@mohasinac/appkit 4.22.0 → 4.23.0

package/dist/_internal/server/features/checkout/locked-lines.js

@@ -237,7 +237,10 @@ export async function finalizeLockedLines(items, orderId) {
         }
         if (item.bidId) {
             try {
-                await bidRepository.attachOrder(item.bidId, orderId);
+                await bidRepository.attachOrder(item.bidId, orderId, {
+                    actor: { role: "system" },
+                    trigger: "finalizeLockedLines",
+                });
             }
             catch (err) {
                 void normalizeError(err);
@@ -270,7 +273,14 @@ async function closeOutBuyoutLosers(productId, winningBidId) {
         const losers = active.filter((e) => e.id !== winningBidId);
         if (losers.length === 0)
             return;
-        await bidRepository.markManyLost(losers.map((e) => e.ref));
+        // Pass the {ref, data} pairs whole, not just the refs — `getActiveByProduct`
+        // already returned the documents, so the timeline gets a real before-value
+        // at zero read cost.
+        await bidRepository.markManyLost(losers, {
+            actor: { role: "system" },
+            trigger: "finalizeLockedLines:buyoutClosedAuction",
+            reason: "A Buy Now purchase ended this auction.",
+        });
         serverLogger.info("finalizeLockedLines: buyout closed out losing bids", {
             productId,
             winningBidId,

package/dist/_internal/server/features/stores/adapters.d.ts

@@ -27,7 +27,7 @@ import type { StoreDetail, StoreListItem } from "../../../../features/stores/typ
  */
 export declare const PUBLIC_STORE_FIELDS: readonly ["id", "storeSlug", "ownerId", "storeName", "storeDescription", "storeCategory", "storeLogoURL", "storeBannerURL", "status", "isPublic", "stats", "bio", "location", "website", "socialLinks", "returnPolicy", "shippingPolicy", "isVacationMode", "vacationMessage", "createdAt"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_STORE_FIELDS: readonly ["updatedAt", "whatsappConfig", "adminNotes", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
+export declare const PRIVATE_STORE_FIELDS: readonly ["updatedAt", "whatsappConfig", "adminNotes", "statusHistory", "statusHistoryTruncated", "isVerified", "suspensionReason", "capabilities", "customCommissionRate", "googleReviews", "shippingConfig", "emiEnabled", "isFeatured", "vacationReturnDate", "isTestData", "testDataExpiresAt"];
 /**
  * Accepted input: a `StoreDocument` (the common case) or a loosely-typed
  * Firestore row. The legacy top-level counters below predate `stats` and are

package/dist/_internal/server/features/stores/adapters.js

@@ -29,6 +29,11 @@ export const PRIVATE_STORE_FIELDS = [
     "updatedAt", // bookkeeping; no public reader
     "whatsappConfig", // Meta access token + WABA/catalog ids — secret
     "adminNotes", // schema comment: never shown to the owner or the public
+    // Admin decisions with actor UIDs and suspension reasons. The store OWNER
+    // sees this on their own admin surfaces; an anonymous visitor to /stores has
+    // no business reading who suspended whom and why.
+    "statusHistory",
+    "statusHistoryTruncated",
     "isVerified", // admin moderation state; surfaced via a separate badge feed if ever needed
     "suspensionReason", // admin moderation note
     "capabilities", // internal feature gating; server-enforced, never client-read

package/dist/_internal/server/jobs/core/auctionSettlement.js

@@ -32,7 +32,11 @@ async function releasePendingBuyouts(ctx, product, holds) {
     for (const hold of holds) {
         try {
             await cartRepository.removeItemsByBidId(hold.data.userId, hold.id);
-            await bidRepository.markCancelled(hold.id);
+            await bidRepository.markCancelled(hold.id, {
+                actor: { role: "system" },
+                trigger: "auctionSettlement:lapsedBuyoutHold",
+                reason: "The auction ended before this Buy Now claim was paid for.",
+            });
             await sendNotification({
                 userId: hold.data.userId,
                 type: "auction_ended",
@@ -84,7 +88,9 @@ async function settleAuction(ctx, product) {
     const reserve = product.reservePrice;
     if (typeof reserve === "number" && reserve > 0 && winnerEntry.data.bidAmount < reserve) {
         const batch = ctx.db.batch();
-        activeBids.forEach(({ ref }) => bidRepository.markLost(batch, ref));
+        // `data` comes from the same query as `ref`, so the timeline entry is
+        // free even on an auction that closed with hundreds of bids (Rule #6).
+        activeBids.forEach(({ ref, data }) => bidRepository.markLost(batch, ref, { actor: { role: "system" }, trigger: "auctionSettlement" }, data));
         productRepository.updateStatusInBatch(batch, product.id, "archived");
         await batch.commit();
         const reserveStore = product.storeId
@@ -117,8 +123,8 @@ async function settleAuction(ctx, product) {
         return;
     }
     const batch = ctx.db.batch();
-    bidRepository.markWon(batch, winnerEntry.ref);
-    loserEntries.forEach(({ ref }) => bidRepository.markLost(batch, ref));
+    bidRepository.markWon(batch, winnerEntry.ref, { actor: { role: "system" }, trigger: "auctionSettlement" }, winnerEntry.data);
+    loserEntries.forEach(({ ref, data }) => bidRepository.markLost(batch, ref, { actor: { role: "system" }, trigger: "auctionSettlement" }, data));
     // Two-axis model: mark as sold without changing publish status.
     batch.update(ctx.db.collection("products").doc(product.id), {
         isSold: true,

package/dist/_internal/server/jobs/core/offerExpiry.js

@@ -155,7 +155,11 @@ async function lapseUnpaidAuctionWins(ctx) {
         for (const { userId, item } of buyoutHolds) {
             try {
                 await cartRepository.removeItemsByBidId(userId, item.bidId);
-                await bidRepository.markCancelled(item.bidId);
+                await bidRepository.markCancelled(item.bidId, {
+                    actor: { role: "system" },
+                    trigger: "runOfferExpiry:buyoutLapsed",
+                    reason: "The Buy Now checkout window closed without payment.",
+                });
                 await sendNotification({
                     userId,
                     type: "auction_ended",
@@ -211,7 +215,11 @@ async function lapseUnpaidAuctionWins(ctx) {
     for (const { userId, item } of auctionLines) {
         try {
             await cartRepository.removeItemsByBidId(userId, item.bidId);
-            await bidRepository.markForfeited(item.bidId);
+            await bidRepository.markForfeited(item.bidId, {
+                actor: { role: "system" },
+                trigger: "runOfferExpiry:winUnpaid",
+                reason: "The 48-hour checkout window closed without payment.",
+            });
             await sendNotification({
                 userId,
                 type: "auction_ended",

package/dist/_internal/server/jobs/core/payoutBatch.js

@@ -9,7 +9,19 @@ import { payoutRepository } from "../../../../repositories";
 const MAX_FAILURES = 3;
 async function dispatch(ctx, entry) {
     const { ref, data: payout } = entry;
-    await payoutRepository.markProcessing(ref);
+    /*
+     * The batch's running copy of the document, threaded through every write.
+     *
+     * Two reasons it is not just `payout`. (a) The snapshot came from the
+     * pending query, so history costs no extra read. (b) The sequence is
+     * pending → processing → failed; diffing the final write against the
+     * ORIGINAL snapshot would record "pending → failed" and lose the dispatch
+     * attempt that is the whole reason anyone opens the timeline.
+     */
+    let current = payout;
+    const actor = { role: "system" };
+    await payoutRepository.markProcessing(ref, { actor }, current);
+    current = { ...current, status: "processing" };
     try {
         const keyId = ctx.env("RAZORPAY_KEY_ID") ?? "";
         const keySecret = ctx.env("RAZORPAY_KEY_SECRET") ?? "";
@@ -67,7 +79,7 @@ async function dispatch(ctx, entry) {
             throw new Error(`Razorpay ${response.status}: ${errBody}`);
         }
         const result = (await response.json());
-        await payoutRepository.recordSuccess(ref, result.id, result.status);
+        await payoutRepository.recordSuccess(ref, result.id, result.status, { actor }, current);
         ctx.logger.info(`Payout ${payout.id} dispatched`, { razorpayId: result.id, razorpayStatus: result.status });
     }
     catch (error) {
@@ -75,7 +87,7 @@ async function dispatch(ctx, entry) {
         const failureCount = (payout.failureCount ?? 0) + 1;
         const isFinal = failureCount >= MAX_FAILURES;
         const reason = error instanceof Error ? error.message : String(error);
-        await payoutRepository.recordFailure(ref, failureCount, reason, isFinal);
+        await payoutRepository.recordFailure(ref, failureCount, reason, isFinal, { actor }, current);
         if (isFinal) {
             ctx.logger.error(`Payout ${payout.id} permanently failed after ${MAX_FAILURES} attempts`, error, {
                 sellerId: payout.storeId,

package/dist/_internal/shared/features/products/schema.d.ts

@@ -41,7 +41,7 @@ export declare const productInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -65,7 +65,7 @@ export declare const productInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -114,7 +114,7 @@ export declare const productUpdateSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -138,7 +138,7 @@ export declare const productUpdateSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     seoTitle?: string | undefined;
     seoDescription?: string | undefined;
     seoKeywords?: string[] | undefined;
@@ -201,7 +201,7 @@ export declare const auctionInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     reservePrice?: number | undefined;
     buyNowPrice?: number | undefined;
     minBidIncrement?: number | undefined;
@@ -233,7 +233,7 @@ export declare const auctionInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     reservePrice?: number | undefined;
     buyNowPrice?: number | undefined;
     minBidIncrement?: number | undefined;
@@ -299,7 +299,7 @@ export declare const preOrderInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     preOrderDepositPercent?: number | undefined;
     preOrderMaxQuantity?: number | undefined;
     seoTitle?: string | undefined;
@@ -327,7 +327,7 @@ export declare const preOrderInputSchema: z.ZodObject<{
     condition?: "new" | "used" | "refurbished" | "like_new" | "good" | "fair" | "poor" | "broken" | undefined;
     insurance?: boolean | undefined;
     insuranceCost?: number | undefined;
-    shippingPaidBy?: "seller" | "buyer" | undefined;
+    shippingPaidBy?: "buyer" | "seller" | undefined;
     preOrderDepositPercent?: number | undefined;
     preOrderMaxQuantity?: number | undefined;
     preOrderProductionStatus?: "upcoming" | "in_production" | "ready_to_ship" | undefined;

package/dist/_internal/shared/features/promotions/schema.d.ts

@@ -75,7 +75,7 @@ export declare const createCouponSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     code: string;
     type: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y";
-    scope: "admin" | "seller";
+    scope: "seller" | "admin";
     name: string;
     discount: {
         value: number;
@@ -99,7 +99,7 @@ export declare const createCouponSchema: z.ZodObject<{
 }, {
     code: string;
     type: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y";
-    scope: "admin" | "seller";
+    scope: "seller" | "admin";
     name: string;
     discount: {
         value: number;
@@ -177,7 +177,7 @@ export declare const updateCouponSchema: z.ZodObject<Omit<{
     }>>>;
 }, "code">, "strip", z.ZodTypeAny, {
     type?: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y" | undefined;
-    scope?: "admin" | "seller" | undefined;
+    scope?: "seller" | "admin" | undefined;
     name?: string | undefined;
     discount?: {
         value: number;
@@ -200,7 +200,7 @@ export declare const updateCouponSchema: z.ZodObject<Omit<{
     } | undefined;
 }, {
     type?: "fixed" | "percentage" | "free_shipping" | "buy_x_get_y" | undefined;
-    scope?: "admin" | "seller" | undefined;
+    scope?: "seller" | "admin" | undefined;
     name?: string | undefined;
     discount?: {
         value: number;

package/dist/_internal/shared/history/index.d.ts

@@ -1,4 +1,4 @@
-export type { HistoryActorRole, HistoryActor, FieldChange, StatusChangeEntry, AppendHistoryResult, } from "./types";
+export type { HistoryActorRole, HistoryActor, FieldChange, StatusChangeEntry, AppendHistoryResult, SerialisedStatusChangeEntry, } from "./types";
 export { STATUS_HISTORY_MAX } from "./types";
 export type { BuildHistoryEntryInput } from "./history";
 export { diffTrackedFields, buildHistoryEntry, appendHistoryEntry, withHistory, } from "./history";

package/dist/_internal/shared/history/types.d.ts

@@ -59,3 +59,19 @@ export interface AppendHistoryResult {
      */
     truncatedCount: number;
 }
+/**
+ * A `StatusChangeEntry` after it has crossed the RSC boundary.
+ *
+ * Identical except `at` is an ISO string. Server Components must serialise
+ * before handing history to a `"use client"` component: every other date prop
+ * on those drawers is already a string, and mixing the two is how a
+ * `toLocaleString` on a string ends up rendering "Invalid Date".
+ *
+ * Declared once here rather than restated per page — two client files had
+ * hand-written copies, which is both a duplication and (because each spelled
+ * `changes` as `Record<string, { from: unknown; to: unknown }>`) an untyped
+ * seam `audit-unknown-leakage` correctly refused.
+ */
+export interface SerialisedStatusChangeEntry extends Omit<StatusChangeEntry, "at"> {
+    at: string;
+}

package/dist/client.d.ts

@@ -164,6 +164,8 @@ export type { ColorPickerFieldProps } from "./ui/forms";
 export { ColorPickerField } from "./ui/forms";
 export type { FormErrorSummaryProps } from "./ui/forms";
 export { FormErrorSummary } from "./ui/forms";
+export { RecordStatusTimeline } from "./features/status-history/index";
+export type { SerialisedStatusChangeEntry } from "./_internal/shared/history/types";
 export type { FormErrorListProps } from "./ui/forms";
 export { FormErrorList } from "./ui/forms";
 export { useFormBottomActions } from "./features/layout/index";

package/dist/client.js

@@ -222,6 +222,7 @@ export { FieldCheckbox } from "./ui/forms";
 export { FieldTextarea } from "./ui/forms";
 export { ColorPickerField } from "./ui/forms";
 export { FormErrorSummary } from "./ui/forms";
+export { RecordStatusTimeline } from "./features/status-history/index";
 export { FormErrorList } from "./ui/forms";
 export { useFormBottomActions } from "./features/layout/index";
 export { OverlayContext, useIsInsideOverlay } from "./ui/components/overlay-context";

package/dist/constants/field-names.d.ts

@@ -341,6 +341,18 @@ export declare const AD_FIELDS: {
         readonly PAUSED: "paused";
     };
 };
+/**
+ * The ad fields whose changes earn a `statusHistory` entry.
+ *
+ * Ads live inside the `siteSettings` singleton and have no repository, so
+ * `withHistory` is called from the route directly — it is a pure function, so
+ * that is fine. This list lives here beside `AD_FIELDS` rather than in a
+ * schema module because ads have no schema module of their own.
+ *
+ * The scheduling dates are tracked alongside `status`: an ad silently
+ * rescheduled reads on the timeline as the same kind of event as one paused.
+ */
+export declare const AD_TRACKED_FIELDS: readonly ["status", "startAt", "endAt"];
 export declare const EVENT_FIELDS: {
     readonly ID: "id";
     readonly TITLE: "title";

package/dist/constants/field-names.js

@@ -390,6 +390,18 @@ export const AD_FIELDS = {
         PAUSED: "paused",
     },
 };
+/**
+ * The ad fields whose changes earn a `statusHistory` entry.
+ *
+ * Ads live inside the `siteSettings` singleton and have no repository, so
+ * `withHistory` is called from the route directly — it is a pure function, so
+ * that is fine. This list lives here beside `AD_FIELDS` rather than in a
+ * schema module because ads have no schema module of their own.
+ *
+ * The scheduling dates are tracked alongside `status`: an ad silently
+ * rescheduled reads on the timeline as the same kind of event as one paused.
+ */
+export const AD_TRACKED_FIELDS = ["status", "startAt", "endAt"];
 // ============================================================================
 // EVENT FIELDS
 // ============================================================================

package/dist/features/admin/actions/admin-actions.js

@@ -72,8 +72,11 @@ export async function adminUpdatePayout(adminId, id, input) {
         throw new NotFoundError("Payout not found");
     }
     const updateData = {
-        ...(input.status !== undefined ? { status: input.status } : {}),
         ...(input.adminNote !== undefined ? { adminNote: input.adminNote } : {}),
+        // The payment reference. Absent from this pick until 2026-08-26, so every
+        // payout marked paid was stored WITHOUT the UTR the modal required — see
+        // PAYOUT_ADMIN_UPDATEABLE_FIELDS for the full trace.
+        ...(input.transactionId !== undefined ? { transactionId: input.transactionId } : {}),
         ...(input.processedAt
             ? {
                 processedAt: input.processedAt instanceof Date
@@ -82,12 +85,19 @@ export async function adminUpdatePayout(adminId, id, input) {
             }
             : {}),
     };
-    const updated = await payoutRepository.update(id, updateData);
+    /*
+     * Through `updateStatus`, not a bare `update`, so the change lands on the
+     * payout's own timeline — `existing` is threaded in as `prior`, so that
+     * costs no second read of a document this function already holds.
+     */
+    const updated = input.status !== undefined
+        ? await payoutRepository.updateStatus(id, input.status, updateData, { actor: { role: "admin", uid: adminId }, trigger: "adminUpdatePayout" }, existing)
+        : await payoutRepository.update(id, updateData);
     serverLogger.info("adminUpdatePayout", {
         adminId,
         payoutId: id,
     });
-    if (updateData.status === "paid") {
+    if (input.status === "paid") {
         void recordAdminAction({
             actorUid: adminId,
             action: AdminAuditActionValues.PAYOUT_MARK_PAID,

package/dist/features/admin/components/AdminBidsView.js

@@ -14,6 +14,7 @@ import { buildBidDetailFields, bidStatusBadge } from "../../auctions/components/
 import { toRecordArray, toRelativeDate, toCurrency, toStringValue, } from "../hooks/useAdminListingData";
 import { DataListingView } from "./DataListingView";
 import { apiClient } from "../../../http";
+import { RecordStatusTimeline } from "../../status-history/components/RecordStatusTimeline";
 export function AdminBidsView({ children, ...props }) {
     const queryClient = useQueryClient();
     const { showToast } = useToast();
@@ -98,7 +99,12 @@ export function AdminBidsView({ children, ...props }) {
     const detailBadge = detail ? bidStatusBadge(detail.status) : null;
     return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(RecordDetailModal, { isOpen: detail !== null, onClose: () => setDetail(null), title: toStringValue(detail?.detail?.productTitle, "Bid"), badges: detailBadge ? [{ label: detailBadge.label }] : undefined, fields: detail
                     ? buildBidDetailFields(detail.detail, "admin")
-                    : undefined }), _jsx(ConfirmDeleteModal, { isOpen: cancelOpen, onClose: () => {
+                    : undefined, extra: 
+                // A bid moves through more states than any record a buyer owns, and
+                // every one of them happened inside a settlement batch with nothing
+                // recording it until W18. Absent history renders the empty label,
+                // never a step invented from `updatedAt`.
+                _jsx(RecordStatusTimeline, { entries: detail?.detail?.statusHistory, truncatedCount: detail?.detail?.statusHistoryTruncated }) }), _jsx(ConfirmDeleteModal, { isOpen: cancelOpen, onClose: () => {
                     setCancelOpen(false);
                     setSelectedRow(null);
                 }, onConfirm: () => {

package/dist/features/admin/components/AdminScammerEditorView.d.ts

@@ -1,4 +1,5 @@
 import React from "react";
+import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
 import { type ScammerStatus } from "../../scams/schemas/firestore";
 export interface AdminScammerEditorViewProps {
     open: boolean;
@@ -11,7 +12,10 @@ export interface AdminScammerEditorViewProps {
     upiIds?: string[];
     currentStatus?: ScammerStatus;
     verificationNote?: string;
+    /** The profile's own decision history. Absent on profiles predating W18. */
+    statusHistory?: StatusChangeEntry[];
+    statusHistoryTruncated?: number;
     reportedBy?: string;
     reportedByAnon?: boolean;
 }
-export declare function AdminScammerEditorView({ open, onClose, scammerId, displayNames, scamType, description, phones, upiIds, currentStatus, verificationNote, reportedBy, reportedByAnon, }: AdminScammerEditorViewProps): React.JSX.Element;
+export declare function AdminScammerEditorView({ open, onClose, scammerId, displayNames, scamType, description, phones, upiIds, currentStatus, verificationNote, statusHistory, statusHistoryTruncated, reportedBy, reportedByAnon, }: AdminScammerEditorViewProps): React.JSX.Element;

package/dist/features/admin/components/AdminScammerEditorView.js

@@ -6,6 +6,7 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Button, Code, Div, FormActions, HorizontalRule, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, useToast } from "../../../ui";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints";
+import { RecordStatusTimeline } from "../../status-history/components/RecordStatusTimeline";
 import { ScammerStatusValues, } from "../../scams/schemas/firestore";
 import { SCAMMER_STATUS_BADGE, SCAMMER_STATUS_LABEL, SCAMMER_STATUS_OPTIONS, } from "../../scams/constants/scammer-status-display";
 const __P = {
@@ -13,7 +14,7 @@ const __P = {
     p4: "p-[var(--appkit-space-4)]",
 };
 const CLS_SECTION_LABEL = "text-[length:var(--appkit-text-xs)] font-medium text-[var(--appkit-color-text-muted)] uppercase tracking-wide";
-export function AdminScammerEditorView({ open, onClose, scammerId, displayNames = [], scamType, description, phones = [], upiIds = [], currentStatus, verificationNote, reportedBy, reportedByAnon, }) {
+export function AdminScammerEditorView({ open, onClose, scammerId, displayNames = [], scamType, description, phones = [], upiIds = [], currentStatus, verificationNote, statusHistory, statusHistoryTruncated, reportedBy, reportedByAnon, }) {
     const queryClient = useQueryClient();
     const { showToast } = useToast();
     const [status, setStatus] = React.useState(currentStatus ?? "pending_review");
@@ -53,5 +54,5 @@ export function AdminScammerEditorView({ open, onClose, scammerId, displayNames
             showToast(err?.message ?? "Failed to delete profile.", "error");
         },
     });
-    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: displayNames.length > 0 ? displayNames[0] : "Scammer Profile", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${SCAMMER_STATUS_BADGE[currentStatus ?? ScammerStatusValues.PENDING_REVIEW]}`, rounded: "full", padding: "pill-sm-tall", children: SCAMMER_STATUS_LABEL[currentStatus ?? ScammerStatusValues.PENDING_REVIEW] }), scamType && (_jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: scamType.replace(/_/g, " ") }))] }), displayNames.length > 0 && (_jsxs(Div, { children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Names / Aliases" }), _jsx(Row, { wrap: true, gap: "xs", children: displayNames.map((name, i) => (_jsx(Span, { size: "xs", rounded: "full", surface: "subtle", padding: "pill-sm", children: name }, i))) })] })), (phones.length > 0 || upiIds.length > 0) && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [phones.length > 0 && (_jsxs(Div, { className: "mb-2", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Phone numbers" }), _jsx(Row, { wrap: true, gap: "xs", children: phones.map((p, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: p }, i))) })] })), upiIds.length > 0 && (_jsxs(_Fragment, { children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "UPI IDs" }), _jsx(Row, { wrap: true, gap: "xs", children: upiIds.map((u, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: u }, i))) })] }))] })), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), _jsxs(Div, { textSize: "xs", color: "muted", children: ["Reported by:", " ", _jsx(Span, { weight: "medium", color: "muted", children: reportedByAnon ? "Anonymous" : (reportedBy ?? "Unknown") })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(Select, { label: "Status", options: SCAMMER_STATUS_OPTIONS, value: status, onValueChange: setStatus }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Verification note (internal)" }), _jsx(Textarea, { value: note, onChange: (e) => setNote(e.target.value), rows: 3, placeholder: "e.g. Verified via 3 independent reports\u2026" })] }), _jsxs(FormActions, { align: "right", children: [_jsx(Button, { type: "button", variant: "danger", size: "sm", disabled: !scammerId, isLoading: deleteMutation.isPending, onClick: () => deleteMutation.mutate(), children: "Delete" }), _jsx(Button, { type: "button", variant: "secondary", onClick: onClose, children: "Cancel" }), _jsx(Button, { type: "button", isLoading: updateMutation.isPending, disabled: !scammerId || updateMutation.isPending, onClick: () => updateMutation.mutate(), children: "Save changes" })] })] }) }));
+    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: displayNames.length > 0 ? displayNames[0] : "Scammer Profile", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsx(RecordStatusTimeline, { title: "Decision history", entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsxs(Row, { align: "center", gap: "sm", children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${SCAMMER_STATUS_BADGE[currentStatus ?? ScammerStatusValues.PENDING_REVIEW]}`, rounded: "full", padding: "pill-sm-tall", children: SCAMMER_STATUS_LABEL[currentStatus ?? ScammerStatusValues.PENDING_REVIEW] }), scamType && (_jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: scamType.replace(/_/g, " ") }))] }), displayNames.length > 0 && (_jsxs(Div, { children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Names / Aliases" }), _jsx(Row, { wrap: true, gap: "xs", children: displayNames.map((name, i) => (_jsx(Span, { size: "xs", rounded: "full", surface: "subtle", padding: "pill-sm", children: name }, i))) })] })), (phones.length > 0 || upiIds.length > 0) && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [phones.length > 0 && (_jsxs(Div, { className: "mb-2", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Phone numbers" }), _jsx(Row, { wrap: true, gap: "xs", children: phones.map((p, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: p }, i))) })] })), upiIds.length > 0 && (_jsxs(_Fragment, { children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "UPI IDs" }), _jsx(Row, { wrap: true, gap: "xs", children: upiIds.map((u, i) => (_jsx(Code, { size: "xs", rounded: "default", padding: "sm", surface: "subtle", children: u }, i))) })] }))] })), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: CLS_SECTION_LABEL, children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), _jsxs(Div, { textSize: "xs", color: "muted", children: ["Reported by:", " ", _jsx(Span, { weight: "medium", color: "muted", children: reportedByAnon ? "Anonymous" : (reportedBy ?? "Unknown") })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(Select, { label: "Status", options: SCAMMER_STATUS_OPTIONS, value: status, onValueChange: setStatus }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Verification note (internal)" }), _jsx(Textarea, { value: note, onChange: (e) => setNote(e.target.value), rows: 3, placeholder: "e.g. Verified via 3 independent reports\u2026" })] }), _jsxs(FormActions, { align: "right", children: [_jsx(Button, { type: "button", variant: "danger", size: "sm", disabled: !scammerId, isLoading: deleteMutation.isPending, onClick: () => deleteMutation.mutate(), children: "Delete" }), _jsx(Button, { type: "button", variant: "secondary", onClick: onClose, children: "Cancel" }), _jsx(Button, { type: "button", isLoading: updateMutation.isPending, disabled: !scammerId || updateMutation.isPending, onClick: () => updateMutation.mutate(), children: "Save changes" })] })] }) }));
 }

package/dist/features/admin/components/AdminSupportTicketDetailView.d.ts

@@ -1,4 +1,5 @@
 import React from "react";
+import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
 interface TicketMessageClient {
     id?: string;
     authorId?: string;
@@ -28,6 +29,9 @@ export interface AdminSupportTicketDetailViewProps {
     orderId?: string;
     /** ST-6 — current relatedParties snapshot from the ticket document. */
     relatedParties?: RelatedPartiesClient;
+    /** The ticket's `statusHistory`. Absent on tickets predating W18. */
+    statusHistory?: StatusChangeEntry[];
+    statusHistoryTruncated?: number;
 }
-export declare function AdminSupportTicketDetailView({ open, onClose, ticketId, subject, userDisplayName, category, currentStatus, currentPriority, description, messages, internalNotes, orderId, relatedParties, }: AdminSupportTicketDetailViewProps): React.JSX.Element;
+export declare function AdminSupportTicketDetailView({ open, onClose, ticketId, subject, userDisplayName, category, currentStatus, currentPriority, description, messages, internalNotes, orderId, relatedParties, statusHistory, statusHistoryTruncated, }: AdminSupportTicketDetailViewProps): React.JSX.Element;
 export {};

package/dist/features/admin/components/AdminSupportTicketDetailView.js

@@ -6,6 +6,7 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { Button, Div, FormActions, HorizontalRule, Input, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, Toggle, useToast } from "../../../ui";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS, SUPPORT_ENDPOINTS } from "../../../constants/api-endpoints";
+import { RecordStatusTimeline } from "../../status-history/components/RecordStatusTimeline";
 const __P = {
     p3: "p-[var(--appkit-space-3)]",
     p4: "p-[var(--appkit-space-4)]",
@@ -38,7 +39,7 @@ const ROLE_LABEL = {
     support: "Support",
     admin: "Admin",
 };
-export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject, userDisplayName, category, currentStatus, currentPriority, description, messages = [], internalNotes, orderId, relatedParties, }) {
+export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject, userDisplayName, category, currentStatus, currentPriority, description, messages = [], internalNotes, orderId, relatedParties, statusHistory, statusHistoryTruncated, }) {
     const queryClient = useQueryClient();
     const { showToast } = useToast();
     const [status, setStatus] = React.useState(currentStatus ?? "open");
@@ -259,7 +260,7 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
             showToast(err?.message ?? "Failed to update order items.", "error");
         },
     });
-    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: subject ?? "Support Ticket", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${STATUS_COLOR[currentStatus ?? "open"] ?? STATUS_COLOR.open}`, rounded: "full", padding: "pill-sm-tall", children: (currentStatus ?? "open").replace(/_/g, " ") }), _jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: category }), orderId && (_jsxs(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: ["Order: ", orderId] }))] }), _jsxs(Div, { textSize: "sm", color: "muted", children: ["From: ", _jsx(Span, { weight: "medium", color: "primary", children: userDisplayName })] }), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), messages.length > 0 && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: ["Messages (", messages.length, ")"] }), _jsx(Stack, { className: `max-h-64 ${__O.yAuto}`, gap: "sm", children: messages.map((msg, i) => (_jsxs(Div, { textSize: "sm", surface: msg.authorRole === "user" ? "default" : "info-surface", className: msg.authorRole === "user" ? "border border-[var(--appkit-color-border)]" : "border border-[var(--appkit-color-info)]", rounded: "lg", padding: "sm", children: [_jsxs(Row, { color: "muted", textSize: "xs", className: "mb-1", align: "center", gap: "sm", children: [_jsx(Span, { weight: "medium", color: "muted", children: ROLE_LABEL[msg.authorRole ?? "user"] ?? msg.authorRole }), msg.createdAt && (_jsx(Span, { children: new Date(msg.createdAt).toLocaleString() }))] }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", children: msg.body })] }, msg.id ?? i))) })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Reply to user" }), _jsx(Textarea, { value: replyBody, onChange: (e) => setReplyBody(e.target.value), rows: 3, placeholder: "Type a reply\u2026" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", isLoading: replyMutation.isPending, disabled: !replyBody.trim() || !ticketId || replyMutation.isPending, onClick: () => replyMutation.mutate(), children: "Send reply" })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(Select, { label: "Status", options: STATUS_OPTIONS, value: status, onValueChange: setStatus }), _jsx(Select, { label: "Priority", options: PRIORITY_OPTIONS, value: priority, onValueChange: setPriority }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Internal notes (staff only)" }), _jsx(Textarea, { value: notes, onChange: (e) => setNotes(e.target.value), rows: 3, placeholder: "Notes visible only to admins and employees\u2026" })] }), _jsxs(Stack, { padding: "sm", gap: "sm", rounded: "lg", border: "default", children: [_jsx(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Linked parties" }), _jsx(Text, { size: "xs", color: "muted", children: "Tag the buyer / store / order / product / bid this ticket concerns." }), [
+    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: subject ?? "Support Ticket", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${STATUS_COLOR[currentStatus ?? "open"] ?? STATUS_COLOR.open}`, rounded: "full", padding: "pill-sm-tall", children: (currentStatus ?? "open").replace(/_/g, " ") }), _jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: category }), orderId && (_jsxs(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: ["Order: ", orderId] }))] }), _jsxs(Div, { textSize: "sm", color: "muted", children: ["From: ", _jsx(Span, { weight: "medium", color: "primary", children: userDisplayName })] }), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), messages.length > 0 && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: ["Messages (", messages.length, ")"] }), _jsx(Stack, { className: `max-h-64 ${__O.yAuto}`, gap: "sm", children: messages.map((msg, i) => (_jsxs(Div, { textSize: "sm", surface: msg.authorRole === "user" ? "default" : "info-surface", className: msg.authorRole === "user" ? "border border-[var(--appkit-color-border)]" : "border border-[var(--appkit-color-info)]", rounded: "lg", padding: "sm", children: [_jsxs(Row, { color: "muted", textSize: "xs", className: "mb-1", align: "center", gap: "sm", children: [_jsx(Span, { weight: "medium", color: "muted", children: ROLE_LABEL[msg.authorRole ?? "user"] ?? msg.authorRole }), msg.createdAt && (_jsx(Span, { children: new Date(msg.createdAt).toLocaleString() }))] }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", children: msg.body })] }, msg.id ?? i))) })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Reply to user" }), _jsx(Textarea, { value: replyBody, onChange: (e) => setReplyBody(e.target.value), rows: 3, placeholder: "Type a reply\u2026" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", isLoading: replyMutation.isPending, disabled: !replyBody.trim() || !ticketId || replyMutation.isPending, onClick: () => replyMutation.mutate(), children: "Send reply" })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(RecordStatusTimeline, { entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(Select, { label: "Status", options: STATUS_OPTIONS, value: status, onValueChange: setStatus }), _jsx(Select, { label: "Priority", options: PRIORITY_OPTIONS, value: priority, onValueChange: setPriority }), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Internal notes (staff only)" }), _jsx(Textarea, { value: notes, onChange: (e) => setNotes(e.target.value), rows: 3, placeholder: "Notes visible only to admins and employees\u2026" })] }), _jsxs(Stack, { padding: "sm", gap: "sm", rounded: "lg", border: "default", children: [_jsx(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Linked parties" }), _jsx(Text, { size: "xs", color: "muted", children: "Tag the buyer / store / order / product / bid this ticket concerns." }), [
                             ["userId", "User slug"],
                             ["storeId", "Store slug"],
                             ["orderId", "Order ID"],

package/dist/features/auctions/repository/bid.repository.d.ts

@@ -7,6 +7,14 @@ import { BaseRepository, parseSieveDateValue } from "../../../providers/db-fireb
 import type { DocumentReference, WriteBatch } from "firebase-admin/firestore";
 import type { SieveModel, FirebaseSieveResult } from "../../../providers/db-firebase";
 import type { BidDocument, BidCreateInput, BidUpdateInput, BidAdminUpdateInput, BidStatus } from "../schemas";
+import { type HistoryActor } from "../../../_internal/shared/history/index";
+/** Who/why for a bid write that lands in `statusHistory`. */
+export interface BidWriteContext {
+    actor?: HistoryActor;
+    trigger?: string;
+    reason?: string;
+    note?: string;
+}
 export declare class BidRepository extends BaseRepository<BidDocument> {
     constructor();
     /** Override mapDoc to auto-decrypt PII on every bid read */
@@ -49,7 +57,7 @@ export declare class BidRepository extends BaseRepository<BidDocument> {
         ref: DocumentReference;
         data: BidDocument;
     } | null>;
-    markWon(batch: WriteBatch, ref: DocumentReference): void;
+    markWon(batch: WriteBatch, ref: DocumentReference, ctx?: BidWriteContext, prior?: BidDocument | null): void;
     /**
      * Link a won bid to the order it eventually became.
      *
@@ -58,29 +66,34 @@ export declare class BidRepository extends BaseRepository<BidDocument> {
      * /user/bids could not link anywhere, and nothing could tell a settled win
      * from an unpaid one.
      */
-    attachOrder(bidId: string, orderId: string): Promise<void>;
+    attachOrder(bidId: string, orderId: string, ctx?: BidWriteContext, prior?: BidDocument | null): Promise<void>;
     /**
      * The winner never paid within their checkout window. Distinct from "lost"
      * (outbid) — this bidder won and then defaulted, which a seller may want to
      * act on.
      */
-    markForfeited(bidId: string): Promise<void>;
-    markLost(batch: WriteBatch, ref: DocumentReference): void;
+    markForfeited(bidId: string, ctx?: BidWriteContext, prior?: BidDocument | null): Promise<void>;
+    markLost(batch: WriteBatch, ref: DocumentReference, ctx?: BidWriteContext, prior?: BidDocument | null): void;
     /**
      * Batched "everyone else lost", for callers that are not already inside a
      * batch of their own — a Buy Now purchase ends the auction outside the
      * settlement job, and the losing bids can be any number, so this writes them
      * in Firestore-batch chunks rather than one round-trip per bid.
      */
-    markManyLost(refs: readonly DocumentReference[]): Promise<void>;
+    markManyLost(entries: readonly (DocumentReference | {
+        ref: DocumentReference;
+        data?: BidDocument;
+    })[], ctx?: BidWriteContext): Promise<void>;
     /**
      * A pending Buy Now claim that never became a sale. Not `forfeited` — that
      * status means "won, then defaulted", and a lapsed claim never won anything;
      * the auction it was placed against carried on untouched.
      */
-    markCancelled(bidId: string): Promise<void>;
-    markOutbid(batch: WriteBatch, ref: DocumentReference): void;
-    markWinning(batch: WriteBatch, ref: DocumentReference): void;
+    markCancelled(bidId: string, ctx?: BidWriteContext, prior?: BidDocument | null): Promise<void>;
+    markOutbid(batch: WriteBatch, ref: DocumentReference, ctx?: BidWriteContext, prior?: BidDocument | null): void;
+    markWinning(batch: WriteBatch, ref: DocumentReference, ctx?: BidWriteContext, prior?: BidDocument | null): void;
+    /** Append a timeline entry when the patch touches a tracked field. */
+    private withBidHistory;
     /**
      * Find current winning bid for a product
      */