@mohasinac/appkit 3.3.1 → 3.3.2

package/dist/_internal/server/features/checkout/actions.js

@@ -778,11 +778,15 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     // decrement runs against `expansionPaid.decrements` lower down.
     const expansionPaid = getExpandedDecrements(cart.items);
     const productByIdPaid = new Map();
-    for (const pid of expansionPaid.productIds) {
-        const product = await unitOfWork.products.findById(pid);
+    // Independent reads across distinct product docs — batch them instead of
+    // awaiting one findById per product (mirrors the COD/UPI path above, which
+    // already batches its product lookups via Promise.all).
+    const fetchedProductsPaid = await Promise.all(expansionPaid.productIds.map((pid) => unitOfWork.products.findById(pid)));
+    expansionPaid.productIds.forEach((pid, i) => {
+        const product = fetchedProductsPaid[i];
         if (product)
             productByIdPaid.set(pid, product);
-    }
+    });
     const productChecks = cart.items.map((item) => {
         const [firstMember] = getCartItemMemberIds(item);
         const product = productByIdPaid.get(firstMember) ?? null;
@@ -867,18 +871,10 @@ export async function verifyAndPlaceRazorpayOrderAction(input) {
     for (const { items: group, orderType } of orderGroups) {
         const firstItem = group[0].item;
         const groupTotal = group.reduce((sum, { item, product }) => sum + unitPriceFor(item, product) * item.quantity, 0);
-        let shippingFee = 0;
-        let storeOwnerId;
-        const storeId = firstItem.storeId;
-        if (storeId) {
-            const store = await storeRepository.findById(storeId);
-            storeOwnerId = store?.ownerId;
-            const sellerUser = storeOwnerId ? await userRepository.findById(storeOwnerId) : null;
-            const shippingConfig = sellerUser?.shippingConfig;
-            if (shippingConfig?.isConfigured) {
-                shippingFee = shippingConfig.customShippingPrice ?? 0;
-            }
-        }
+        // Reuses the same store/seller lookup as the COD/UPI path above instead
+        // of re-implementing it inline — was two sequential findById calls per
+        // seller group here, duplicated from resolveShippingCost.
+        const { shippingFee, storeOwnerId } = await resolveShippingCost(firstItem.storeId);
         let couponDiscount = 0;
         const appliedDiscounts = [];
         for (const coupon of appliedCoupons) {

package/dist/client/api/surface-error.js

@@ -1,9 +1,17 @@
 import { isApiError } from "./ApiError";
 import { normalizeError } from "../../errors/normalize";
 import { getErrorDisplay } from "../../errors/error-display-map";
+/** True for `ApiError` instances and for any other thrown error (e.g. the
+ * lower-level `ApiClientError` from `ApiClient.request()`) that carries the
+ * same stable `code: string` field — both shapes route through the same
+ * toast-vs-inline-field-error logic below. */
+function hasStableErrorCode(err) {
+    return (isApiError(err) ||
+        (err instanceof Error && typeof err.code === "string"));
+}
 export function surfaceError(err, opts) {
     const { showToast, setFieldError, translate, report } = opts;
-    if (isApiError(err)) {
+    if (hasStableErrorCode(err)) {
         const display = getErrorDisplay(err.code);
         const message = translate?.(display.messageKey) ?? err.message;
         if (display.field && setFieldError) {

package/dist/client.d.ts

@@ -27,6 +27,7 @@ export type { GradientKey, RequiredThemeToken, ThemeMode, ThemeRecord, } from ".
 export { ConfirmDeleteModal } from "./ui/components/ConfirmDeleteModal";
 export { EmptyState } from "./ui/components/EmptyState";
 export { Skeleton } from "./ui/components/Skeleton";
+export { Alert } from "./ui/components/Alert";
 export type { SkeletonProps } from "./ui/components/Skeleton";
 export { Divider } from "./ui/components/Divider";
 export { TabStrip } from "./ui/components/TabStrip";
@@ -79,6 +80,8 @@ export type { LotteryConfig, LotterySlot, ClientLotterySlot, ClientLotteryConfig
 export { BottomSheet } from "./features/layout/index";
 export { ImageUpload } from "./features/media/index";
 export type { ImageUploadProps } from "./features/media/index";
+export { AvatarUpload } from "./features/media/index";
+export type { AvatarUploadProps, ImageCropData } from "./features/media/index";
 export { ImageCropModal } from "./features/media/index";
 export { VideoTrimModal } from "./features/media/index";
 export { useMediaAbort } from "./features/media/index";
@@ -117,13 +120,15 @@ export type { OtpInputProps } from "./ui/components/OtpInput";
 export { DateInput, DateRangeInput } from "./ui/components/DateInput";
 export type { DateInputProps, DateRangeInputProps } from "./ui/components/DateInput";
 export type { FormShellProps, FormShellProviderProps, FormShellStep, FormShellContextValue, UseFormShellStateResult } from "./ui/forms";
-export { FormShell, FormShellProvider, FormShellContext, useFormShell, useFormShellState } from "./ui/forms";
+export { FormShell, FormShellProvider, FormShellContext, useFormShell, useFormShellState, applyZodIssues } from "./ui/forms";
 export type { FieldInputProps } from "./ui/forms";
 export { FieldInput } from "./ui/forms";
 export type { FieldSelectProps } from "./ui/forms";
 export { FieldSelect } from "./ui/forms";
 export type { FieldCheckboxProps } from "./ui/forms";
 export { FieldCheckbox } from "./ui/forms";
+export type { FieldTextareaProps } from "./ui/forms";
+export { FieldTextarea } from "./ui/forms";
 export type { ColorPickerFieldProps } from "./ui/forms";
 export { ColorPickerField } from "./ui/forms";
 export { Select } from "./ui/components/Select";
@@ -171,6 +176,7 @@ export type { Address, AddressFormData } from "./features/account/index";
 export { AddressBook, AddressCard, AddressForm } from "./features/account/index";
 export type { AddressCardAddress, AddressCardProps } from "./features/account/index";
 export { useProfile, useUpdateProfile } from "./features/account/index";
+export { updateProfileSchema } from "./features/account/index";
 export { CategoryProductsView } from "./features/categories/index";
 export type { CategoryItem } from "./features/categories/index";
 export { MediaImage } from "./features/media/index";

package/dist/client.js

@@ -38,6 +38,7 @@ export { ConfirmDeleteModal } from "./ui/components/ConfirmDeleteModal";
 // S-STORE — pure-UI primitives + Seller view consumed by new dashboard pages
 export { EmptyState } from "./ui/components/EmptyState";
 export { Skeleton } from "./ui/components/Skeleton";
+export { Alert } from "./ui/components/Alert";
 export { Divider } from "./ui/components/Divider";
 export { TabStrip } from "./ui/components/TabStrip";
 export { SellerProductsView } from "./features/seller/components/SellerProductsView";
@@ -131,6 +132,7 @@ export { PrizeDrawLotteryDetailView } from "./_internal/client/features/lottery/
 // BottomSheet - Shared export for bottom sheet.
 export { BottomSheet } from "./features/layout/index";
 export { ImageUpload } from "./features/media/index";
+export { AvatarUpload } from "./features/media/index";
 // [CLIENT-ONLY]-Cannot run in SSR mode â€" uses browser-only APIs (window, navigator, localStorage, matchMedia, DOM events) that do not exist in Node.js.
 // ImageCropModal - Component for image crop modal.
 export { ImageCropModal } from "./features/media/index";
@@ -175,10 +177,11 @@ export { RadioItem } from "./ui/components/Radio";
 export { Input } from "./ui/components/Input";
 export { OtpInput } from "./ui/components/OtpInput";
 export { DateInput, DateRangeInput } from "./ui/components/DateInput";
-export { FormShell, FormShellProvider, FormShellContext, useFormShell, useFormShellState } from "./ui/forms";
+export { FormShell, FormShellProvider, FormShellContext, useFormShell, useFormShellState, applyZodIssues } from "./ui/forms";
 export { FieldInput } from "./ui/forms";
 export { FieldSelect } from "./ui/forms";
 export { FieldCheckbox } from "./ui/forms";
+export { FieldTextarea } from "./ui/forms";
 export { ColorPickerField } from "./ui/forms";
 export { Select } from "./ui/components/Select";
 export { Heading } from "./ui/components/Typography";
@@ -206,6 +209,7 @@ export { CartView, CartItemRow, CartSummary, CartDrawer, CheckoutView, CheckoutS
 export { useAddresses, useCreateAddress, useUpdateAddress, useDeleteAddress, useSetDefaultAddress, useAddress } from "./features/account/index";
 export { AddressBook, AddressCard, AddressForm } from "./features/account/index";
 export { useProfile, useUpdateProfile } from "./features/account/index";
+export { updateProfileSchema } from "./features/account/index";
 export { CategoryProductsView } from "./features/categories/index";
 export { MediaImage } from "./features/media/index";
 export { StoreSidebar } from "./features/seller/components/SellerSidebar";

package/dist/errors/error-handler.d.ts

@@ -4,6 +4,12 @@ import { AppError } from "./base-error";
 /**
  * Handle API errors with consistent response format.
  * Use in Next.js API route catch blocks.
+ *
+ * Delegates classification to `mapToHttpError` — the same table `createRouteHandler`
+ * uses — so `DatabaseError`/bare Firestore error codes/`ApiError` are classified
+ * correctly here too, instead of silently falling through to a generic 500 the way
+ * this function previously did for anything that wasn't an `AppError` or a Zod-shaped
+ * object. Response shape is unchanged for existing callers.
  */
 export declare function handleApiError(error: unknown): NextResponse;
 /**

package/dist/errors/error-handler.js

@@ -1,41 +1,39 @@
 import { NextResponse } from "next/server.js";
 import { AppError } from "./base-error";
-import { ERROR_CODES, ERROR_MESSAGES_BY_CODE } from "./error-codes";
+import { mapToHttpError } from "./error-mapping";
 /**
  * Handle API errors with consistent response format.
  * Use in Next.js API route catch blocks.
+ *
+ * Delegates classification to `mapToHttpError` — the same table `createRouteHandler`
+ * uses — so `DatabaseError`/bare Firestore error codes/`ApiError` are classified
+ * correctly here too, instead of silently falling through to a generic 500 the way
+ * this function previously did for anything that wasn't an `AppError` or a Zod-shaped
+ * object. Response shape is unchanged for existing callers.
  */
 export function handleApiError(error) {
-    if (error instanceof AppError) {
-        if (error.statusCode >= 500) {
-            console.error("[API Error]", {
-                code: error.code,
-                message: error.message,
-                statusCode: error.statusCode,
-                data: error.data,
-            });
-        }
-        return NextResponse.json(error.toJSON(), { status: error.statusCode });
-    }
-    // Zod / schema validation errors
-    if (error && typeof error === "object" && "issues" in error) {
-        return NextResponse.json({
-            success: false,
-            error: "Validation failed",
-            code: ERROR_CODES.VALIDATION_INVALID_INPUT,
-            data: error,
-        }, { status: 400 });
-    }
-    console.error("[Unexpected API Error]", {
-        error: error instanceof Error
-            ? { name: error.name, message: error.message, stack: error.stack }
-            : error,
+    const mapped = mapToHttpError(error, {
+        isProduction: process.env.NODE_ENV === "production",
     });
+    if (mapped.status >= 500) {
+        console.error("[API Error]", {
+            code: mapped.code,
+            message: mapped.message,
+            statusCode: mapped.status,
+            data: error instanceof AppError ? error.data : undefined,
+        });
+    }
     return NextResponse.json({
         success: false,
-        error: ERROR_MESSAGES_BY_CODE[ERROR_CODES.GEN_INTERNAL_ERROR],
-        code: ERROR_CODES.GEN_INTERNAL_ERROR,
-    }, { status: 500 });
+        error: mapped.message,
+        code: mapped.code,
+        statusCode: mapped.status,
+        ...(error instanceof AppError && error.data !== undefined
+            ? { data: error.data }
+            : mapped.issues
+                ? { data: { issues: mapped.issues } }
+                : {}),
+    }, { status: mapped.status });
 }
 /**
  * Log an error with optional context. Wraps console.error for package portability;

package/dist/features/account/hooks/useProfile.d.ts

@@ -14,6 +14,14 @@ export interface UpdateCurrentProfileInput {
     displayName?: string;
     phoneNumber?: string;
     photoURL?: string;
+    avatarMetadata?: {
+        url: string;
+        position: {
+            x: number;
+            y: number;
+        };
+        zoom: number;
+    };
     bio?: string;
     profileIsPublic?: boolean;
 }

package/dist/features/account/schemas/index.d.ts

@@ -183,16 +183,25 @@ export declare const userProfileSchema: z.ZodObject<{
     } | undefined;
     bio?: string | undefined;
 }>;
+/**
+ * Client-side mirror of the server's updateProfileSchema
+ * (src/app/api/user/profile/route.ts) — kept field-for-field in sync so a
+ * value that passes client validation is guaranteed to pass server
+ * validation too.
+ */
 export declare const updateProfileSchema: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
-    phone: z.ZodOptional<z.ZodString>;
+    phoneNumber: z.ZodOptional<z.ZodString>;
     bio: z.ZodOptional<z.ZodString>;
+    profileIsPublic: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    phone?: string | undefined;
     displayName?: string | undefined;
+    phoneNumber?: string | undefined;
     bio?: string | undefined;
+    profileIsPublic?: boolean | undefined;
 }, {
-    phone?: string | undefined;
     displayName?: string | undefined;
+    phoneNumber?: string | undefined;
     bio?: string | undefined;
+    profileIsPublic?: boolean | undefined;
 }>;

package/dist/features/account/schemas/index.js

@@ -44,8 +44,15 @@ export const userProfileSchema = z.object({
     createdAt: z.string().optional(),
     updatedAt: z.string().optional(),
 });
+/**
+ * Client-side mirror of the server's updateProfileSchema
+ * (src/app/api/user/profile/route.ts) — kept field-for-field in sync so a
+ * value that passes client validation is guaranteed to pass server
+ * validation too.
+ */
 export const updateProfileSchema = z.object({
-    displayName: z.string().min(1).optional(),
-    phone: z.string().optional(),
-    bio: z.string().optional(),
+    displayName: z.string().min(1, "Enter your name").optional(),
+    phoneNumber: z.string().optional(),
+    bio: z.string().max(500, "Bio must be 500 characters or fewer").optional(),
+    profileIsPublic: z.boolean().optional(),
 });

package/dist/features/auth/components/RegisterForm.js

@@ -8,10 +8,10 @@ import { Form } from "../../../ui/components/Form";
 import { FieldInput } from "../../../ui/forms/FieldInput";
 import { FieldCheckbox } from "../../../ui/forms/FieldCheckbox";
 import { applyZodIssues } from "../../../ui/forms/FormShell";
-import { registerSchema } from "../schemas";
+import { registerSchema, registerPasswordSchema } from "../schemas";
 const registerClientSchema = registerSchema.extend({
     displayName: z.string().min(1, "Enter your name"),
-    confirmPassword: z.string().min(6),
+    confirmPassword: registerPasswordSchema,
     acceptTerms: z.literal(true, {
         errorMap: () => ({ message: "You must accept the terms to continue" }),
     }),

package/dist/features/auth/permissions/constants.d.ts

@@ -11,7 +11,7 @@
  * Permission naming: admin:resource:action
  * Ban action naming: plain verb phrase — write_reviews, place_bids, etc.
  */
-export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
+export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
 /**
  * Granular user actions that can be soft-banned individually.
  * A user may have multiple simultaneous soft bans of different types.

package/dist/features/auth/schemas/index.d.ts

@@ -17,6 +17,14 @@ export declare const loginSchema: z.ZodObject<{
     password: string;
     email: string;
 }>;
+/**
+ * Matches the server-side complexity rule enforced in
+ * src/app/api/auth/register/route.ts — kept in sync so a password that fails
+ * client-side validation is exactly the same one that would fail server-side,
+ * instead of passing the client gate and failing with a generic toast after
+ * the network round-trip.
+ */
+export declare const registerPasswordSchema: z.ZodString;
 export declare const registerSchema: z.ZodObject<{
     email: z.ZodString;
     password: z.ZodString;

package/dist/features/auth/schemas/index.js

@@ -1,5 +1,6 @@
 export * from "./firestore";
 import { z } from "zod";
+import { ERROR_MESSAGES } from "../../../errors/messages";
 // --- Form schemas -------------------------------------------------------------
 /**
  * Login form schema — use with react-hook-form + zodResolver.
@@ -12,9 +13,22 @@ export const loginSchema = z.object({
     email: z.string().email(),
     password: z.string().min(6),
 });
+/**
+ * Matches the server-side complexity rule enforced in
+ * src/app/api/auth/register/route.ts — kept in sync so a password that fails
+ * client-side validation is exactly the same one that would fail server-side,
+ * instead of passing the client gate and failing with a generic toast after
+ * the network round-trip.
+ */
+export const registerPasswordSchema = z
+    .string()
+    .min(8, ERROR_MESSAGES.PASSWORD.TOO_SHORT)
+    .regex(/[A-Z]/, ERROR_MESSAGES.PASSWORD.NO_UPPERCASE)
+    .regex(/[a-z]/, ERROR_MESSAGES.PASSWORD.NO_LOWERCASE)
+    .regex(/[0-9]/, ERROR_MESSAGES.PASSWORD.NO_NUMBER);
 export const registerSchema = z.object({
     email: z.string().email(),
-    password: z.string().min(6),
+    password: registerPasswordSchema,
     displayName: z.string().min(1).optional(),
 });
 export const forgotPasswordSchema = z.object({

package/dist/features/seller/actions/seller-actions.js

@@ -224,6 +224,9 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
     if (!userDoc.payoutDetails?.isConfigured) {
         throw new ValidationError("Payout details are not set up. Please configure your payout method before requesting a payout.");
     }
+    // order.storeId is the store slug, not the seller's Firebase UID — resolve
+    // the caller's store once so eligibility can compare like-for-like.
+    const callerStore = userRole !== "admin" ? await storeRepository.findByOwnerId(userId) : null;
     const orders = await Promise.all(orderIds.map((id) => orderRepository.findById(id)));
     const requested = [];
     const skipped = [];
@@ -235,7 +238,7 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
             skipped.push(id);
             continue;
         }
-        if (userRole !== "admin" && order.storeId !== userId) {
+        if (userRole !== "admin" && order.storeId !== callerStore?.id) {
             skipped.push(id);
             continue;
         }
@@ -317,9 +320,15 @@ export async function createSellerProduct(userId, userName, userEmail, input) {
         sellerId: userId,
         sellerName: userName,
         sellerEmail: userEmail,
-        status: "draft",
+        // Pass through the caller's intended status (draft vs published) instead
+        // of hardcoding "draft" — this previously made every "Publish" click
+        // silently save as a draft regardless of what the wizard sent.
+        status: finalizedData.status ?? "draft",
+    });
+    serverLogger.info("createSellerProduct: product created", {
+        userId,
+        status: finalizedData.status ?? "draft",
     });
-    serverLogger.info("createSellerProduct: product created", { userId });
 }
 // --- Read Actions -------------------------------------------------------------
 export async function getSellerStore(userId) {
@@ -342,7 +351,20 @@ export async function getSellerPayoutSettings(userId) {
     return { ...details, bankAccount: safeBank };
 }
 export async function listSellerOrders(userId, params) {
-    const sellerProducts = await productRepository.findByStore(userId);
+    // productRepository.findByStore expects the store slug, not the seller's
+    // Firebase UID — resolve the caller's store first.
+    const store = await storeRepository.findByOwnerId(userId);
+    if (!store) {
+        return {
+            items: [],
+            total: 0,
+            page: 1,
+            pageSize: params?.pageSize ?? 20,
+            totalPages: 0,
+            hasMore: false,
+        };
+    }
+    const sellerProducts = await productRepository.findByStore(store.id);
     const productIds = sellerProducts.map((p) => p.id);
     if (productIds.length === 0) {
         return {
@@ -362,7 +384,10 @@ export async function listSellerOrders(userId, params) {
     });
 }
 export async function getSellerAnalytics(userId) {
-    const products = await productRepository.findByStore(userId);
+    // productRepository.findByStore expects the store slug, not the seller's
+    // Firebase UID — resolve the caller's store first.
+    const store = await storeRepository.findByOwnerId(userId);
+    const products = store ? await productRepository.findByStore(store.id) : [];
     const productIds = products.map((p) => p.id);
     let allOrders = [];
     if (productIds.length > 0) {
@@ -449,8 +474,12 @@ export async function sellerUpdateProduct(userId, userRole, productId, input) {
     const existing = await productRepository.findById(productId);
     if (!existing)
         throw new NotFoundError("Product not found");
-    if (userRole !== "admin" && existing.storeId !== userId)
-        throw new AuthorizationError("You do not own this product");
+    // existing.storeId is the store slug, not the seller's Firebase UID.
+    if (userRole !== "admin") {
+        const store = await storeRepository.findByOwnerId(userId);
+        if (!store || existing.storeId !== store.id)
+            throw new AuthorizationError("You do not own this product");
+    }
     const finalizedData = await finalizeProductMediaReferences(input);
     const updated = await productRepository.updateProduct(productId, finalizedData);
     serverLogger.info("sellerUpdateProduct", { userId, productId });
@@ -460,8 +489,12 @@ export async function sellerDeleteProduct(userId, userRole, productId) {
     const existing = await productRepository.findById(productId);
     if (!existing)
         throw new NotFoundError("Product not found");
-    if (userRole !== "admin" && existing.storeId !== userId)
-        throw new AuthorizationError("You do not own this product");
+    // existing.storeId is the store slug, not the seller's Firebase UID.
+    if (userRole !== "admin") {
+        const store = await storeRepository.findByOwnerId(userId);
+        if (!store || existing.storeId !== store.id)
+            throw new AuthorizationError("You do not own this product");
+    }
     await productRepository.delete(productId);
     serverLogger.info("sellerDeleteProduct", { userId, productId });
 }
@@ -487,8 +520,12 @@ export async function customShipOrder(userId, userRole, orderId, input) {
     const order = await orderRepository.findById(orderId);
     if (!order)
         throw new NotFoundError("Order not found");
-    if (userRole !== "admin" && order.storeId !== userId)
-        throw new AuthorizationError("You do not own this order");
+    // order.storeId is the store slug, not the seller's Firebase UID.
+    if (userRole !== "admin") {
+        const store = await storeRepository.findByOwnerId(userId);
+        if (!store || order.storeId !== store.id)
+            throw new AuthorizationError("You do not own this order");
+    }
     if (order.status === OrderStatusValues.SHIPPED ||
         order.status === OrderStatusValues.DELIVERED)
         throw new ValidationError("Order is already shipped");
@@ -523,8 +560,12 @@ export async function markEmiInstallmentPaid(userId, userRole, orderId, input) {
     const order = await orderRepository.findById(orderId);
     if (!order)
         throw new NotFoundError("Order not found");
-    if (userRole !== "admin" && order.storeId !== userId)
-        throw new AuthorizationError("You do not own this order");
+    // order.storeId is the store slug, not the seller's Firebase UID.
+    if (userRole !== "admin") {
+        const store = await storeRepository.findByOwnerId(userId);
+        if (!store || order.storeId !== store.id)
+            throw new AuthorizationError("You do not own this order");
+    }
     if (!order.emiEnabled)
         throw new ValidationError("This order is not on an EMI plan");
     const installments = order.emiInstallments ?? [];

package/dist/features/seller/components/SellerOrdersView.js

@@ -275,20 +275,35 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
             render: (row) => _jsx(Span, { size: "xs", color: "muted", children: row.updatedAt }),
         },
     ];
+    const [shippingRowId, setShippingRowId] = useState(null);
     const handleQuickShip = useCallback(async (row, e) => {
         e.stopPropagation();
-        const res = await fetch(`${orderDetailApiBase}/${row.id}`, {
-            method: "PATCH",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ status: "shipped" }),
-        }).catch(() => null);
-        if (res?.ok)
+        setShippingRowId(row.id);
+        try {
+            const res = await fetch(`${orderDetailApiBase}/${row.id}`, {
+                method: "PATCH",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ status: "shipped" }),
+            });
+            if (!res.ok) {
+                const body = await res.json().catch(() => null);
+                throw new Error(body?.error ?? "Failed to mark order shipped");
+            }
+            showToast("Order marked shipped.", "success");
             setSelectedOrderId(null);
-    }, [orderDetailApiBase]);
+        }
+        catch (err) {
+            void normalizeError(err);
+            showToast(err instanceof Error ? err.message : "Failed to mark order shipped.", "error");
+        }
+        finally {
+            setShippingRowId(null);
+        }
+    }, [orderDetailApiBase, showToast]);
     const renderRowActions = useCallback((row) => {
         const isShippable = ["PENDING", "PROCESSING", "CONFIRMED"].includes(row.status?.toUpperCase() ?? "");
-        return (_jsxs(Row, { align: "center", gap: "xs", children: [isShippable && (_jsx(Button, { variant: "ghost", size: "sm", onClick: (e) => void handleQuickShip(row, e), "aria-label": "Mark as shipped", title: "Mark shipped", children: _jsx(Truck, { className: "h-4 w-4" }) })), _jsx(Button, { variant: "ghost", size: "sm", onClick: (e) => { e.stopPropagation(); setSelectedOrderId(row.id); }, title: "View order details", "aria-label": "View order details", children: _jsx(Eye, { className: "h-4 w-4" }) })] }));
-    }, [handleQuickShip]);
+        return (_jsxs(Row, { align: "center", gap: "xs", children: [isShippable && (_jsx(Button, { variant: "ghost", size: "sm", onClick: (e) => void handleQuickShip(row, e), "aria-label": "Mark as shipped", title: "Mark shipped", isLoading: shippingRowId === row.id, disabled: shippingRowId !== null, children: _jsx(Truck, { className: "h-4 w-4" }) })), _jsx(Button, { variant: "ghost", size: "sm", onClick: (e) => { e.stopPropagation(); setSelectedOrderId(row.id); }, title: "View order details", "aria-label": "View order details", children: _jsx(Eye, { className: "h-4 w-4" }) })] }));
+    }, [handleQuickShip, shippingRowId]);
     const selection = useBulkSelection({ items: rows, keyExtractor: (r) => r.id });
     const handlePrintPackingSlips = useCallback(() => {
         const ids = selection.selectedIds.join(",");

package/dist/features/seller/components/SellerProductShell.js

@@ -296,17 +296,32 @@ export function SellerProductShell({ mode, listingType = "standard", initialValu
         {
             label: "Basic",
             render: ({ values, onChange }) => (_jsx(StepBasic, { values: values, onChange: onChange, renderCategorySelector: renderCategorySelector, renderBrandSelector: renderBrandSelector, renderTemplateSelector: renderTemplateSelector })),
-            validate: (v) => (!v.title?.trim() ? "Title is required" : null),
+            validate: (v) => {
+                if (!v.title?.trim() || v.title.trim().length < 3)
+                    return "Title must be at least 3 characters";
+                if (!v.description?.trim() || v.description.trim().length < 20)
+                    return "Description must be at least 20 characters";
+                return null;
+            },
         },
         {
             label: "Media",
             render: ({ values, onChange }) => (_jsx(StepMedia, { values: values, onChange: onChange, storeSlug: storeSlug })),
+            validate: (v) => (!v.mainImage ? "A main image is required" : null),
         },
         ...(typeSpecificStep ? [typeSpecificStep] : []),
         {
             label: "Pricing",
             render: ({ values, onChange }) => (_jsx(StepPricing, { values: values, onChange: onChange, listingType: listingType })),
-            validate: (v) => (!v.price ? "Price is required" : null),
+            validate: (v) => {
+                if (!v.price)
+                    return "Price is required";
+                if (pluginForMode(listingType).showsStockQuantity &&
+                    (v.stockQuantity === undefined || v.stockQuantity === null)) {
+                    return "Stock quantity is required";
+                }
+                return null;
+            },
         },
         {
             label: "Shipping",

package/dist/http/ApiClient.d.ts

@@ -20,6 +20,17 @@ import type { JsonValue } from "../schemas/types";
 export declare class ApiClientError extends Error {
     readonly status: number;
     readonly data?: unknown | undefined;
+    /** Stable server error code, e.g. HTTP_ERROR_CODES.VALIDATION_FAILED — lets
+     * `surfaceError`/`ERROR_DISPLAY_MAP` route this to a toast or an inline
+     * field error the same way a `client/api/ApiError` would. */
+    readonly code?: string;
+    /** Serialised Zod issues, when the failure was a validation error. */
+    readonly issues?: {
+        message: string;
+        path?: (string | number)[];
+        code?: string;
+    }[];
+    readonly requestId?: string;
     constructor(message: string, status: number, data?: unknown | undefined);
 }
 export interface RequestConfig extends RequestInit {

package/dist/http/ApiClient.js

@@ -22,6 +22,10 @@ export class ApiClientError extends Error {
         this.status = status;
         this.data = data;
         this.name = "ApiClientError";
+        const body = data;
+        this.code = typeof body?.code === "string" ? body.code : undefined;
+        this.issues = Array.isArray(body?.issues) ? body.issues : undefined;
+        this.requestId = typeof body?.requestId === "string" ? body.requestId : undefined;
     }
 }
 export class ApiClient {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "3.3.1",
+  "version": "3.3.2",
   "license": "MIT",
   "publishConfig": {
     "access": "public"