional, several).
+    const addTicketMessage = (0, _http_1.catchAsync)(async (req, res, next) => {
+        const ownerId = req.user.owner;
+        const { body } = req.body;
+        if (!body || !body.trim())
+            return next(new errors_1.AppError("Message body is required", _http_1.HTTP.BAD_REQUEST));
+        const ticket = await TicketModel.findOne({ _id: req.params.id, ownerType, ownerId });
+        if (!ticket)
+            return next(new errors_1.AppError("Ticket not found", _http_1.HTTP.NOT_FOUND));
+        const attachments = await uploadAttachments(req.files || [], ownerId);
+        const message = {
+            _id: new mongoose_1.default.Types.ObjectId(),
+            authorType: "client",
+            authorId: req.user._id,
+            authorName: req.user.name || req.user.email || fallbackAuthorName,
+            body: body.trim(),
+            isInternal: false,
+            attachments,
+            createdAt: new Date(),
+        };
+        await TicketModel.updateOne({ _id: ticket._id }, { $push: { messages: message }, $set: { updatedAt: new Date() } });
+        const updated = await withPeople(TicketModel.findById(ticket._id)).lean();
+        res.status(_http_1.HTTP.CREATED).json({ success: true, message: "Message added", data: { ticket: (0, ticketSanitize_1.sanitizeTicketForRequester)(updated) } });
+    });
+    return { getTicketCategories, createTicket, getMyTickets, getMyTicketById, addTicketMessage };
+}