@mohasinac/appkit 4.10.0 → 4.11.0

package/dist/features/categories/schemas/firestore.d.ts

@@ -125,8 +125,16 @@ export interface CategoryDocument extends BaseDocument {
     brandCountry?: string;
     /** Brand founding year — categoryType==="brand". */
     brandFounded?: number;
-    /** Banner image for the brand storefront page — categoryType==="brand". */
-    brandBannerImage?: string;
+    /**
+     * Short bullet points — "why shop this category/brand." Category and
+     * brand detail pages only; renders nothing when absent/empty.
+     */
+    highlights?: string[];
+    /** A handful of Q&A pairs shown on the category/brand detail page. */
+    faqs?: {
+        question: string;
+        answer: string;
+    }[];
     /**
      * "special" — admin-curated bundle; writes reverse `partOfBundleIds`
      * pointers on member products and shows the "Bundled" badge on cards.
@@ -135,6 +143,15 @@ export interface CategoryDocument extends BaseDocument {
      * Does NOT update `partOfBundleIds`; used as a discovery surface only.
      */
     bundleKind?: "special" | "brand";
+    /**
+     * Which brand this bundle belongs to, for the brand detail page's bundle
+     * tab — works for both `bundleKind:"special"` (static) and `"brand"`
+     * (dynamic) bundles. Distinct from `bundleQueryRule.filter.brandSlug`,
+     * which is a dynamic-rule query *filter* (only meaningful when
+     * `bundleQueryRule.type==="dynamic"`) — this field is the bundle's own
+     * brand tag regardless of how its members are resolved.
+     */
+    brandSlug?: string;
     /** Discounted bundle price in decimal rupees. */
     bundlePrice?: number;
     /** Rule resolving the bundle's member products — static list or live query. */

package/dist/features/categories/schemas/index.d.ts

@@ -229,8 +229,19 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
     brandWebsite: z.ZodOptional<z.ZodString>;
     brandCountry: z.ZodOptional<z.ZodString>;
     brandFounded: z.ZodOptional<z.ZodNumber>;
-    brandBannerImage: z.ZodOptional<z.ZodString>;
+    highlights: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    faqs: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        question: z.ZodString;
+        answer: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        question: string;
+        answer: string;
+    }, {
+        question: string;
+        answer: string;
+    }>, "many">>;
     bundleKind: z.ZodOptional<z.ZodEnum<["special", "brand"]>>;
+    brandSlug: z.ZodOptional<z.ZodString>;
     bundlePrice: z.ZodOptional<z.ZodEffects<z.ZodNumber, number, number>>;
     bundleQueryRule: z.ZodOptional<z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
         type: z.ZodLiteral<"static">;
@@ -419,7 +430,12 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
         name: string;
         tier: number;
     }[];
+    faqs?: {
+        question: string;
+        answer: string;
+    }[] | undefined;
     description?: string | undefined;
+    brandSlug?: string | undefined;
     showOnHomepage?: boolean | undefined;
     categoryType?: "brand" | "category" | "sublisting" | "bundle" | undefined;
     bundleKind?: "brand" | "special" | undefined;
@@ -442,7 +458,7 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
     brandWebsite?: string | undefined;
     brandCountry?: string | undefined;
     brandFounded?: number | undefined;
-    brandBannerImage?: string | undefined;
+    highlights?: string[] | undefined;
     bundlePrice?: number | undefined;
     bundleQueryRule?: {
         type: "static";
@@ -513,7 +529,12 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
         name: string;
         tier: number;
     }[];
+    faqs?: {
+        question: string;
+        answer: string;
+    }[] | undefined;
     description?: string | undefined;
+    brandSlug?: string | undefined;
     showOnHomepage?: boolean | undefined;
     categoryType?: "brand" | "category" | "sublisting" | "bundle" | undefined;
     bundleKind?: "brand" | "special" | undefined;
@@ -536,7 +557,7 @@ export declare const categoryFirestoreSchema: z.ZodObject<{
     brandWebsite?: string | undefined;
     brandCountry?: string | undefined;
     brandFounded?: number | undefined;
-    brandBannerImage?: string | undefined;
+    highlights?: string[] | undefined;
     bundlePrice?: number | undefined;
     bundleQueryRule?: {
         type: "static";

package/dist/features/categories/schemas/index.js

@@ -76,8 +76,10 @@ export const categoryFirestoreSchema = z.object({
     brandWebsite: z.string().optional(),
     brandCountry: z.string().optional(),
     brandFounded: z.number().int().optional(),
-    brandBannerImage: z.string().optional(),
+    highlights: z.array(z.string()).optional(),
+    faqs: z.array(z.object({ question: z.string(), answer: z.string() })).optional(),
     bundleKind: z.enum(["special", "brand"]).optional(),
+    brandSlug: z.string().optional(),
     bundlePrice: rupeesSchema.optional(),
     bundleQueryRule: bundleQueryRuleSchema.optional(),
     bundleStockStatus: z.enum(["in_stock", "out_of_stock"]).optional(),

package/dist/features/categories/types/index.d.ts

@@ -37,6 +37,13 @@ export interface CategoryItem {
     brandCountry?: string;
     /** Brand founded year — only set when categoryType==="brand". */
     brandFounded?: number;
+    /** Short bullet points — "why shop this category/brand." */
+    highlights?: string[];
+    /** A handful of Q&A pairs shown on the category/brand detail page. */
+    faqs?: {
+        question: string;
+        answer: string;
+    }[];
     name: string;
     slug: string;
     description?: string;

package/dist/features/checkout/actions/checkout-value-otp-actions.d.ts

@@ -6,9 +6,23 @@
  * purpose from `checkout-actions.ts`'s third-party shipping consent OTP —
  * same crypto primitives, separate Firestore namespace and copy.
  */
-/** Sends a checkout-value OTP to the buyer's registered email. Returns masked email so the UI can confirm which inbox to check. */
-export declare function sendCheckoutValueOtp(userId: string, userEmail: string): Promise<{
-    maskedEmail: string;
+export type CheckoutValueOtpChannel = "email" | "whatsapp";
+/**
+ * Sends a checkout-value OTP either by email (default) or WhatsApp
+ * (opt-in — the buyer must explicitly choose it in the UI). WhatsApp phone
+ * is always resolved server-side from the selected shipping address —
+ * never trust a client-supplied phone number.
+ *
+ * If the chosen channel (and, for email, its skip-worthy fallback) is
+ * currently circuit-broken or unconfigured, the OTP gate is treated as
+ * satisfied (`skipped: true`) rather than blocking checkout — the caller
+ * must log this, since it is a security-relevant bypass even though
+ * user-authorized by the channel outage.
+ */
+export declare function sendCheckoutValueOtp(userId: string, userEmail: string, channel?: CheckoutValueOtpChannel, addressId?: string): Promise<{
+    maskedEmail?: string;
+    maskedPhone?: string;
+    skipped?: boolean;
 }>;
 /** Verifies the 6-digit checkout-value OTP and marks the Firestore record verified. */
 export declare function verifyCheckoutValueOtp(userId: string, code: string): Promise<void>;

package/dist/features/checkout/actions/checkout-value-otp-actions.js

@@ -8,18 +8,94 @@
  */
 import { timingSafeEqual } from "crypto";
 import { ValidationError } from "../../../errors";
+import { normalizeError } from "../../../errors/normalize";
 import { serverLogger } from "../../../monitoring";
 import { sendEmail } from "../../contact/email";
 import { getAdminDb } from "../../../providers/db-firebase";
 import { resolveDate } from "../../../utils";
-import { CHECKOUT_VALUE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS, hashOtp, generateOtpCode, checkoutValueOtpRef, enforceCheckoutValueOtpRateLimit, } from "../../auth/checkout-value-otp";
-/** Sends a checkout-value OTP to the buyer's registered email. Returns masked email so the UI can confirm which inbox to check. */
-export async function sendCheckoutValueOtp(userId, userEmail) {
+import { addressesRepository } from "../../addresses/repository/addresses.repository";
+import { siteSettingsRepository } from "../../admin/repository/site-settings.repository";
+import { sendWhatsAppBusinessMessage } from "../../whatsapp-bot/helpers/whatsapp";
+import { isChannelHealthy, withChannelRetry } from "../../../_internal/server/notifications/channel-health";
+import { CHECKOUT_VALUE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS, hashOtp, generateOtpCode, checkoutValueOtpRef, enforceCheckoutValueOtpRateLimit, buildCheckoutValueOtpMessage, } from "../../auth/checkout-value-otp";
+function maskEmail(userEmail) {
+    const [local, domain] = userEmail.split("@");
+    return domain
+        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
+        : "***";
+}
+/**
+ * Sends a checkout-value OTP either by email (default) or WhatsApp
+ * (opt-in — the buyer must explicitly choose it in the UI). WhatsApp phone
+ * is always resolved server-side from the selected shipping address —
+ * never trust a client-supplied phone number.
+ *
+ * If the chosen channel (and, for email, its skip-worthy fallback) is
+ * currently circuit-broken or unconfigured, the OTP gate is treated as
+ * satisfied (`skipped: true`) rather than blocking checkout — the caller
+ * must log this, since it is a security-relevant bypass even though
+ * user-authorized by the channel outage.
+ */
+export async function sendCheckoutValueOtp(userId, userEmail, channel = "email", addressId) {
     const db = getAdminDb();
     await enforceCheckoutValueOtpRateLimit(db, userId);
     const code = generateOtpCode();
     const codeHash = hashOtp(code);
     const expiresAt = new Date(Date.now() + CHECKOUT_VALUE_OTP_EXPIRY_MS);
+    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
+    if (channel === "whatsapp") {
+        if (!addressId) {
+            throw new ValidationError("Select a delivery address before sending the code via WhatsApp.");
+        }
+        const settings = await siteSettingsRepository.getSingleton().catch(() => null);
+        const creds = settings?.credentials ?? {};
+        const whatsappOtpEnabled = settings?.notificationChannels?.whatsapp?.otpEnabled === true;
+        const phoneNumberId = creds.whatsappPhoneNumberId?.trim() ?? "";
+        const accessToken = creds.whatsappCloudApiToken?.trim() ?? "";
+        const credsReady = phoneNumberId && accessToken && !phoneNumberId.includes("PLACEHOLDER") && !accessToken.includes("PLACEHOLDER");
+        if (!whatsappOtpEnabled || !credsReady) {
+            throw new ValidationError("WhatsApp verification isn't available right now — send the code by email instead.");
+        }
+        const address = await addressesRepository.findById(addressId);
+        const phone = address?.phone?.trim();
+        if (!phone) {
+            throw new ValidationError("The selected address has no phone number on file — send the code by email instead.");
+        }
+        if (!(await isChannelHealthy("whatsapp"))) {
+            serverLogger.warn("sendCheckoutValueOtp: WhatsApp channel unhealthy — skipping OTP gate", { uid: userId, channel });
+            return { skipped: true };
+        }
+        await checkoutValueOtpRef(db, userId).set({
+            codeHash,
+            expiresAt,
+            attempts: 0,
+            verified: false,
+            createdAt: new Date(),
+        });
+        const message = buildCheckoutValueOtpMessage(code, siteName);
+        try {
+            const sent = await withChannelRetry("whatsapp", async () => {
+                const ok = await sendWhatsAppBusinessMessage({ toPhone: phone, message, phoneNumberId, accessToken });
+                if (!ok)
+                    throw new Error("WhatsApp Cloud API returned a non-OK response");
+                return ok;
+            });
+            if (!sent)
+                throw new Error("WhatsApp send failed");
+        }
+        catch (err) {
+            void normalizeError(err);
+            serverLogger.error("Failed to send checkout value OTP via WhatsApp", { uid: userId, err });
+            throw new ValidationError("We couldn't send the verification code via WhatsApp — please try again, or send it by email instead.");
+        }
+        const maskedPhone = phone.length > 4 ? `${"*".repeat(phone.length - 4)}${phone.slice(-4)}` : "***";
+        serverLogger.info(`Checkout value OTP sent via WhatsApp: uid=${userId}`);
+        return { maskedPhone };
+    }
+    if (!(await isChannelHealthy("email"))) {
+        serverLogger.warn("sendCheckoutValueOtp: email channel unhealthy — skipping OTP gate", { uid: userId, channel });
+        return { skipped: true };
+    }
     await checkoutValueOtpRef(db, userId).set({
         codeHash,
         expiresAt,
@@ -27,24 +103,27 @@ export async function sendCheckoutValueOtp(userId, userEmail) {
         verified: false,
         createdAt: new Date(),
     });
-    const siteName = process.env.NEXT_PUBLIC_SITE_NAME || "LetItRip";
-    const [local, domain] = userEmail.split("@");
-    const maskedEmail = domain
-        ? `${local.length <= 2 ? "*".repeat(local.length) : local[0] + "*".repeat(local.length - 2) + local[local.length - 1]}@${domain}`
-        : "***";
-    const { error } = await sendEmail({
-        to: userEmail,
-        subject: `${siteName}: Verify your order`,
-        html: `
-      <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
-        <h2 style="margin-bottom:8px">Verify Your Order</h2>
-        <p style="color:#555">Your cart total requires verification before checkout. Enter this code to continue:</p>
-        <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
-        <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, please ignore this email.</p>
-      </div>
-    `,
-    });
-    if (error) {
+    const maskedEmail = maskEmail(userEmail);
+    try {
+        await withChannelRetry("email", async () => {
+            const { error } = await sendEmail({
+                to: userEmail,
+                subject: `${siteName}: Verify your order`,
+                html: `
+          <div style="font-family:sans-serif;max-width:480px;margin:0 auto;padding:24px">
+            <h2 style="margin-bottom:8px">Verify Your Order</h2>
+            <p style="color:#555">Your cart total requires verification before checkout. Enter this code to continue:</p>
+            <div style="font-size:36px;font-weight:bold;letter-spacing:8px;text-align:center;margin:24px 0;padding:16px;background:#f3f4f6;border-radius:8px">${code}</div>
+            <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, please ignore this email.</p>
+          </div>
+        `,
+            });
+            if (error)
+                throw new Error(String(error));
+        });
+    }
+    catch (err) {
+        void normalizeError(err);
         // Root-caused 2026-08-20: this used to be fire-and-forget — the
         // Firestore OTP doc was written and the caller always got back a
         // success response ("code sent") regardless of whether the email
@@ -52,7 +131,7 @@ export async function sendCheckoutValueOtp(userId, userEmail) {
         // unverified sending domain, outage) silently stranded the buyer
         // with a checkout they could never complete, since the OTP gate
         // gave no indication anything had gone wrong.
-        serverLogger.error("Failed to send checkout value OTP email", { uid: userId, error });
+        serverLogger.error("Failed to send checkout value OTP email", { uid: userId, err });
         throw new ValidationError("We couldn't send the verification code — please try again in a moment, or contact support if this keeps happening.");
     }
     serverLogger.info(`Checkout value OTP sent: uid=${userId}`);

package/dist/features/contact/components/ContactForm.js

@@ -1,8 +1,16 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { normalizeError } from "../../../errors/normalize";
-import { useState, useCallback } from "react";
+import { useEffect, useState, useCallback } from "react";
+import { z } from "zod";
 import { Button, Div, Form, Heading, Input, Span, Stack, Text, Textarea } from "../../../ui";
+import { useFormShellState, FormShellContext, FormErrorSummary } from "../../../ui/forms";
+const contactFormSchema = z.object({
+    name: z.string().min(1, "Name is required"),
+    email: z.string().email("Enter a valid email address"),
+    subject: z.string().min(1, "Subject is required"),
+    message: z.string().min(10, "Message must be at least 10 characters"),
+});
 const CLS_FIELD_ERROR = "text-error";
 const CLS_ERROR_BANNER = "rounded-lg bg-error-surface dark:bg-error-surface border border-error dark:border-error px-[var(--appkit-space-4)] py-[var(--appkit-space-3)] text-[length:var(--appkit-text-sm)] text-error dark:text-error";
 const INITIAL_FORM = {
@@ -17,6 +25,11 @@ export function ContactForm({ onSubmit, labels = {}, className = "", }) {
     const [submitted, setSubmitted] = useState(false);
     const [errors, setErrors] = useState({});
     const [submitError, setSubmitError] = useState(null);
+    const { shellCtx, validate: validateSchema } = useFormShellState(contactFormSchema);
+    useEffect(() => {
+        validateSchema(form);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [form, validateSchema]);
     const validate = () => {
         const newErrors = {};
         if (!form.name.trim())
@@ -56,7 +69,7 @@ export function ContactForm({ onSubmit, labels = {}, className = "", }) {
         return (_jsxs(Div, { className: `text-center ${className}`, padding: "y-3xl", children: [_jsx(Div, { textSize: "5xl", className: "mb-4", children: "\u2705" }), _jsx(Heading, { level: 2, className: "mb-2", children: labels.successTitle ?? "Message Sent!" }), _jsx(Text, { variant: "secondary", className: "mb-6", children: labels.successDescription ?? "We'll get back to you shortly." }), _jsx(Button, { type: "button", variant: "outline", onClick: () => setSubmitted(false), children: labels.sendAnotherButton ?? "Send another message" })] }));
     }
     const field = (id, label, placeholder, multiline) => (_jsxs(Stack, { gap: "xs", children: [_jsx("label", { htmlFor: id, className: "text-[length:var(--appkit-text-sm)] font-medium text-[var(--appkit-color-text-muted)]", children: label }), multiline ? (_jsx(Textarea, { id: id, value: form[id], onChange: (e) => setForm((f) => ({ ...f, [id]: e.target.value })), placeholder: placeholder, rows: 5, className: "w-full rounded-lg border border-neutral-200 border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] px-[var(--appkit-space-3)] py-[var(--appkit-space-2)] text-[length:var(--appkit-text-sm)] outline-none focus:ring-2 ring-primary/20 transition" })) : (_jsx(Input, { id: id, type: id === "email" ? "email" : "text", value: form[id], onChange: (e) => setForm((f) => ({ ...f, [id]: e.target.value })), placeholder: placeholder, className: "h-10" })), errors[id] && _jsx(Span, { size: "xs", className: CLS_FIELD_ERROR, children: errors[id] })] }));
-    return (_jsxs(Form, { onSubmit: handleSubmit, noValidate: true, className: className, spacing: "md", children: [_jsx(Heading, { level: 2, className: "mb-6", children: labels.title ?? "Send us a message" }), submitError && (_jsx(Div, { className: CLS_ERROR_BANNER, children: submitError })), field("name", labels.nameLabel ?? "Your Name", labels.namePlaceholder ?? "Enter your name"), field("email", labels.emailLabel ?? "Email", labels.emailPlaceholder ?? "your@email.com"), field("subject", labels.subjectLabel ?? "Subject", labels.subjectPlaceholder ?? "How can we help?"), field("message", labels.messageLabel ?? "Message", labels.messagePlaceholder ?? "Tell us more…", true), _jsx(Button, { type: "submit", variant: "primary", disabled: isSubmitting, className: "w-full sm:w-auto", children: isSubmitting
-                    ? (labels.submittingButton ?? "Sending…")
-                    : (labels.submitButton ?? "Send Message") })] }));
+    return (_jsx(FormShellContext.Provider, { value: shellCtx, children: _jsxs(Form, { onSubmit: handleSubmit, noValidate: true, className: className, spacing: "md", children: [_jsx(Heading, { level: 2, className: "mb-6", children: labels.title ?? "Send us a message" }), submitError && (_jsx(Div, { className: CLS_ERROR_BANNER, children: submitError })), field("name", labels.nameLabel ?? "Your Name", labels.namePlaceholder ?? "Enter your name"), field("email", labels.emailLabel ?? "Email", labels.emailPlaceholder ?? "your@email.com"), field("subject", labels.subjectLabel ?? "Subject", labels.subjectPlaceholder ?? "How can we help?"), field("message", labels.messageLabel ?? "Message", labels.messagePlaceholder ?? "Tell us more…", true), _jsx(FormErrorSummary, {}), _jsx(Button, { type: "submit", variant: "primary", disabled: isSubmitting, className: "w-full sm:w-auto", children: isSubmitting
+                        ? (labels.submittingButton ?? "Sending…")
+                        : (labels.submitButton ?? "Send Message") })] }) }));
 }

package/dist/features/contact/email.d.ts

@@ -6,6 +6,7 @@ type SendEmailOptions = Record<string, JsonValue> & {
     html?: string;
     text?: string;
     from?: string;
+    cc?: string | string[];
     replyTo?: string;
 };
 export declare function sendEmail(opts: SendEmailOptions): Promise<{

package/dist/features/contact/email.js

@@ -33,6 +33,9 @@ export async function sendEmail(opts) {
             html: typeof opts.html === "string" ? opts.html : "",
             text: typeof opts.text === "string" ? opts.text : undefined,
             from: typeof opts.from === "string" ? opts.from : undefined,
+            cc: typeof opts.cc === "string" || Array.isArray(opts.cc)
+                ? opts.cc
+                : undefined,
             replyTo: typeof opts.replyTo === "string" ? opts.replyTo : undefined,
             headers: typeof opts.headers === "object" && opts.headers
                 ? opts.headers

package/dist/features/events/components/AdminEventEditorView.js

@@ -2,14 +2,44 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { normalizeError } from "../../../errors/normalize";
 import { useApiMutation } from "@mohasinac/appkit/client";
-import React from "react";
+import React, { useEffect, useMemo } from "react";
+import { z } from "zod";
 import { useQuery } from "@tanstack/react-query";
 import { Alert, Button, Div, Grid, Heading, Input, Label, RichTextEditor, Row, Select, Stack, StackedViewShell, TagInput, Text, Textarea, Toggle, } from "../../../ui";
+import { FormShellContext, useFormShellState, applyZodIssues, FormErrorSummary } from "../../../ui/forms";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
 import { StepForm } from "../../shell";
 import { ProductInlineSelect } from "../../seller/components/ProductInlineSelect";
 import { CouponInlineSelect } from "../../seller/components/CouponInlineSelect";
+// Covers the cross-type required fields plus the two conditional rules the
+// "Settings" step already hand-enforces (offer coupon/code, poll min-2
+// options) — mirrored here as Zod so they're also live/summary-visible, not
+// just a submit-time gate. The many other per-type fields (survey/feedback
+// form-builder arrays, raffle/spin config) are deliberately left unvalidated
+// — modeling their full conditional shape correctly would need much deeper
+// per-type domain rules than this pass is scoped for.
+const eventDraftSchema = z.object({
+    type: z.string(),
+    title: z.string().min(1, "Title is required"),
+    startsAt: z.string().min(1, "Start date is required"),
+    endsAt: z.string().min(1, "End date is required"),
+    couponId: z.string(),
+    displayCode: z.string(),
+    pollOptions: z.array(z.object({ id: z.string(), label: z.string() })),
+}).passthrough().superRefine((v, ctx) => {
+    if (v.type === "offer") {
+        if (!v.couponId.trim()) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["couponId"], message: "Coupon is required for offer events" });
+        }
+        if (!v.displayCode.trim()) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["displayCode"], message: "Display code is required for offer events" });
+        }
+    }
+    if (v.type === "poll" && v.pollOptions.filter((o) => o.label.trim()).length < 2) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["pollOptions"], message: "Poll events require at least 2 options" });
+    }
+});
 const __P = {
     p4: "p-[var(--appkit-space-4)]",
 };
@@ -202,6 +232,11 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
     const [raffleWinnerName, setRaffleWinnerName] = React.useState("");
     const [raffleEntryCount, setRaffleEntryCount] = React.useState(null);
     const [raffleGithubUrl, setRaffleGithubUrl] = React.useState("");
+    const { shellCtx, setFieldError, validate } = useFormShellState(eventDraftSchema);
+    useEffect(() => {
+        validate(draft);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [draft, validate]);
     const update = React.useCallback((partial) => {
         setDraft((prev) => ({ ...prev, ...partial }));
         setSaveMessage(null);
@@ -295,6 +330,10 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
                 onSaved?.(savedId);
         },
         onError: (error) => {
+            const issues = error?.issues;
+            if (issues && issues.length > 0) {
+                applyZodIssues(issues, setFieldError);
+            }
             setSaveMessage(error instanceof Error ? error.message : "Save failed");
         },
     });
@@ -322,6 +361,7 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
     const steps = [
         {
             label: "Details",
+            fields: ["type", "title", "slug", "description", "startsAt", "endsAt", "tags"],
             validate: (values) => {
                 if (!values.title.trim())
                     return "Title is required";
@@ -338,10 +378,12 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
         },
         {
             label: "Media",
+            fields: ["coverImageUrl"],
             render: ({ values, onChange }) => (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Media" }), _jsx(Input, { label: "Cover Image URL (optional)", value: values.coverImageUrl, onChange: (e) => onChange({ coverImageUrl: e.target.value }), placeholder: "https://\u2026", helperText: "Direct link to the event cover image." })] })),
         },
         {
             label: "Settings",
+            fields: ["status", "allowGuestParticipation", "discountPercent", "saleBannerText", "couponId", "displayCode", "offerBannerText", "pollOptions", "resultsVisibility", "allowMultiSelect", "allowComment", "maxEntriesPerUser", "hasLeaderboard", "hasPointSystem", "pointsLabel", "entryReviewRequired", "surveyFields", "anonymous", "feedbackFields"],
             validate: (values) => {
                 if (values.type === "offer" && !values.couponId.trim())
                     return "Coupon ID is required for offer events";
@@ -355,6 +397,7 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
         },
         {
             label: "Raffle / Spin",
+            fields: ["hasRaffle", "raffleType", "raffleTopN", "rafflePrize", "rafflePrizeCouponId", "rafflePrizeProductIds", "spinPrizes", "spinMaxPerUser", "spinWindowStart", "spinWindowEnd"],
             render: ({ values, onChange }) => {
                 const isRaffleType = values.type === "raffle" || values.type === "spin_wheel";
                 const showRaffleConfig = isRaffleType || values.hasRaffle;
@@ -364,7 +407,16 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
         },
     ];
     const alertSection = eventQuery.error ? (_jsx(Alert, { variant: "error", title: "Could not load event", children: eventQuery.error instanceof Error ? eventQuery.error.message : "Unknown error" })) : null;
-    const formContent = (_jsxs(Stack, { gap: "sm", children: [alertSection, _jsx(StepForm, { steps: steps, values: draft, onChange: update, onComplete: () => { saveMutation.mutate(); }, formId: "admin-event", currentStep: currentStep, onStepChange: setCurrentStep, completeLabel: isEdit ? "Save Changes" : "Create Event", isLoading: isLoading }), saveMessage && (_jsx(Alert, { variant: saveMessage.toLowerCase().includes("fail") || saveMessage.toLowerCase().includes("error") ? "error" : "success", title: "Save status", children: saveMessage }))] }));
+    const fieldToStepIndex = useMemo(() => {
+        const map = {};
+        steps.forEach((step, i) => {
+            step.fields?.forEach((field) => { map[field] = i; });
+        });
+        return map;
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [steps.length]);
+    const wizardShellCtx = useMemo(() => ({ ...shellCtx, fieldToStepIndex, goToStep: (n) => setCurrentStep(n) }), [shellCtx, fieldToStepIndex, setCurrentStep]);
+    const formContent = (_jsxs(Stack, { gap: "sm", children: [alertSection, _jsxs(FormShellContext.Provider, { value: wizardShellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(StepForm, { steps: steps, values: draft, onChange: update, onComplete: () => { saveMutation.mutate(); }, formId: "admin-event", currentStep: currentStep, onStepChange: setCurrentStep, completeLabel: isEdit ? "Save Changes" : "Create Event", isLoading: isLoading })] }), saveMessage && (_jsx(Alert, { variant: saveMessage.toLowerCase().includes("fail") || saveMessage.toLowerCase().includes("error") ? "error" : "success", title: "Save status", children: saveMessage }))] }));
     if (embedded) {
         return _jsx(Div, { className: `${__O.yAuto} ${__P.p4}`, children: formContent });
     }

package/dist/features/events/components/AdminEventEntriesView.d.ts

@@ -1,22 +1,8 @@
 import React from "react";
-import type { StackedViewShellProps } from "../../../ui";
-export interface AdminEventEntriesViewProps extends Omit<StackedViewShellProps, "sections"> {
+export interface AdminEventEntriesViewProps {
     eventId?: string;
     entriesEndpoint?: (eventId: string) => string;
     entryReviewEndpoint?: (eventId: string, entryId: string) => string;
     statsEndpoint?: (eventId: string) => string;
-    children?: React.ReactNode;
-    /** Back-link and event title header */
-    renderHeader?: () => React.ReactNode;
-    /** Stats banner (total / approved / flagged counts) */
-    renderStats?: () => React.ReactNode;
-    /** Filter bar (status dropdown, sort, search) */
-    renderFilters?: () => React.ReactNode;
-    /** Entries data table */
-    renderTable?: () => React.ReactNode;
-    /** Pagination footer */
-    renderPagination?: () => React.ReactNode;
-    /** Entry review side-drawer */
-    renderReviewDrawer?: () => React.ReactNode;
 }
-export declare function AdminEventEntriesView({ eventId, entriesEndpoint, entryReviewEndpoint, statsEndpoint, renderHeader, renderStats, renderFilters, renderTable, renderPagination, renderReviewDrawer, ...rest }: AdminEventEntriesViewProps): React.JSX.Element;
+export declare function AdminEventEntriesView({ eventId, entriesEndpoint, entryReviewEndpoint, statsEndpoint, }: AdminEventEntriesViewProps): React.JSX.Element;