@mohasinac/appkit 4.21.0 → 4.23.0

package/dist/_internal/server/features/checkout/locked-lines.js

@@ -237,7 +237,10 @@ export async function finalizeLockedLines(items, orderId) {
         }
         if (item.bidId) {
             try {
-                await bidRepository.attachOrder(item.bidId, orderId);
+                await bidRepository.attachOrder(item.bidId, orderId, {
+                    actor: { role: "system" },
+                    trigger: "finalizeLockedLines",
+                });
             }
             catch (err) {
                 void normalizeError(err);
@@ -270,7 +273,14 @@ async function closeOutBuyoutLosers(productId, winningBidId) {
         const losers = active.filter((e) => e.id !== winningBidId);
         if (losers.length === 0)
             return;
-        await bidRepository.markManyLost(losers.map((e) => e.ref));
+        // Pass the {ref, data} pairs whole, not just the refs — `getActiveByProduct`
+        // already returned the documents, so the timeline gets a real before-value
+        // at zero read cost.
+        await bidRepository.markManyLost(losers, {
+            actor: { role: "system" },
+            trigger: "finalizeLockedLines:buyoutClosedAuction",
+            reason: "A Buy Now purchase ended this auction.",
+        });
         serverLogger.info("finalizeLockedLines: buyout closed out losing bids", {
             productId,
             winningBidId,

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -27,7 +27,7 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  */
 export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["updatedAt", "whatsappConfig", "adminNotes", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -29,6 +29,11 @@ export const PRIVATE_STORE_FIELDS = [
     "updatedAt", // bookkeeping; no public reader
     "whatsappConfig", // Meta access token + WABA/catalog ids — secret
     "adminNotes", // schema comment: never shown to the owner or the public
+    // Admin decisions with actor UIDs and suspension reasons. The store OWNER
+    // sees this on their own admin surfaces; an anonymous visitor to /stores has
+    // no business reading who suspended whom and why.
+    "statusHistory",
+    "statusHistoryTruncated",
     "isVerified", // admin moderation state; surfaced via a separate badge feed if ever needed
     "suspensionReason", // admin moderation note
     "capabilities", // internal feature gating; server-enforced, never client-read

package/dist/_internal/server/jobs/core/auctionSettlement.js

@@ -32,7 +32,11 @@ async function releasePendingBuyouts(ctx, product, holds) {
     for (const hold of holds) {
         try {
             await cartRepository.removeItemsByBidId(hold.data.userId, hold.id);
-            await bidRepository.markCancelled(hold.id);
+            await bidRepository.markCancelled(hold.id, {
+                actor: { role: "system" },
+                trigger: "auctionSettlement:lapsedBuyoutHold",
+                reason: "The auction ended before this Buy Now claim was paid for.",
+            });
             await sendNotification({
                 userId: hold.data.userId,
                 type: "auction_ended",
@@ -84,7 +88,9 @@ async function settleAuction(ctx, product) {
     const reserve = product.reservePrice;
     if (typeof reserve === "number" && reserve > 0 && winnerEntry.data.bidAmount < reserve) {
         const batch = ctx.db.batch();
-        activeBids.forEach(({ ref }) => bidRepository.markLost(batch, ref));
+        // `data` comes from the same query as `ref`, so the timeline entry is
+        // free even on an auction that closed with hundreds of bids (Rule #6).
+        activeBids.forEach(({ ref, data }) => bidRepository.markLost(batch, ref, { actor: { role: "system" }, trigger: "auctionSettlement" }, data));
         productRepository.updateStatusInBatch(batch, product.id, "archived");
         await batch.commit();
         const reserveStore = product.storeId
@@ -117,8 +123,8 @@ async function settleAuction(ctx, product) {
         return;
     }
     const batch = ctx.db.batch();
-    bidRepository.markWon(batch, winnerEntry.ref);
-    loserEntries.forEach(({ ref }) => bidRepository.markLost(batch, ref));
+    bidRepository.markWon(batch, winnerEntry.ref, { actor: { role: "system" }, trigger: "auctionSettlement" }, winnerEntry.data);
+    loserEntries.forEach(({ ref, data }) => bidRepository.markLost(batch, ref, { actor: { role: "system" }, trigger: "auctionSettlement" }, data));
     // Two-axis model: mark as sold without changing publish status.
     batch.update(ctx.db.collection("products").doc(product.id), {
         isSold: true,

package/dist/_internal/server/jobs/core/offerExpiry.js

@@ -155,7 +155,11 @@ async function lapseUnpaidAuctionWins(ctx) {
         for (const { userId, item } of buyoutHolds) {
             try {
                 await cartRepository.removeItemsByBidId(userId, item.bidId);
-                await bidRepository.markCancelled(item.bidId);
+                await bidRepository.markCancelled(item.bidId, {
+                    actor: { role: "system" },
+                    trigger: "runOfferExpiry:buyoutLapsed",
+                    reason: "The Buy Now checkout window closed without payment.",
+                });
                 await sendNotification({
                     userId,
                     type: "auction_ended",
@@ -211,7 +215,11 @@ async function lapseUnpaidAuctionWins(ctx) {
     for (const { userId, item } of auctionLines) {
         try {
             await cartRepository.removeItemsByBidId(userId, item.bidId);
-            await bidRepository.markForfeited(item.bidId);
+            await bidRepository.markForfeited(item.bidId, {
+                actor: { role: "system" },
+                trigger: "runOfferExpiry:winUnpaid",
+                reason: "The 48-hour checkout window closed without payment.",
+            });
             await sendNotification({
                 userId,
                 type: "auction_ended",

package/dist/_internal/server/jobs/core/payoutBatch.js

@@ -9,7 +9,19 @@ import { payoutRepository } from "../../../../repositories";
 const MAX_FAILURES = 3;
 async function dispatch(ctx, entry) {
     const { ref, data: payout } = entry;
-    await payoutRepository.markProcessing(ref);
+    /*
+     * The batch's running copy of the document, threaded through every write.
+     *
+     * Two reasons it is not just `payout`. (a) The snapshot came from the
+     * pending query, so history costs no extra read. (b) The sequence is
+     * pending → processing → failed; diffing the final write against the
+     * ORIGINAL snapshot would record "pending → failed" and lose the dispatch
+     * attempt that is the whole reason anyone opens the timeline.
+     */
+    let current = payout;
+    const actor = { role: "system" };
+    await payoutRepository.markProcessing(ref, { actor }, current);
+    current = { ...current, status: "processing" };
     try {
         const keyId = ctx.env("RAZORPAY_KEY_ID") ?? "";
         const keySecret = ctx.env("RAZORPAY_KEY_SECRET") ?? "";
@@ -67,7 +79,7 @@ async function dispatch(ctx, entry) {
             throw new Error(`Razorpay ${response.status}: ${errBody}`);
         }
         const result = (await response.json());
-        await payoutRepository.recordSuccess(ref, result.id, result.status);
+        await payoutRepository.recordSuccess(ref, result.id, result.status, { actor }, current);
         ctx.logger.info(`Payout ${payout.id} dispatched`, { razorpayId: result.id, razorpayStatus: result.status });
     }
     catch (error) {
@@ -75,7 +87,7 @@ async function dispatch(ctx, entry) {
         const failureCount = (payout.failureCount ?? 0) + 1;
         const isFinal = failureCount >= MAX_FAILURES;
         const reason = error instanceof Error ? error.message : String(error);
-        await payoutRepository.recordFailure(ref, failureCount, reason, isFinal);
+        await payoutRepository.recordFailure(ref, failureCount, reason, isFinal, { actor }, current);
         if (isFinal) {
             ctx.logger.error(`Payout ${payout.id} permanently failed after ${MAX_FAILURES} attempts`, error, {
                 sellerId: payout.storeId,

package/dist/_internal/shared/features/products/schema.d.ts

@@ -41,7 +41,7 @@ export declare const productInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -65,7 +65,7 @@ export declare const productInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -114,7 +114,7 @@ export declare const productUpdateSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -138,7 +138,7 @@ export declare const productUpdateSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -201,7 +201,7 @@ export declare const auctionInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     reservePrice?: number | undefined;
     buyNowPrice?: number | undefined;
     minBidIncrement?: number | undefined;
@@ -233,7 +233,7 @@ export declare const auctionInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     reservePrice?: number | undefined;
     buyNowPrice?: number | undefined;
     minBidIncrement?: number | undefined;
@@ -299,7 +299,7 @@ export declare const preOrderInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     preOrderDepositPercent?: number | undefined;
     preOrderMaxQuantity?: number | undefined;
     seoTitle?: string | undefined;
@@ -327,7 +327,7 @@ export declare const preOrderInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     preOrderDepositPercent?: number | undefined;
     preOrderMaxQuantity?: number | undefined;
     preOrderProductionStatus?: "upcoming" | "in_production" | "ready_to_ship" | undefined;

package/dist/_internal/shared/features/promotions/schema.d.ts

@@ -75,7 +75,7 @@ export declare const createCouponSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     code: string;
     type: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y";
-    scope: "admin" | "seller";
+    scope: "seller" | "admin";
     name: string;
     discount: {
         value: number;
@@ -99,7 +99,7 @@ export declare const createCouponSchema: z.ZodObject<{
 }, {
     code: string;
     type: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y";
-    scope: "admin" | "seller";
+    scope: "seller" | "admin";
     name: string;
     discount: {
         value: number;
@@ -177,7 +177,7 @@ export declare const updateCouponSchema: z.ZodObject<Omit<{
     }>>>;
 }, "code">, "strip", z.ZodTypeAny, {
     type?: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y" | undefined;
-    scope?: "admin" | "seller" | undefined;
+    scope?: "seller" | "admin" | undefined;
     name?: string | undefined;
     discount?: {
         value: number;
@@ -200,7 +200,7 @@ export declare const updateCouponSchema: z.ZodObject<Omit<{
     } | undefined;
 }, {
     type?: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y" | undefined;
-    scope?: "admin" | "seller" | undefined;
+    scope?: "seller" | "admin" | undefined;
     name?: string | undefined;
     discount?: {
         value: number;

package/dist/_internal/shared/history/index.d.ts

@@ -1,4 +1,4 @@
-export type { HistoryActorRole, HistoryActor, FieldChange, StatusChangeEntry, AppendHistoryResult, } from "./types";
+export type { HistoryActorRole, HistoryActor, FieldChange, StatusChangeEntry, AppendHistoryResult, SerialisedStatusChangeEntry, } from "./types";
 export { STATUS_HISTORY_MAX } from "./types";
 export type { BuildHistoryEntryInput } from "./history";
 export { diffTrackedFields, buildHistoryEntry, appendHistoryEntry, withHistory, } from "./history";

package/dist/_internal/shared/history/types.d.ts

@@ -59,3 +59,19 @@ export interface AppendHistoryResult {
      */
     truncatedCount: number;
 }
+/**
+ * A `StatusChangeEntry` after it has crossed the RSC boundary.
+ *
+ * Identical except `at` is an ISO string. Server Components must serialise
+ * before handing history to a `"use client"` component: every other date prop
+ * on those drawers is already a string, and mixing the two is how a
+ * `toLocaleString` on a string ends up rendering "Invalid Date".
+ *
+ * Declared once here rather than restated per page — two client files had
+ * hand-written copies, which is both a duplication and (because each spelled
+ * `changes` as `Record<string, { from: unknown; to: unknown }>`) an untyped
+ * seam `audit-unknown-leakage` correctly refused.
+ */
+export interface SerialisedStatusChangeEntry extends Omit<StatusChangeEntry, "at"> {
+    at: string;
+}

package/dist/client.d.ts

@@ -164,6 +164,13 @@ export type { ColorPickerFieldProps } from "./ui/forms";
 export { ColorPickerField } from "./ui/forms";
 export type { FormErrorSummaryProps } from "./ui/forms";
 export { FormErrorSummary } from "./ui/forms";
+export { RecordStatusTimeline } from "./features/status-history/index";
+export type { SerialisedStatusChangeEntry } from "./_internal/shared/history/types";
+export type { FormErrorListProps } from "./ui/forms";
+export { FormErrorList } from "./ui/forms";
+export { useFormBottomActions } from "./features/layout/index";
+export type { UseFormBottomActionsOptions } from "./features/layout/index";
+export { OverlayContext, useIsInsideOverlay } from "./ui/components/overlay-context";
 export { Select } from "./ui/components/Select";
 export type { SelectOption, SelectProps } from "./ui/components/Select";
 export { Heading } from "./ui/components/Typography";

package/dist/client.js

@@ -222,6 +222,10 @@ export { FieldCheckbox } from "./ui/forms";
 export { FieldTextarea } from "./ui/forms";
 export { ColorPickerField } from "./ui/forms";
 export { FormErrorSummary } from "./ui/forms";
+export { RecordStatusTimeline } from "./features/status-history/index";
+export { FormErrorList } from "./ui/forms";
+export { useFormBottomActions } from "./features/layout/index";
+export { OverlayContext, useIsInsideOverlay } from "./ui/components/overlay-context";
 export { Select } from "./ui/components/Select";
 export { Heading } from "./ui/components/Typography";
 export { Label, Text, Span, Caption } from "./ui/components/Typography";

package/dist/constants/field-names.d.ts

@@ -341,6 +341,18 @@ export declare const AD_FIELDS: {
         readonly PAUSED: "paused";
     };
 };
+/**
+ * The ad fields whose changes earn a `statusHistory` entry.
+ *
+ * Ads live inside the `siteSettings` singleton and have no repository, so
+ * `withHistory` is called from the route directly — it is a pure function, so
+ * that is fine. This list lives here beside `AD_FIELDS` rather than in a
+ * schema module because ads have no schema module of their own.
+ *
+ * The scheduling dates are tracked alongside `status`: an ad silently
+ * rescheduled reads on the timeline as the same kind of event as one paused.
+ */
+export declare const AD_TRACKED_FIELDS: readonly ["status", "startAt", "endAt"];
 export declare const EVENT_FIELDS: {
     readonly ID: "id";
     readonly TITLE: "title";

package/dist/constants/field-names.js

@@ -390,6 +390,18 @@ export const AD_FIELDS = {
         PAUSED: "paused",
     },
 };
+/**
+ * The ad fields whose changes earn a `statusHistory` entry.
+ *
+ * Ads live inside the `siteSettings` singleton and have no repository, so
+ * `withHistory` is called from the route directly — it is a pure function, so
+ * that is fine. This list lives here beside `AD_FIELDS` rather than in a
+ * schema module because ads have no schema module of their own.
+ *
+ * The scheduling dates are tracked alongside `status`: an ad silently
+ * rescheduled reads on the timeline as the same kind of event as one paused.
+ */
+export const AD_TRACKED_FIELDS = ["status", "startAt", "endAt"];
 // ============================================================================
 // EVENT FIELDS
 // ============================================================================

package/dist/features/account/components/AddressForm.js

@@ -1,7 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { normalizeError } from "../../../errors/normalize";
-import { useEffect, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import { z } from "zod";
 import { Button, Checkbox, FormField, FormGroup, Row, useToast } from "../../../ui";
 import { Form } from "../../../ui/components/Form";
@@ -64,7 +64,43 @@ export function AddressForm({ initialData, onSubmit, onCancel, isLoading = false
         country: initialData?.country || defaultCountry,
         isDefault: initialData?.isDefault || false,
     });
-    const { shellCtx, validate } = useFormShellState(addressFormSchema);
+    const { shellCtx, validate, setFieldError, clearErrors, markSubmitAttempted } = useFormShellState(addressFormSchema);
+    /*
+     * ONE submit path, shared by the inline Save button and the pinned mobile
+     * bar. Two copies would be two chances for the bar to skip a check the
+     * button performs — and the bar is the one a phone user actually presses,
+     * since the inline row sits below the fold on a form this long.
+     */
+    const submitAddress = useCallback(async (h) => {
+        const setErr = h?.setFieldError ?? setFieldError;
+        const clear = h?.clearErrors ?? clearErrors;
+        markSubmitAttempted();
+        clear();
+        const errs = {};
+        if (!formData.fullName.trim())
+            errs["fullName"] = "Full name is required";
+        if (!formData.phone.trim())
+            errs["phone"] = "Phone number is required";
+        if (!formData.addressLine1.trim())
+            errs["addressLine1"] = "Address is required";
+        if (!formData.city.trim())
+            errs["city"] = "City is required";
+        if (!formData.state.trim())
+            errs["state"] = "State is required";
+        if (!formData.postalCode.trim())
+            errs["postalCode"] = "Postal code is required";
+        if (Object.keys(errs).length > 0) {
+            Object.entries(errs).forEach(([k, v]) => setErr(k, v));
+            return;
+        }
+        try {
+            await onSubmit(formData);
+        }
+        catch (err) {
+            void normalizeError(err);
+            showToast(err instanceof Error ? err.message : "Failed to save address", "error");
+        }
+    }, [formData, onSubmit, showToast, setFieldError, clearErrors, markSubmitAttempted]);
     useEffect(() => {
         validate(formData);
         // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -72,31 +108,11 @@ export function AddressForm({ initialData, onSubmit, onCancel, isLoading = false
     const handleChange = (field, value) => {
         setFormData((prev) => ({ ...prev, [field]: value }));
     };
-    return (_jsx(Form, { onSubmit: (e) => e.preventDefault(), spacing: "md", shellCtx: shellCtx, children: ({ setFieldError, clearErrors }) => (_jsxs(_Fragment, { children: [_jsx(FormField, { label: mergedLabels.label, name: "label", type: "text", value: formData.label, onChange: (value) => handleChange("label", value), placeholder: mergedPlaceholders.label, required: true }), _jsx(FormField, { label: mergedLabels.fullName, name: "fullName", type: "text", value: formData.fullName, onChange: (value) => handleChange("fullName", value), placeholder: mergedPlaceholders.fullName, required: true }), _jsx(FormField, { label: mergedLabels.phone, name: "phone", type: "tel", value: formData.phone, onChange: (value) => handleChange("phone", value), placeholder: mergedPlaceholders.phone, required: true }), _jsx(FormField, { label: mergedLabels.addressLine1, name: "addressLine1", type: "text", value: formData.addressLine1, onChange: (value) => handleChange("addressLine1", value), placeholder: mergedPlaceholders.addressLine1, required: true }), _jsx(FormField, { label: mergedLabels.addressLine2, name: "addressLine2", type: "text", value: formData.addressLine2, onChange: (value) => handleChange("addressLine2", value), placeholder: mergedPlaceholders.addressLine2 }), _jsxs(FormGroup, { columns: 3, children: [_jsx(FormField, { label: mergedLabels.city, name: "city", type: "text", value: formData.city, onChange: (value) => handleChange("city", value), placeholder: mergedPlaceholders.city, required: true }), _jsx(FormField, { label: mergedLabels.state, name: "state", type: "text", value: formData.state, onChange: (value) => handleChange("state", value), placeholder: mergedPlaceholders.state, required: true }), _jsx(FormField, { label: mergedLabels.postalCode, name: "postalCode", type: "text", value: formData.postalCode, onChange: (value) => handleChange("postalCode", value), placeholder: mergedPlaceholders.postalCode, required: true })] }), _jsx(FormField, { label: mergedLabels.country, name: "country", type: "text", value: formData.country, onChange: (value) => handleChange("country", value), placeholder: mergedPlaceholders.country, required: true }), _jsx(Checkbox, { checked: formData.isDefault, onChange: (e) => handleChange("isDefault", e.target.checked), label: mergedLabels.setDefault }), _jsx(FormErrorSummary, {}), _jsxs(Row, { padding: "t-xs", align: "center", justify: "start", gap: "xs", children: [_jsx(Button, { type: "button", variant: "outline", onClick: onCancel, disabled: isLoading, children: mergedLabels.cancel }), _jsx(Button, { type: "submit", variant: "primary", disabled: isLoading, isLoading: isLoading, onClick: async () => {
-                                clearErrors();
-                                const errs = {};
-                                if (!formData.fullName.trim())
-                                    errs["fullName"] = "Full name is required";
-                                if (!formData.phone.trim())
-                                    errs["phone"] = "Phone number is required";
-                                if (!formData.addressLine1.trim())
-                                    errs["addressLine1"] = "Address is required";
-                                if (!formData.city.trim())
-                                    errs["city"] = "City is required";
-                                if (!formData.state.trim())
-                                    errs["state"] = "State is required";
-                                if (!formData.postalCode.trim())
-                                    errs["postalCode"] = "Postal code is required";
-                                if (Object.keys(errs).length > 0) {
-                                    Object.entries(errs).forEach(([k, v]) => setFieldError(k, v));
-                                    return;
-                                }
-                                try {
-                                    await onSubmit(formData);
-                                }
-                                catch (err) {
-                                    void normalizeError(err);
-                                    showToast(err instanceof Error ? err.message : "Failed to save address", "error");
-                                }
-                            }, children: isLoading ? mergedLabels.loading : effectiveSubmitLabel })] })] })) }));
+    return (_jsx(Form, { onSubmit: (e) => e.preventDefault(), spacing: "md", shellCtx: shellCtx, bottomBar: {
+            onSubmit: submitAddress,
+            onCancel,
+            submitLabel: effectiveSubmitLabel,
+            cancelLabel: mergedLabels.cancel,
+            isLoading,
+        }, children: ({ setFieldError, clearErrors }) => (_jsxs(_Fragment, { children: [_jsx(FormField, { label: mergedLabels.label, name: "label", type: "text", value: formData.label, onChange: (value) => handleChange("label", value), placeholder: mergedPlaceholders.label, required: true }), _jsx(FormField, { label: mergedLabels.fullName, name: "fullName", type: "text", value: formData.fullName, onChange: (value) => handleChange("fullName", value), placeholder: mergedPlaceholders.fullName, required: true }), _jsx(FormField, { label: mergedLabels.phone, name: "phone", type: "tel", value: formData.phone, onChange: (value) => handleChange("phone", value), placeholder: mergedPlaceholders.phone, required: true }), _jsx(FormField, { label: mergedLabels.addressLine1, name: "addressLine1", type: "text", value: formData.addressLine1, onChange: (value) => handleChange("addressLine1", value), placeholder: mergedPlaceholders.addressLine1, required: true }), _jsx(FormField, { label: mergedLabels.addressLine2, name: "addressLine2", type: "text", value: formData.addressLine2, onChange: (value) => handleChange("addressLine2", value), placeholder: mergedPlaceholders.addressLine2 }), _jsxs(FormGroup, { columns: 3, children: [_jsx(FormField, { label: mergedLabels.city, name: "city", type: "text", value: formData.city, onChange: (value) => handleChange("city", value), placeholder: mergedPlaceholders.city, required: true }), _jsx(FormField, { label: mergedLabels.state, name: "state", type: "text", value: formData.state, onChange: (value) => handleChange("state", value), placeholder: mergedPlaceholders.state, required: true }), _jsx(FormField, { label: mergedLabels.postalCode, name: "postalCode", type: "text", value: formData.postalCode, onChange: (value) => handleChange("postalCode", value), placeholder: mergedPlaceholders.postalCode, required: true })] }), _jsx(FormField, { label: mergedLabels.country, name: "country", type: "text", value: formData.country, onChange: (value) => handleChange("country", value), placeholder: mergedPlaceholders.country, required: true }), _jsx(Checkbox, { checked: formData.isDefault, onChange: (e) => handleChange("isDefault", e.target.checked), label: mergedLabels.setDefault }), _jsx(FormErrorSummary, {}), _jsxs(Row, { padding: "t-xs", align: "center", justify: "start", gap: "xs", children: [_jsx(Button, { type: "button", variant: "outline", onClick: onCancel, disabled: isLoading, children: mergedLabels.cancel }), _jsx(Button, { type: "submit", variant: "primary", disabled: isLoading, isLoading: isLoading, onClick: () => void submitAddress({ setFieldError, clearErrors }), children: isLoading ? mergedLabels.loading : effectiveSubmitLabel })] })] })) }));
 }

package/dist/features/admin/actions/admin-actions.js

@@ -72,8 +72,11 @@ export async function adminUpdatePayout(adminId, id, input) {
         throw new NotFoundError("Payout not found");
     }
     const updateData = {
-        ...(input.status !== undefined ? { status: input.status } : {}),
         ...(input.adminNote !== undefined ? { adminNote: input.adminNote } : {}),
+        // The payment reference. Absent from this pick until 2026-08-26, so every
+        // payout marked paid was stored WITHOUT the UTR the modal required — see
+        // PAYOUT_ADMIN_UPDATEABLE_FIELDS for the full trace.
+        ...(input.transactionId !== undefined ? { transactionId: input.transactionId } : {}),
         ...(input.processedAt
             ? {
                 processedAt: input.processedAt instanceof Date
@@ -82,12 +85,19 @@ export async function adminUpdatePayout(adminId, id, input) {
             }
             : {}),
     };
-    const updated = await payoutRepository.update(id, updateData);
+    /*
+     * Through `updateStatus`, not a bare `update`, so the change lands on the
+     * payout's own timeline — `existing` is threaded in as `prior`, so that
+     * costs no second read of a document this function already holds.
+     */
+    const updated = input.status !== undefined
+        ? await payoutRepository.updateStatus(id, input.status, updateData, { actor: { role: "admin", uid: adminId }, trigger: "adminUpdatePayout" }, existing)
+        : await payoutRepository.update(id, updateData);
     serverLogger.info("adminUpdatePayout", {
         adminId,
         payoutId: id,
     });
-    if (updateData.status === "paid") {
+    if (input.status === "paid") {
         void recordAdminAction({
             actorUid: adminId,
             action: AdminAuditActionValues.PAYOUT_MARK_PAID,

package/dist/features/admin/components/AdminBidsView.js

@@ -14,6 +14,7 @@ import { buildBidDetailFields, bidStatusBadge } from "../../auctions/components/
 import { toRecordArray, toRelativeDate, toCurrency, toStringValue, } from "../hooks/useAdminListingData";
 import { DataListingView } from "./DataListingView";
 import { apiClient } from "../../../http";
+import { RecordStatusTimeline } from "../../status-history/components/RecordStatusTimeline";
 export function AdminBidsView({ children, ...props }) {
     const queryClient = useQueryClient();
     const { showToast } = useToast();
@@ -98,7 +99,12 @@ export function AdminBidsView({ children, ...props }) {
     const detailBadge = detail ? bidStatusBadge(detail.status) : null;
     return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(RecordDetailModal, { isOpen: detail !== null, onClose: () => setDetail(null), title: toStringValue(detail?.detail?.productTitle, "Bid"), badges: detailBadge ? [{ label: detailBadge.label }] : undefined, fields: detail
                     ? buildBidDetailFields(detail.detail, "admin")
-                    : undefined }), _jsx(ConfirmDeleteModal, { isOpen: cancelOpen, onClose: () => {
+                    : undefined, extra: 
+                // A bid moves through more states than any record a buyer owns, and
+                // every one of them happened inside a settlement batch with nothing
+                // recording it until W18. Absent history renders the empty label,
+                // never a step invented from `updatedAt`.
+                _jsx(RecordStatusTimeline, { entries: detail?.detail?.statusHistory, truncatedCount: detail?.detail?.statusHistoryTruncated }) }), _jsx(ConfirmDeleteModal, { isOpen: cancelOpen, onClose: () => {
                     setCancelOpen(false);
                     setSelectedRow(null);
                 }, onConfirm: () => {

package/dist/features/admin/components/AdminBundleEditorView.js

@@ -142,6 +142,9 @@ export function AdminBundleEditorView({ bundleId, onSaved, onDeleted, scope = "a
         };
     }, [bundleId, endpoints]);
     const handleSave = useCallback(async () => {
+        // Save is a type="button" onClick — <Form>'s native submit never fires,
+        // so the error summary has to be unhidden explicitly.
+        formHelpersRef.current?.markSubmitAttempted();
         clearErrors();
         setApiError(null);
         const price = parsePriceRupees(form.priceRupees);

package/dist/features/admin/components/AdminScammerEditorView.d.ts

@@ -1,4 +1,5 @@
 import React from "react";
+import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
 import { type ScammerStatus } from "../../scams/schemas/firestore";
 export interface AdminScammerEditorViewProps {
     open: boolean;
@@ -11,7 +12,10 @@ export interface AdminScammerEditorViewProps {
     upiIds?: string[];
     currentStatus?: ScammerStatus;
     verificationNote?: string;
+    /** The profile's own decision history. Absent on profiles predating W18. */
+    statusHistory?: StatusChangeEntry[];
+    statusHistoryTruncated?: number;
     reportedBy?: string;
     reportedByAnon?: boolean;
 }
-export declare function AdminScammerEditorView({ open, onClose, scammerId, displayNames, scamType, description, phones, upiIds, currentStatus, verificationNote, reportedBy, reportedByAnon, }: AdminScammerEditorViewProps): React.JSX.Element;
+export declare function AdminScammerEditorView({ open, onClose, scammerId, displayNames, scamType, description, phones, upiIds, currentStatus, verificationNote, statusHistory, statusHistoryTruncated, reportedBy, reportedByAnon, }: AdminScammerEditorViewProps): React.JSX.Element;

package/dist/features/admin/components/AdminScammerEditorView.js

@@ -6,6 +6,7 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Button, Code, Div, FormActions, HorizontalRule, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, useToast } from "../../../ui";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { RecordStatusTimeline } from "../../status-history/components/RecordStatusTimeline";
 import { ScammerStatusValues, } from "../../scams/schemas/firestore";
 import { SCAMMER_STATUS_BADGE, SCAMMER_STATUS_LABEL, SCAMMER_STATUS_OPTIONS, } from "../../scams/constants/scammer-status-display";
 const __P = {
@@ -13,7 +14,7 @@ const __P = {
     p4: "p-[var(--appkit-space-4)]",
 };
 const CLS_SECTION_LABEL = "text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] uppercase tracking-wide";
-export function AdminScammerEditorView({ open, onClose, scammerId, displayNames = [], scamType, description, phones = [], upiIds = [], currentStatus, verificationNote, reportedBy, reportedByAnon, }) {
+export function AdminScammerEditorView({ open, onClose, scammerId, displayNames = [], scamType, description, phones = [], upiIds = [], currentStatus, verificationNote, statusHistory, statusHistoryTruncated, reportedBy, reportedByAnon, }) {
     const queryClient = useQueryClient();
     const { showToast } = useToast();
     const [status, setStatus] = React.useState(currentStatus ?? "pending_review");
@@ -53,5 +54,5 @@ export function AdminScammerEditorView({ open, onClose, scammerId, displayNames
             showToast(err?.message ?? "Failed to delete profile.", "error");
         },
     });
-    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: displayNames.length > 0 ? displayNames[0] : "Scammer Profile", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${SCAMMER_STATUS_BADGE[currentStatus ?? ScammerStatusValues.PENDING_REVIEW]}`, rounded: "full", padding: "pill-sm-tall", children: SCAMMER_STATUS_LABEL[currentStatus ?? ScammerStatusValues.PENDING_REVIEW] }), scamType && (_jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: scamType.replace(/_/g, " ") }))] }), displayNames.length > 0 && (_jsxs(Div, { children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Names / Aliases" }), _jsx(Row, { wrap: true, gap: "xs", children: displayNames.map((name, i) => (_jsx(Span, { size: "xs", rounded: "full", surface: "subtle", padding: "pill-sm", children: name }, i))) })] })), (phones.length > 0 || upiIds.length > 0) && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [phones.length > 0 && (_jsxs(Div, { className: "mb-2", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Phone numbers" }), _jsx(Row, { wrap: true, gap: "xs", children: phones.map((p, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: p }, i))) })] })), upiIds.length > 0 && (_jsxs(_Fragment, { children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "UPI IDs" }), _jsx(Row, { wrap: true, gap: "xs", children: upiIds.map((u, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: u }, i))) })] }))] })), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), _jsxs(Div, { textSize: "xs", color: "muted", children: ["Reported by:", " ", _jsx(Span, { weight: "medium", color: "muted", children: reportedByAnon ? "Anonymous" : (reportedBy ?? "Unknown") })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(Select, { label: "Status", options: SCAMMER_STATUS_OPTIONS, value: status, onValueChange: setStatus }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Verification note (internal)" }), _jsx(Textarea, { value: note, onChange: (e) => setNote(e.target.value), rows: 3, placeholder: "e.g. Verified via 3 independent reports\u2026" })] }), _jsxs(FormActions, { align: "right", children: [_jsx(Button, { type: "button", variant: "danger", size: "sm", disabled: !scammerId, isLoading: deleteMutation.isPending, onClick: () => deleteMutation.mutate(), children: "Delete" }), _jsx(Button, { type: "button", variant: "secondary", onClick: onClose, children: "Cancel" }), _jsx(Button, { type: "button", isLoading: updateMutation.isPending, disabled: !scammerId || updateMutation.isPending, onClick: () => updateMutation.mutate(), children: "Save changes" })] })] }) }));
+    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: displayNames.length > 0 ? displayNames[0] : "Scammer Profile", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsx(RecordStatusTimeline, { title: "Decision history", entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsxs(Row, { align: "center", gap: "sm", children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${SCAMMER_STATUS_BADGE[currentStatus ?? ScammerStatusValues.PENDING_REVIEW]}`, rounded: "full", padding: "pill-sm-tall", children: SCAMMER_STATUS_LABEL[currentStatus ?? ScammerStatusValues.PENDING_REVIEW] }), scamType && (_jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: scamType.replace(/_/g, " ") }))] }), displayNames.length > 0 && (_jsxs(Div, { children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Names / Aliases" }), _jsx(Row, { wrap: true, gap: "xs", children: displayNames.map((name, i) => (_jsx(Span, { size: "xs", rounded: "full", surface: "subtle", padding: "pill-sm", children: name }, i))) })] })), (phones.length > 0 || upiIds.length > 0) && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [phones.length > 0 && (_jsxs(Div, { className: "mb-2", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Phone numbers" }), _jsx(Row, { wrap: true, gap: "xs", children: phones.map((p, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: p }, i))) })] })), upiIds.length > 0 && (_jsxs(_Fragment, { children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "UPI IDs" }), _jsx(Row, { wrap: true, gap: "xs", children: upiIds.map((u, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: u }, i))) })] }))] })), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), _jsxs(Div, { textSize: "xs", color: "muted", children: ["Reported by:", " ", _jsx(Span, { weight: "medium", color: "muted", children: reportedByAnon ? "Anonymous" : (reportedBy ?? "Unknown") })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(Select, { label: "Status", options: SCAMMER_STATUS_OPTIONS, value: status, onValueChange: setStatus }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Verification note (internal)" }), _jsx(Textarea, { value: note, onChange: (e) => setNote(e.target.value), rows: 3, placeholder: "e.g. Verified via 3 independent reports\u2026" })] }), _jsxs(FormActions, { align: "right", children: [_jsx(Button, { type: "button", variant: "danger", size: "sm", disabled: !scammerId, isLoading: deleteMutation.isPending, onClick: () => deleteMutation.mutate(), children: "Delete" }), _jsx(Button, { type: "button", variant: "secondary", onClick: onClose, children: "Cancel" }), _jsx(Button, { type: "button", isLoading: updateMutation.isPending, disabled: !scammerId || updateMutation.isPending, onClick: () => updateMutation.mutate(), children: "Save changes" })] })] }) }));
 }

package/dist/features/admin/components/AdminSupportTicketDetailView.d.ts

@@ -1,4 +1,5 @@
 import React from "react";
+import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
 interface TicketMessageClient {
     id?: string;
     authorId?: string;
@@ -28,6 +29,9 @@ export interface AdminSupportTicketDetailViewProps {
     orderId?: string;
     /** ST-6 — current relatedParties snapshot from the ticket document. */
     relatedParties?: RelatedPartiesClient;
+    /** The ticket's `statusHistory`. Absent on tickets predating W18. */
+    statusHistory?: StatusChangeEntry[];
+    statusHistoryTruncated?: number;
 }
-export declare function AdminSupportTicketDetailView({ open, onClose, ticketId, subject, userDisplayName, category, currentStatus, currentPriority, description, messages, internalNotes, orderId, relatedParties, }: AdminSupportTicketDetailViewProps): React.JSX.Element;
+export declare function AdminSupportTicketDetailView({ open, onClose, ticketId, subject, userDisplayName, category, currentStatus, currentPriority, description, messages, internalNotes, orderId, relatedParties, statusHistory, statusHistoryTruncated, }: AdminSupportTicketDetailViewProps): React.JSX.Element;
 export {};