@mohasinac/appkit 4.14.0 → 4.15.0

package/dist/_internal/shared/features/cart/schema.d.ts

@@ -8,7 +8,7 @@ export declare const addToCartSchema: z.ZodObject<{
     storeId: z.ZodString;
     storeName: z.ZodDefault<z.ZodString>;
     quantity: z.ZodDefault<z.ZodNumber>;
-    listingType: z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "classified", "digital-code", "live"]>;
+    listingType: z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "classified", "digital-code", "live", "art", "stickers"]>;
     isOffer: z.ZodOptional<z.ZodBoolean>;
     offerId: z.ZodOptional<z.ZodString>;
     lockedPrice: z.ZodOptional<z.ZodNumber>;
@@ -16,7 +16,7 @@ export declare const addToCartSchema: z.ZodObject<{
     currency: string;
     storeId: string;
     price: number;
-    listingType: "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
+    listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
     productId: string;
     productTitle: string;
     quantity: number;
@@ -28,7 +28,7 @@ export declare const addToCartSchema: z.ZodObject<{
 }, {
     storeId: string;
     price: number;
-    listingType: "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
+    listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
     productId: string;
     productTitle: string;
     currency?: string | undefined;
@@ -66,7 +66,7 @@ export declare const mergeGuestCartSchema: z.ZodObject<{
         storeId: z.ZodString;
         storeName: z.ZodDefault<z.ZodString>;
         quantity: z.ZodDefault<z.ZodNumber>;
-        listingType: z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "classified", "digital-code", "live"]>;
+        listingType: z.ZodEnum<["standard", "auction", "pre-order", "prize-draw", "classified", "digital-code", "live", "art", "stickers"]>;
         isOffer: z.ZodOptional<z.ZodBoolean>;
         offerId: z.ZodOptional<z.ZodString>;
         lockedPrice: z.ZodOptional<z.ZodNumber>;
@@ -74,7 +74,7 @@ export declare const mergeGuestCartSchema: z.ZodObject<{
         currency: string;
         storeId: string;
         price: number;
-        listingType: "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
+        listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
         productId: string;
         productTitle: string;
         quantity: number;
@@ -86,7 +86,7 @@ export declare const mergeGuestCartSchema: z.ZodObject<{
     }, {
         storeId: string;
         price: number;
-        listingType: "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
+        listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
         productId: string;
         productTitle: string;
         currency?: string | undefined;
@@ -102,7 +102,7 @@ export declare const mergeGuestCartSchema: z.ZodObject<{
         currency: string;
         storeId: string;
         price: number;
-        listingType: "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
+        listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
         productId: string;
         productTitle: string;
         quantity: number;
@@ -116,7 +116,7 @@ export declare const mergeGuestCartSchema: z.ZodObject<{
     guestItems: {
         storeId: string;
         price: number;
-        listingType: "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
+        listingType: "art" | "stickers" | "classified" | "standard" | "auction" | "pre-order" | "prize-draw" | "digital-code" | "live";
         productId: string;
         productTitle: string;
         currency?: string | undefined;
@@ -128,5 +128,10 @@ export declare const mergeGuestCartSchema: z.ZodObject<{
         isOffer?: boolean | undefined;
     }[];
 }>;
-export type AddToCartInput = z.infer<typeof addToCartSchema>;
+/**
+ * Renamed from `AddToCartInput` 2026-08-24 (W3) — `features/cart/schemas/
+ * firestore.ts` declares its own hand-written `AddToCartInput`, and a consumer
+ * importing the name had no way to tell which one it got.
+ */
+export type AddToCartActionInput = z.infer<typeof addToCartSchema>;
 export type MergeGuestCartInput = z.infer<typeof mergeGuestCartSchema>;

package/dist/_internal/shared/features/cart/schema.js

@@ -10,6 +10,19 @@ const cartItemBaseSchema = z.object({
     quantity: z.number().int().min(1).max(99).default(1),
     // SB1-G Phase 4 — canonical listing-kind snapshot.
     // SB-UNI-D — "bundle" removed from the listing-kind enum.
+    /*
+     * All NINE listing types. `art` and `stickers` were missing until
+     * 2026-08-24 (W3) — added to the union, the plugin registry, the capability
+     * map and the Sieve alias map, but not here.
+     *
+     * Not a live bug today, and verified rather than assumed (Rule #4): the real
+     * add-to-cart path is `POST /api/cart`, which takes only {productId,
+     * quantity} and derives the type server-side via `normalizeListingType`,
+     * never validating it against an enum. This enum sits on paths an art or
+     * sticker listing cannot currently reach. It was a trap waiting for the
+     * first caller that did — the third instalment of Root Cause #58, where a
+     * union member is added everywhere except the one allowlist that gates it.
+     */
     listingType: z.enum([
         "standard",
         "auction",
@@ -18,6 +31,8 @@ const cartItemBaseSchema = z.object({
         "classified",
         "digital-code",
         "live",
+        "art",
+        "stickers",
     ]),
     isOffer: z.boolean().optional(),
     offerId: z.string().optional(),

package/dist/_internal/shared/features/products/schema.d.ts

@@ -289,7 +289,7 @@ export declare const preOrderInputSchema: z.ZodObject<{
     tags: string[];
     listingType: "pre-order";
     preOrderDeliveryDate: string;
-    preOrderProductionStatus: "in_production" | "upcoming" | "ready_to_ship";
+    preOrderProductionStatus: "upcoming" | "in_production" | "ready_to_ship";
     preOrderCancellable: boolean;
     features?: string[] | undefined;
     description?: string | undefined;
@@ -330,7 +330,7 @@ export declare const preOrderInputSchema: z.ZodObject<{
     shippingPaidBy?: "seller" | "buyer" | undefined;
     preOrderDepositPercent?: number | undefined;
     preOrderMaxQuantity?: number | undefined;
-    preOrderProductionStatus?: "in_production" | "upcoming" | "ready_to_ship" | undefined;
+    preOrderProductionStatus?: "upcoming" | "in_production" | "ready_to_ship" | undefined;
     preOrderCancellable?: boolean | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;

package/dist/_internal/shared/history/history.d.ts

@@ -59,6 +59,28 @@ export declare function withHistory<TPatch extends FirestoreDocument>(current: F
      * a reader actually wants on the timeline.
      */
     extraChanges?: Record<string, FieldChange>;
+    /**
+     * This entity's PII field names — pass the same list the repository hands
+     * to `encryptPiiFields` (`ORDER_PII_FIELDS`, `OFFER_PII_FIELDS`, …).
+     *
+     * 🛑 Not optional in spirit. `encryptPiiFields` is a FLAT top-level loop:
+     * it reads `doc[field]`, skips anything that is not a string, and never
+     * descends into arrays or nested objects. `statusHistory` is an array of
+     * objects, so a PII value that reaches `changes` is written to Firestore
+     * **in plaintext** and `mapDoc`'s decrypt never touches it on the way
+     * back out — a leak with no error and no visible symptom.
+     *
+     * Scrubbing here rather than at each call site is deliberate: a
+     * convention that says "don't put PII in history" is one forgetful
+     * adopter away from that leak, and 9 more entities adopt this primitive.
+     *
+     * SCOPE: this scrubs `changes` structurally, at any depth — a key whose
+     * NAME is PII is dropped. It cannot scrub `note`, which is free text the
+     * user themselves authored (a seller's counter-offer note). The rule
+     * there is a call-site one: pass the author's own text, never an identity
+     * field lifted off the document.
+     */
+    piiFields?: readonly string[];
     historyField?: string;
     truncatedField?: string;
     now?: Date;

package/dist/_internal/shared/history/history.js

@@ -99,6 +99,46 @@ export function diffTrackedFields(current, patch, tracked) {
     }
     return changes;
 }
+/**
+ * Remove PII-named keys from a `changes` map, at any depth.
+ *
+ * Two passes are needed because PII can arrive two ways: as a tracked field
+ * that happens to be PII (`buyerEmail` in `changes`), or nested inside a
+ * value a caller contributed via `extraChanges` (a refund's `reason`, an
+ * offer note object). `encryptPiiFields` catches neither — it only ever
+ * looks at top-level string properties of the document itself.
+ *
+ * Scrubbed rather than redacted-in-place: an entry that silently omits a
+ * field is honest, whereas one containing `"[redacted]"` invites a reader to
+ * assume the real value is recoverable somewhere.
+ */
+function scrubPii(changes, piiFields) {
+    if (!piiFields?.length)
+        return changes;
+    const pii = new Set(piiFields);
+    const stripNested = (v) => {
+        if (v == null || typeof v !== "object")
+            return v;
+        if (v instanceof Date)
+            return v;
+        if (Array.isArray(v))
+            return v.map(stripNested);
+        const out = {};
+        for (const [k, val] of Object.entries(v)) {
+            if (pii.has(k))
+                continue;
+            out[k] = stripNested(val);
+        }
+        return out;
+    };
+    const result = {};
+    for (const [field, change] of Object.entries(changes)) {
+        if (pii.has(field))
+            continue; // the tracked field itself is PII
+        result[field] = { from: stripNested(change.from), to: stripNested(change.to) };
+    }
+    return result;
+}
 export function buildHistoryEntry(input) {
     const entry = {
         at: input.now ?? new Date(),
@@ -136,7 +176,7 @@ export function appendHistoryEntry(existing, entry, previousTruncatedCount = 0,
  * writes its patch unchanged, so an untracked update never grows the array.
  */
 export function withHistory(current, patch, opts) {
-    const changes = { ...diffTrackedFields(current, patch, opts.tracked), ...opts.extraChanges };
+    const changes = scrubPii({ ...diffTrackedFields(current, patch, opts.tracked), ...opts.extraChanges }, opts.piiFields);
     if (Object.keys(changes).length === 0)
         return null;
     const historyField = opts.historyField ?? "statusHistory";

package/dist/client.d.ts

@@ -112,6 +112,17 @@ export { useBulkSelection } from "./react/hooks/useBulkSelection";
 export type { UseBulkSelectionOptions, UseBulkSelectionReturn } from "./react/hooks/useBulkSelection";
 export { useEntityDelete } from "./react/hooks/useEntityDelete";
 export type { UseEntityDeleteOptions, UseEntityDeleteReturn } from "./react/hooks/useEntityDelete";
+export { storeCategoryFormSchema, storeCategoryCreateSchema, type StoreCategoryFormValues, } from "./features/store-extensions/schemas/store-category-form";
+export { payoutMethodFormSchema, payoutMethodCreateSchema, payoutMethodUpdateSchema, type PayoutMethodFormValues, } from "./features/store-extensions/schemas/payout-method-form";
+export { groupedListingFormSchema, groupedListingCreateSchema, groupedListingUpdateSchema, type GroupedListingFormValues, } from "./features/grouped/schemas/grouped-listing-form";
+export { navItemFormSchema, navItemCreateSchema, navItemUpdateSchema, type NavItemFormValues, } from "./features/admin/schemas/nav-item-form";
+export { customRoleFormSchema, customRoleCreateSchema, customRoleUpdateSchema, isKnownPermission, type CustomRoleFormValues, } from "./features/store-extensions/schemas/custom-role-form";
+export { SCAMMER_STATUS_LABEL, SCAMMER_STATUS_BADGE, SCAMMER_STATUS_OPTIONS, toScammerStatus, } from "./features/scams/constants/scammer-status-display";
+export { ReviewDecisionModal, type ReviewDecisionModalProps, } from "./features/store-extensions/components/ReviewDecisionModal";
+export { moderationReviewFormSchema, moderationReviewUpdateSchema, MODERATION_REVIEWER_STATUSES, type ModerationReviewFormValues, } from "./features/store-extensions/schemas/moderation-review-form";
+export { reportReviewFormSchema, reportReviewUpdateSchema, REPORT_REVIEWER_STATUSES, REPORT_TERMINAL_STATUSES, type ReportReviewFormValues, } from "./features/store-extensions/schemas/report-review-form";
+export { shippingConfigFormSchema, shippingConfigCreateSchema, shippingConfigUpdateSchema, type ShippingConfigFormValues, } from "./features/store-extensions/schemas/shipping-config-form";
+export { listingTemplateFormSchema, listingTemplateCreateSchema, listingTemplateUpdateSchema, type ListingTemplateFormValues, } from "./features/store-extensions/schemas/listing-template-form";
 export { ROUTES, PUBLIC_ROUTES, PROTECTED_ROUTES, AUTH_ROUTES } from "./constants/index";
 export { SORT_DIR, sortBy } from "./constants/sort";
 export { SIEVE_OP, sieveFilter, sieveAnd, sieveMultiEq } from "./utils/sieve-builder";
@@ -381,7 +392,7 @@ export { SellerDigitalCodesView } from "./features/seller/components/SellerDigit
 export type { SellerDigitalCodesViewProps } from "./features/seller/components/SellerDigitalCodesView";
 export { SellerLiveView } from "./features/seller/components/SellerLiveView";
 export type { SellerLiveViewProps } from "./features/seller/components/SellerLiveView";
-export { SCHEMAS, lookupApiSchema, lookupFirestoreSchema, } from "./schemas/index";
+export { SCHEMAS, lookupApiSchema, lookupFormSchema, lookupFirestoreSchema, } from "./schemas/index";
 export type { ApiRouteKey, ApiRouteSchema, FirestoreDocument, FirestoreValue, FormFieldValue, FormValues, HttpVerb, JsonArray, JsonObject, JsonObjectWithUndefined, JsonPrimitive, JsonValue, JsonValueWithUndefined, RegisteredApiRouteKey, RegisteredFirestoreCollection, RegisteredFormId, RegisteredRtdbChannel, RegisteredSieveCollection, RegisteredStorageOp, RegisteredWebhookProvider, RegistryEntry, SchemaRegistry, SchemasShape, WebhookSchemaBucket, } from "./schemas/index";
 export { normalizeError, getErrorMessage, isApiNormalized, isAppNormalized, isFirebaseAuthNormalized, isFirebaseFirestoreNormalized, isFirebaseStorageNormalized, isNativeNormalized, isNetworkNormalized, isUnknownNormalized, isZodNormalized, } from "./errors/normalize";
 export type { NormalizedError, NormalizedApiError, NormalizedAppError, NormalizedFirebaseAuthError, NormalizedFirebaseFirestoreError, NormalizedFirebaseStorageError, NormalizedNativeError, NormalizedNetworkError, NormalizedUnknownThrownValue, NormalizedZodError, } from "./errors/normalize";
@@ -390,7 +401,7 @@ export type { PaymentProofReviewMessageInput } from "./features/whatsapp-bot/typ
 export type { AdminNotificationDocument, ItemRequestDocument, ModerationQueueDocument, ReportDocument, CustomRoleDocument, AnalyticsCardDocument, ListingTemplateDocument, } from "./features/store-extensions/index";
 export { CommandPalette, useCommandPaletteHotkey } from "./features/shell/index";
 export type { CommandPaletteGroup } from "./features/shell/index";
-export { AdminBlogEditorView, AdminBundleEditorView, AdminCarouselEditorView, AdminCategoryEditorView, AdminCouponEditorView, AdminFaqEditorView, AdminOrderEditorView, AdminPayoutMarkPaidModal, AdminAuditLogView, ViewAuditLogEntryModal, AdminProductEditorView, AdminScammerEditorView, AdminStoreEditorView, AdminSublistingCategoryEditorView, AdminSupportTicketDetailView, } from "./features/admin/index";
+export { AdminBlogEditorView, AdminBundleEditorView, AdminCarouselEditorView, AdminCategoryEditorView, AdminCouponEditorView, AdminFaqEditorView, AdminFeatureEditorView, AdminOrderEditorView, AdminPayoutMarkPaidModal, AdminAuditLogView, ViewAuditLogEntryModal, AdminProductEditorView, AdminScammerEditorView, AdminStoreEditorView, AdminSublistingCategoryEditorView, AdminSupportTicketDetailView, } from "./features/admin/index";
 export type { AdminStoreEditorViewProps, AdminPayoutMarkPaidModalProps, AdminAuditLogViewProps, AuditLogEntryDetail, ViewAuditLogEntryModalProps } from "./features/admin/index";
 export { ADMIN_CHECKOUT_BYPASS_FLAG_KEY } from "./features/admin/schemas/firestore";
 export { SpinWheelView, EventRaffleEntryForm } from "./features/events/index";

package/dist/client.js

@@ -178,6 +178,24 @@ export { useUrlTable } from "./react/hooks/useUrlTable";
 export { useBulkSelection } from "./react/hooks/useBulkSelection";
 export { useEntityDelete } from "./react/hooks/useEntityDelete";
 // Client-safe constants, UI primitives, and views
+// Storefront-category form schema — isomorphic (the page parses it client-side,
+// the route parses the same one server-side).
+export { storeCategoryFormSchema, storeCategoryCreateSchema, } from "./features/store-extensions/schemas/store-category-form";
+// Payout-method + listing-template form schemas — isomorphic: the pages parse
+// them client-side and the routes parse the SAME ones server-side.
+export { payoutMethodFormSchema, payoutMethodCreateSchema, payoutMethodUpdateSchema, } from "./features/store-extensions/schemas/payout-method-form";
+export { groupedListingFormSchema, groupedListingCreateSchema, groupedListingUpdateSchema, } from "./features/grouped/schemas/grouped-listing-form";
+export { navItemFormSchema, navItemCreateSchema, navItemUpdateSchema, } from "./features/admin/schemas/nav-item-form";
+export { customRoleFormSchema, customRoleCreateSchema, customRoleUpdateSchema, isKnownPermission, } from "./features/store-extensions/schemas/custom-role-form";
+// Client-only: deliberately NOT added to `features/store-extensions/index.ts`,
+// which the schema registry's import chain reaches — a "use client" React tree
+// re-exported from there would be pulled into every API route (the W4 trap).
+export { SCAMMER_STATUS_LABEL, SCAMMER_STATUS_BADGE, SCAMMER_STATUS_OPTIONS, toScammerStatus, } from "./features/scams/constants/scammer-status-display";
+export { ReviewDecisionModal, } from "./features/store-extensions/components/ReviewDecisionModal";
+export { moderationReviewFormSchema, moderationReviewUpdateSchema, MODERATION_REVIEWER_STATUSES, } from "./features/store-extensions/schemas/moderation-review-form";
+export { reportReviewFormSchema, reportReviewUpdateSchema, REPORT_REVIEWER_STATUSES, REPORT_TERMINAL_STATUSES, } from "./features/store-extensions/schemas/report-review-form";
+export { shippingConfigFormSchema, shippingConfigCreateSchema, shippingConfigUpdateSchema, } from "./features/store-extensions/schemas/shipping-config-form";
+export { listingTemplateFormSchema, listingTemplateCreateSchema, listingTemplateUpdateSchema, } from "./features/store-extensions/schemas/listing-template-form";
 export { ROUTES, PUBLIC_ROUTES, PROTECTED_ROUTES, AUTH_ROUTES } from "./constants/index";
 export { SORT_DIR, sortBy } from "./constants/sort";
 export { SIEVE_OP, sieveFilter, sieveAnd, sieveMultiEq } from "./utils/sieve-builder";
@@ -368,7 +386,7 @@ export { SellerLiveView } from "./features/seller/components/SellerLiveView";
 // ── Central schema registry (W1) ──────────────────────────────────────────────
 // Pure Zod, isomorphic — re-exported here so client code can resolve schemas
 // without pulling in the full server barrel.
-export { SCHEMAS, lookupApiSchema, lookupFirestoreSchema, } from "./schemas/index";
+export { SCHEMAS, lookupApiSchema, lookupFormSchema, lookupFirestoreSchema, } from "./schemas/index";
 // ── W3 catch-clause normalizer ──────────────────────────────────────────────
 export { normalizeError, getErrorMessage, isApiNormalized, isAppNormalized, isFirebaseAuthNormalized, isFirebaseFirestoreNormalized, isFirebaseStorageNormalized, isNativeNormalized, isNetworkNormalized, isUnknownNormalized, isZodNormalized, } from "./errors/normalize";
 // [CLIENT-SAFE] Pure wa.me share-link message builder — imported directly
@@ -376,7 +394,7 @@ export { normalizeError, getErrorMessage, isApiNormalized, isAppNormalized, isFi
 // never touches the sibling crypto-importing helpers.
 export { buildPaymentProofReviewMessage } from "./features/whatsapp-bot/helpers/payment-proof-message";
 export { CommandPalette, useCommandPaletteHotkey } from "./features/shell/index";
-export { AdminBlogEditorView, AdminBundleEditorView, AdminCarouselEditorView, AdminCategoryEditorView, AdminCouponEditorView, AdminFaqEditorView, AdminOrderEditorView, AdminPayoutMarkPaidModal, AdminAuditLogView, ViewAuditLogEntryModal, AdminProductEditorView, AdminScammerEditorView, AdminStoreEditorView, AdminSublistingCategoryEditorView, AdminSupportTicketDetailView, } from "./features/admin/index";
+export { AdminBlogEditorView, AdminBundleEditorView, AdminCarouselEditorView, AdminCategoryEditorView, AdminCouponEditorView, AdminFaqEditorView, AdminFeatureEditorView, AdminOrderEditorView, AdminPayoutMarkPaidModal, AdminAuditLogView, ViewAuditLogEntryModal, AdminProductEditorView, AdminScammerEditorView, AdminStoreEditorView, AdminSublistingCategoryEditorView, AdminSupportTicketDetailView, } from "./features/admin/index";
 export { ADMIN_CHECKOUT_BYPASS_FLAG_KEY } from "./features/admin/schemas/firestore";
 export { SpinWheelView, EventRaffleEntryForm } from "./features/events/index";
 export { Card, CardBody } from "./ui/index";

package/dist/constants/field-names.d.ts

@@ -151,10 +151,9 @@ export declare const PRODUCT_FIELDS: {
         readonly WINNER: "winner";
     };
     readonly PRE_ORDER_PRODUCTION_STATUS_VALUES: {
+        readonly UPCOMING: "upcoming";
         readonly IN_PRODUCTION: "in_production";
-        readonly READY: "ready";
-        readonly DELAYED: "delayed";
-        readonly CANCELLED: "cancelled";
+        readonly READY_TO_SHIP: "ready_to_ship";
     };
     readonly PRIZE_REVEAL_STATUS_VALUES: {
         readonly PENDING: "pending";
@@ -246,9 +245,11 @@ export declare const ORDER_FIELDS: {
     };
     readonly PAYMENT_STATUS_VALUES: {
         readonly PENDING: "pending";
+        readonly PROCESSING: "processing";
         readonly PAID: "paid";
         readonly FAILED: "failed";
         readonly REFUNDED: "refunded";
+        readonly PARTIAL_REFUND: "partial_refund";
     };
     readonly PAYOUT_STATUS_VALUES: {
         readonly ELIGIBLE: "eligible";
@@ -322,6 +323,8 @@ export declare const BID_FIELDS: {
         readonly WON: "won";
         readonly LOST: "lost";
         readonly CANCELLED: "cancelled";
+        /** Won, then the buyer let the payment window lapse. Was missing here. */
+        readonly FORFEITED: "forfeited";
     };
 };
 export declare const AD_FIELDS: {
@@ -443,7 +446,6 @@ export declare const PAYOUT_FIELDS: {
         readonly PROCESSING: "processing";
         readonly PAID: "paid";
         readonly FAILED: "failed";
-        readonly CANCELLED: "cancelled";
     };
 };
 export declare const STORE_FIELDS: {
@@ -687,9 +689,10 @@ export declare const SCAMMER_FIELDS: {
     readonly VERIFIED_BY: "verifiedBy";
     readonly CREATED_AT: "createdAt";
     readonly STATUS_VALUES: {
-        readonly PENDING: "pending";
+        readonly PENDING_REVIEW: "pending_review";
         readonly VERIFIED: "verified";
         readonly REJECTED: "rejected";
+        readonly REMOVED: "removed";
     };
 };
 export declare const SUPPORT_TICKET_FIELDS: {
@@ -712,7 +715,6 @@ export declare const SUPPORT_TICKET_FIELDS: {
     readonly PRIORITY_VALUES: {
         readonly LOW: "low";
         readonly NORMAL: "normal";
-        readonly MEDIUM: "medium";
         readonly HIGH: "high";
         readonly URGENT: "urgent";
     };

package/dist/constants/field-names.js

@@ -159,11 +159,19 @@ export const PRODUCT_FIELDS = {
         SELLER: "seller",
         WINNER: "winner",
     },
+    /*
+     * Corrected 2026-08-24 (W3). This block used to read
+     * {in_production, ready, delayed, cancelled} — and `ready`, `delayed` and
+     * `cancelled` were values no product has ever held. `ProductDocument`
+     * declares "upcoming" | "in_production" | "ready_to_ship", the write schema
+     * agrees, and all 9 seeded pre-orders store one of those three. It had zero
+     * consumers, which is the only reason it never produced a visibly broken
+     * filter chip (Recurrent Root Cause #33).
+     */
     PRE_ORDER_PRODUCTION_STATUS_VALUES: {
+        UPCOMING: "upcoming",
         IN_PRODUCTION: "in_production",
-        READY: "ready",
-        DELAYED: "delayed",
-        CANCELLED: "cancelled",
+        READY_TO_SHIP: "ready_to_ship",
     },
     PRIZE_REVEAL_STATUS_VALUES: {
         PENDING: "pending",
@@ -261,11 +269,19 @@ export const ORDER_FIELDS = {
         RETURN_REQUESTED: "return_requested",
         REFUNDED: "refunded",
     },
+    /*
+     * Corrected 2026-08-24 (W3) — `processing` and `partial_refund` were
+     * missing, so this listed 4 of the real 6. `PaymentStatus`
+     * (features/orders/types/index.ts) is the source; a partial refund is a
+     * state real orders reach, and W2 put it on the order timeline.
+     */
     PAYMENT_STATUS_VALUES: {
         PENDING: "pending",
+        PROCESSING: "processing",
         PAID: "paid",
         FAILED: "failed",
         REFUNDED: "refunded",
+        PARTIAL_REFUND: "partial_refund",
     },
     PAYOUT_STATUS_VALUES: {
         ELIGIBLE: "eligible",
@@ -339,12 +355,22 @@ export const BID_FIELDS = {
     AUTO_MAX_BID: "autoMaxBid",
     CREATED_AT: "createdAt",
     UPDATED_AT: "updatedAt",
+    /*
+     * Corrected 2026-08-24 (W3). Verified against the feature's own union AND
+     * against what is actually stored. This file is a deliberate LEAF — it
+     * imports nothing, and `features/products/types/index.ts` imports IT — so it
+     * cannot re-export the feature unions without a cycle. The values are
+     * therefore duplicated on purpose, and `audit-field-names-union-parity`
+     * blocks them drifting again.
+     */
     STATUS_VALUES: {
         ACTIVE: "active",
         OUTBID: "outbid",
         WON: "won",
         LOST: "lost",
         CANCELLED: "cancelled",
+        /** Won, then the buyer let the payment window lapse. Was missing here. */
+        FORFEITED: "forfeited",
     },
 };
 // ============================================================================
@@ -476,12 +502,17 @@ export const PAYOUT_FIELDS = {
     STATUS: "status",
     CREATED_AT: "createdAt",
     UPDATED_AT: "updatedAt",
+    /*
+     * Corrected 2026-08-24 (W3) — `cancelled` was listed here and is NOT a
+     * member of `PayoutStatus` (features/payments/schemas/firestore.ts:18,
+     * pending|processing|paid|failed). A chip or badge keyed on it could only
+     * ever match zero rows (Recurrent Root Cause #33).
+     */
     STATUS_VALUES: {
         PENDING: "pending",
         PROCESSING: "processing",
         PAID: "paid",
         FAILED: "failed",
-        CANCELLED: "cancelled",
     },
 };
 // ============================================================================
@@ -771,10 +802,17 @@ export const SCAMMER_FIELDS = {
     REPORTED_BY: "reportedBy",
     VERIFIED_BY: "verifiedBy",
     CREATED_AT: "createdAt",
+    /*
+     * Corrected 2026-08-24 (W3). Two defects: the real stored value is
+     * `pending_review`, not `pending` (the seeded scammer profile stores
+     * `pending_review`), and `removed` was missing entirely. Already flagged in
+     * CLAUDE.md's Root Cause #34 and never actioned.
+     */
     STATUS_VALUES: {
-        PENDING: "pending",
+        PENDING_REVIEW: "pending_review",
         VERIFIED: "verified",
         REJECTED: "rejected",
+        REMOVED: "removed",
     },
 };
 // ============================================================================
@@ -797,10 +835,14 @@ export const SUPPORT_TICKET_FIELDS = {
         RESOLVED: "resolved",
         CLOSED: "closed",
     },
+    /*
+     * Corrected 2026-08-24 (W3) — `medium` is not a member of
+     * `TicketPriorityValues` (low|normal|high|urgent). `normal` is the
+     * middle value.
+     */
     PRIORITY_VALUES: {
         LOW: "low",
         NORMAL: "normal",
-        MEDIUM: "medium",
         HIGH: "high",
         URGENT: "urgent",
     },

package/dist/features/account/components/UserBidsView.js

@@ -1,9 +1,11 @@
 "use client";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { sortBy, sieveFilter, SIEVE_OP } from "../../../utils/sieve-builder";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints";
 import { ROUTES } from "../../../constants/index";
-import { Div, Span, Stack, TextLink } from "../../../ui";
+import { useState } from "react";
+import { Div, Span, Stack, TextLink, RecordDetailModal } from "../../../ui";
+import { buildBidDetailFields, bidStatusBadge } from "../../auctions/components/bid-detail-fields";
 import { FieldSelect } from "../../../ui/forms";
 import { AuctionBidsTable } from "../../auctions/components/AuctionBidsTable";
 import { DataListingView } from "../../admin/components/DataListingView";
@@ -21,6 +23,11 @@ const STATUS_OPTIONS = [
     { value: "cancelled", label: "Cancelled" },
 ];
 export function UserBidsView() {
+    // A bid could be seen in this list and never opened — no row click, no row
+    // action, no detail page. The "Browse auctions" link in the empty state is
+    // not an affordance: it is not row-scoped, and it only shows when there are
+    // no bids at all.
+    const [detail, setDetail] = useState(null);
     const config = {
         portal: "user",
         title: "My Bids",
@@ -40,8 +47,9 @@ export function UserBidsView() {
             if (isLoading) {
                 return (_jsx(Stack, { gap: "md", children: Array.from({ length: 3 }).map((_, i) => (_jsx(Div, { className: "h-16 animate-pulse border border-[var(--appkit-color-border)]", rounded: "xl" }, i))) }));
             }
-            return (_jsx(AuctionBidsTable, { bids: rows, portal: "buyer", totalPages: 1, currentPage: 1, onPageChange: () => { }, emptyLabel: _jsxs(Span, { children: ["You haven't placed any bids yet.", " ", _jsx(TextLink, { href: String(ROUTES.PUBLIC.AUCTIONS), children: "Browse auctions" })] }) }));
+            return (_jsx(AuctionBidsTable, { bids: rows, portal: "buyer", onRowClick: (bid) => setDetail(bid), totalPages: 1, currentPage: 1, onPageChange: () => { }, emptyLabel: _jsxs(Span, { children: ["You haven't placed any bids yet.", " ", _jsx(TextLink, { href: String(ROUTES.PUBLIC.AUCTIONS), children: "Browse auctions" })] }) }));
         },
     };
-    return _jsx(DataListingView, { config: config });
+    const badge = detail ? bidStatusBadge(detail.status) : null;
+    return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(RecordDetailModal, { isOpen: detail !== null, onClose: () => setDetail(null), title: detail?.productTitle || "Bid", badges: badge ? [{ label: badge.label }] : undefined, fields: detail ? buildBidDetailFields(detail, "buyer") : undefined, footer: detail ? (_jsx(TextLink, { href: String(ROUTES.PUBLIC.AUCTION_DETAIL(detail.productId)), children: "View auction \u2192" })) : undefined })] }));
 }

package/dist/features/account/components/UserReturnsView.d.ts

@@ -1,5 +1,8 @@
 import type { Order } from "../../orders/types";
 export interface UserReturnsViewProps {
+    /**
+     * Optional override. When omitted the card still opens — see below.
+     */
     onOrderClick?: (order: Order) => void;
 }
 export declare function UserReturnsView({ onOrderClick }: UserReturnsViewProps): import("react").JSX.Element;

package/dist/features/account/components/UserReturnsView.js

@@ -3,6 +3,8 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { sortBy } from "../../../constants/sort";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints";
 import { Div, Grid, Stack, Text } from "../../../ui";
+import { useRouter } from "next/navigation";
+import { ROUTES } from "../../../next/routing/route-map";
 import { DataListingView } from "../../admin/components/DataListingView";
 import { OrderCard } from "../../orders/components/OrdersList";
 const SORT_OPTIONS = [
@@ -11,6 +13,11 @@ const SORT_OPTIONS = [
     { value: sortBy("createdAt", "ASC"), label: "Oldest" },
 ];
 export function UserReturnsView({ onOrderClick }) {
+    const router = useRouter();
+    // Client-side navigation, not a full reload — the row is a link in behaviour
+    // even though the card itself contains its own controls, so wrapping it in
+    // an <a> would nest interactive content inside a link.
+    const openOrder = (order) => router.push(String(ROUTES.USER.ORDER_DETAIL(order.id)));
     const config = {
         portal: "user",
         title: "Returns & Refunds",
@@ -32,7 +39,16 @@ export function UserReturnsView({ onOrderClick }) {
             if (rows.length === 0) {
                 return _jsx(Text, { color: "muted", children: "You have no return or refund requests." });
             }
-            return (_jsx(Grid, { gap: "md", className: "grid-cols-1", children: rows.map((order) => (_jsx(OrderCard, { order: order, onClick: onOrderClick }, order.id))) }));
+            return (_jsx(Grid, { gap: "md", className: "grid-cols-1", children: rows.map((order) => (_jsx(OrderCard, { order: order, 
+                    // A return IS an order, and its detail page already exists — so
+                    // the row opens whether or not a consumer supplies a handler.
+                    //
+                    // It was previously openable ONLY because the single consumer
+                    // happened to pass `onOrderClick`; a second one that forgot
+                    // would have produced a listing whose rows do nothing, and no
+                    // audit could have seen it because the affordance lived in the
+                    // caller. Defaulting here makes it structural.
+                    onClick: onOrderClick ?? openOrder }, order.id))) }));
         },
     };
     return _jsx(DataListingView, { config: config });

package/dist/features/admin/components/AdminAuditLogView.js

@@ -23,6 +23,7 @@ const ACTION_LABELS = {
     checkout_bypass: "Admin checkout bypass",
     coupon_update: "Coupon updated",
     payout_mark_paid: "Payout marked paid",
+    offer_cancel: "Offer cancelled",
     store_status_change: "Store status changed",
     user_role_change: "User role changed",
 };

package/dist/features/admin/components/AdminBidsView.js

@@ -5,11 +5,12 @@ import { sieveFilter, SIEVE_OP } from "@mohasinac/appkit/client";
 import { sortBy } from "@mohasinac/appkit/client";
 import React, { useState } from "react";
 import { useQueryClient } from "@tanstack/react-query";
-import { ConfirmDeleteModal, FilterChipGroup, ListingLayout, RowActionMenu, useToast } from "../../../ui";
+import { ConfirmDeleteModal, FilterChipGroup, ListingLayout, RecordDetailModal, RowActionMenu, useToast, } from "../../../ui";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
 import { ADMIN_BID_STATUS_TABS } from "../constants/filter-tabs";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry";
 import { ROW_ACTION_META, ROW_ACTION_ID } from "../../products/constants/action-defs";
+import { buildBidDetailFields, bidStatusBadge } from "../../auctions/components/bid-detail-fields";
 import { toRecordArray, toRelativeDate, toCurrency, toStringValue, } from "../hooks/useAdminListingData";
 import { DataListingView } from "./DataListingView";
 import { apiClient } from "../../../http";
@@ -18,6 +19,7 @@ export function AdminBidsView({ children, ...props }) {
     const { showToast } = useToast();
     const [cancelOpen, setCancelOpen] = useState(false);
     const [selectedRow, setSelectedRow] = useState(null);
+    const [detail, setDetail] = useState(null);
     const cancelMutation = useApiMutation({
         mutationFn: async (bidId) => {
             await apiClient.patch(ADMIN_ENDPOINTS.BID_BY_ID(bidId), { status: "cancelled" });
@@ -58,6 +60,7 @@ export function AdminBidsView({ children, ...props }) {
             secondary: toStringValue(item.bidderId ?? item.bidderName ?? item.userId, "Unknown bidder"),
             status: toStringValue(item.status, "active"),
             updatedAt: toRelativeDate(item.bidDate ?? item.updatedAt ?? item.createdAt),
+            detail: item,
         })),
         getTotal: (response, mappedRows) => typeof response.total === "number" ? response.total : mappedRows.length,
         buildFilters: (state) => state.status && state.status !== "All" ? sieveFilter("status", SIEVE_OP.EQ, state.status) : undefined,
@@ -72,6 +75,13 @@ export function AdminBidsView({ children, ...props }) {
         renderRowActions: (row) => {
             const isCancelled = row.status === "cancelled" || row.status === "voided";
             return (_jsx(RowActionMenu, { actions: [
+                    // A menu of pure MUTATIONS is not a detail affordance (Root Cause
+                    // #56): it let an admin cancel a bid they had never been able to
+                    // read. View comes first for that reason.
+                    {
+                        label: ROW_ACTION_META[ROW_ACTION_ID.VIEW].label,
+                        onClick: () => setDetail(row),
+                    },
                     {
                         label: ROW_ACTION_META[ROW_ACTION_ID.CANCEL].label,
                         destructive: ROW_ACTION_META[ROW_ACTION_ID.CANCEL].destructive,
@@ -85,7 +95,10 @@ export function AdminBidsView({ children, ...props }) {
         },
         renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsx(FilterChipGroup, { label: "Status", tabs: ADMIN_BID_STATUS_TABS, value: pendingFilters.status ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, status: id })) })),
     };
-    return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(ConfirmDeleteModal, { isOpen: cancelOpen, onClose: () => {
+    const detailBadge = detail ? bidStatusBadge(detail.status) : null;
+    return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(RecordDetailModal, { isOpen: detail !== null, onClose: () => setDetail(null), title: toStringValue(detail?.detail?.productTitle, "Bid"), badges: detailBadge ? [{ label: detailBadge.label }] : undefined, fields: detail
+                    ? buildBidDetailFields(detail.detail, "admin")
+                    : undefined }), _jsx(ConfirmDeleteModal, { isOpen: cancelOpen, onClose: () => {
                     setCancelOpen(false);
                     setSelectedRow(null);
                 }, onConfirm: () => {