@mohasinac/appkit 4.26.0 → 4.28.0

package/dist/client.js

@@ -12,6 +12,12 @@ export { ApiError, isApiError } from "./client/api/ApiError";
 export { surfaceError } from "./client/api/surface-error";
 export { reportClientError, } from "./client/observability/reportClientError";
 export { installClientErrorReporter, useClientErrorReporter, } from "./client/observability/installClientErrorReporter";
+// [CLIENT-SAFE] Error-tracker registration. The consumer calls setErrorTracker
+// once at bootstrap to route every trackError() — notably the `error.digest`
+// captured by ErrorView / GlobalError / ErrorBoundary — into reportClientError.
+// Without a registration, trackError falls back to console.error and the digest
+// (the only link to the server-side error) is lost.
+export { setErrorTracker, trackError, ErrorCategory, ErrorSeverity, } from "./monitoring/error-tracking";
 // [CLIENT-SAFE] React Query wrappers — auto-toast / auto-inline-field-error
 // on failure, optional `loadingMessage` for long ops.
 export { useApiMutation } from "./client/api/useApiMutation";
@@ -51,6 +57,7 @@ export { IconBox } from "./ui/components/IconBox";
 export { Alert } from "./ui/components/Alert";
 export { Divider } from "./ui/components/Divider";
 export { Tabs, TabsList, TabsTrigger, TabsContent } from "./ui/components/Tabs";
+export { TabBarShell, TabBarButton, TabsNavSelect } from "./ui/components/TabBarShell";
 export { SellerProductsView } from "./features/seller/components/SellerProductsView";
 export { SellerOrderDetailPanel } from "./features/seller/components/SellerOrdersView";
 export { SellerPayoutDetailContent } from "./features/seller/components/SellerPayoutsView";
@@ -144,6 +151,16 @@ export { LotteryDetailView } from "./_internal/client/features/lottery/LotteryDe
 export { LotteryEntriesView } from "./_internal/client/features/lottery/LotteryEntriesView";
 export { LotteryAdminSlotView } from "./_internal/client/features/lottery/LotteryAdminSlotView";
 export { LotteryAdminEditView } from "./_internal/client/features/lottery/LotteryAdminEditView";
+export { lotteryConfigWriteSchema, lotterySlotWriteSchema } from "./features/lottery/schemas/config-write";
+// The SectionForm engine + its schema-derived section builder. Client-only:
+// consumer forms need these and the bare package resolves to the SERVER entry.
+export { SectionForm, useSectionFormNav } from "./features/shell/SectionForm";
+export { buildSectionsFromSchema } from "./features/shell/build-sections";
+export { reportCreateSchema } from "./features/store-extensions/schemas/report-create-form";
+export { itemRequestCreateSchema } from "./features/store-extensions/schemas/item-request-create-form";
+export { supportTicketCreateSchema } from "./features/support/schemas/ticket-create-form";
+export { analyticsCardCreateSchema, ANALYTICS_CARD_TYPES } from "./features/store-extensions/schemas/analytics-forms";
+export { QuickFormDrawer } from "./features/shell/QuickFormDrawer";
 export { PrizeDrawLotteryDetailView } from "./_internal/client/features/lottery/PrizeDrawLotteryDetailView";
 // [CLIENT-ONLY]-Cannot run in SSR mode â€" uses browser-only APIs (window, navigator, localStorage, matchMedia, DOM events) that do not exist in Node.js.
 // BottomSheet - Shared export for bottom sheet.
@@ -258,10 +275,19 @@ export { useCollapsedSections } from "./features/account/hooks/useCollapsedSecti
 export { PageViewTracker } from "./features/analytics/components/PageViewTracker";
 export { PAGE_VIEW_ENTITY_TYPES } from "./features/analytics/types";
 export { AuctionBidsTable } from "./features/auctions/components/AuctionBidsTable";
+// The ONE bid-detail field builder, shared by all three portals' list modals
+// and — since W22 — their detail pages. `viewer` is what decides whether the
+// bidder's identity is shown, so keeping it in one place is what stops a
+// buyer-facing surface ever rendering another bidder's name.
+export { buildBidDetailFields, bidStatusBadge } from "./features/auctions/components/bid-detail-fields";
+// Same reason, one feature over: the entry detail modal and its full page
+// render from one builder rather than two lists that can drift.
+export { buildEventEntryDetailFields } from "./features/events/components/event-entry-detail-fields";
 export { ProtectedRoute, AuthStatusPanel, ForgotPasswordView, LoginForm, RegisterForm, ResetPasswordView, VerifyEmailView } from "./features/auth/index";
 export { useLogout, useLogin, useGoogleLogin, useLinkGoogleAccount, useRegister, useForgotPassword, useResetPassword, useVerifyEmail, useChangeEmail } from "./features/auth/index";
 export { CartView, CartItemRow, CartGroupLineRow, CartSummary, CartPriceBreakdown, CartDrawer, CheckoutView, CheckoutSuccessView, CheckoutAddressStep, useGuestCart, useCartCount, useAddToCart, useCart, useGuestCartMerge, useCartQuery } from "./features/cart/index";
-export { StoreAddonsPicker } from "./features/cart/index";
+export { StoreAddonsPicker, hasAnyStoreAddon } from "./features/cart/index";
+export { clientLineTotal } from "./features/cart/utils/line-total";
 export { getCartOps, CART_OPS_CHANGE_EVENT } from "./features/cart/utils/pending-ops";
 export { useAddresses, useCreateAddress, useUpdateAddress, useDeleteAddress, useSetDefaultAddress, useAddress } from "./features/account/index";
 export { AddressBook, AddressCard, AddressForm } from "./features/account/index";
@@ -278,10 +304,14 @@ export { useActiveAd } from "./features/homepage/hooks/useActiveAd";
 export { registerAdSlot, registerAdSlots, unregisterAdSlot, clearAdRegistry, setAdConsentGranted, isAdConsentGranted, isAdSlotRenderable, } from "./features/homepage/ad-registry";
 export { WishlistView, useGuestWishlist, useWishlistWithGuest } from "./features/wishlist/index";
 export { WishlistCapWatcher } from "./features/wishlist/components/WishlistCapWatcher";
+// The single wishlist heart. Exported here too because it is a "use client"
+// UI component and consumer client code imports from this entry.
+export { WishlistHeartButton } from "./features/wishlist/components/WishlistHeartButton";
 export { SyncManagerMount } from "./core/components/SyncManagerMount";
 export { useWishlistCount, useWishlistCountWithLimit, WISHLIST_CAP_EVENT } from "./features/wishlist/hooks/useWishlistCount";
 export { getGuestWishlistItems, addToGuestWishlist, removeFromGuestWishlist, isInGuestWishlist, clearGuestWishlist, getGuestWishlistCount, getGuestWishlistByType, } from "./features/wishlist/utils/guest-wishlist";
 export { InteractiveProductCard } from "./features/products/index";
+export { GroupedListingEditorView } from "./features/grouped/components/GroupedListingEditorView";
 export { GroupedListingDetailView } from "./features/grouped/components/GroupedListingDetailView";
 export { GroupMemberPicker } from "./features/products/components/GroupMemberPicker";
 export { MarketplaceBundleCard } from "./features/products/components/MarketplaceBundleCard";
@@ -400,7 +430,12 @@ export { normalizeError, getErrorMessage, isApiNormalized, isAppNormalized, isFi
 // never touches the sibling crypto-importing helpers.
 export { buildPaymentProofReviewMessage } from "./features/whatsapp-bot/helpers/payment-proof-message";
 export { CommandPalette, useCommandPaletteHotkey } from "./features/shell/index";
-export { AdminBlogEditorView, AdminBundleEditorView, AdminCarouselEditorView, AdminCategoryEditorView, AdminCouponEditorView, AdminFaqEditorView, AdminFeatureEditorView, AdminOrderEditorView, AdminPayoutMarkPaidModal, AdminAuditLogView, ViewAuditLogEntryModal, AdminProductEditorView, AdminScammerEditorView, AdminStoreEditorView, AdminSublistingCategoryEditorView, AdminSupportTicketDetailView, } from "./features/admin/index";
+export { AdminBlogEditorView, AdminBundleEditorView, AdminCarouselEditorView, AdminCategoryEditorView, AdminCouponEditorView, AdminFaqEditorView, AdminFeatureEditorView, AdminOrderEditorView, AdminPayoutMarkPaidModal, AdminAuditLogView, ViewAuditLogEntryModal, AdminProductEditorView, AdminScammerEditorView, 
+// Client-exported for the W22 /admin/team/{new,[id]/edit} pages. It was
+// reachable only from `index.ts` (the SERVER entry), which a "use client"
+// page must never import — that is the Turbopack client-bundle trap.
+AdminEmployeeEditorView, AdminNavEditorView, AdminUserEditorView, AdminStoreEditorView, AdminSublistingCategoryEditorView, AdminSupportTicketDetailView, } from "./features/admin/index";
+export { PageLoader } from "./ui/index";
 export { ADMIN_CHECKOUT_BYPASS_FLAG_KEY } from "./features/admin/schemas/firestore";
 export { SpinWheelView, EventRaffleEntryForm } from "./features/events/index";
 export { Card, CardBody } from "./ui/index";

package/dist/constants/api-endpoints.d.ts

@@ -25,7 +25,6 @@ export declare const AUTH_ENDPOINTS: {
     readonly SESSION_ACTIVITY: "/api/auth/session/activity";
     readonly SESSION_VALIDATE: "/api/auth/session/validate";
     readonly EVENT_INIT: "/api/auth/event/init";
-    readonly RESEND_VERIFICATION: "/api/auth/resend-verification";
 };
 export declare const ACCOUNT_ENDPOINTS: {
     /** @param userId — Firestore user document id */
@@ -51,6 +50,7 @@ export declare const ACCOUNT_ENDPOINTS: {
     readonly HISTORY_MERGE: "/api/user/history/merge";
     readonly REVIEWS: "/api/user/reviews";
     readonly BIDS: "/api/user/bids";
+    readonly BID_BY_ID: (id: string) => string;
     readonly EXPORT: "/api/user/export";
     /** Claimed-coupons wallet — GET list, POST claim, DELETE by id. */
     readonly COUPONS: "/api/user/coupons";
@@ -150,6 +150,12 @@ export declare const ADMIN_ENDPOINTS: {
     readonly EVENTS: "/api/admin/events";
     readonly EVENT_BY_ID: (id: string) => string;
     readonly EVENT_STATUS: (id: string) => string;
+    /**
+     * The ONLY sanctioned writer of `lotteryConfig`. The generic EVENT_BY_ID
+     * PATCH rejects that field — it is `.passthrough()`, and letting a slot
+     * array through it erased every already-pulled slot.
+     */
+    readonly EVENT_LOTTERY_CONFIG: (id: string) => string;
     readonly EVENT_STATS: (id: string) => string;
     readonly EVENT_ENTRIES: (id: string) => string;
     readonly EVENT_ENTRIES_EXPORT: (id: string) => string;
@@ -488,7 +494,6 @@ export declare const API_ENDPOINTS: {
         readonly SESSION_ACTIVITY: "/api/auth/session/activity";
         readonly SESSION_VALIDATE: "/api/auth/session/validate";
         readonly EVENT_INIT: "/api/auth/event/init";
-        readonly RESEND_VERIFICATION: "/api/auth/resend-verification";
     };
     readonly ACCOUNT: {
         /** @param userId — Firestore user document id */
@@ -514,6 +519,7 @@ export declare const API_ENDPOINTS: {
         readonly HISTORY_MERGE: "/api/user/history/merge";
         readonly REVIEWS: "/api/user/reviews";
         readonly BIDS: "/api/user/bids";
+        readonly BID_BY_ID: (id: string) => string;
         readonly EXPORT: "/api/user/export";
         /** Claimed-coupons wallet — GET list, POST claim, DELETE by id. */
         readonly COUPONS: "/api/user/coupons";
@@ -613,6 +619,12 @@ export declare const API_ENDPOINTS: {
         readonly EVENTS: "/api/admin/events";
         readonly EVENT_BY_ID: (id: string) => string;
         readonly EVENT_STATUS: (id: string) => string;
+        /**
+         * The ONLY sanctioned writer of `lotteryConfig`. The generic EVENT_BY_ID
+         * PATCH rejects that field — it is `.passthrough()`, and letting a slot
+         * array through it erased every already-pulled slot.
+         */
+        readonly EVENT_LOTTERY_CONFIG: (id: string) => string;
         readonly EVENT_STATS: (id: string) => string;
         readonly EVENT_ENTRIES: (id: string) => string;
         readonly EVENT_ENTRIES_EXPORT: (id: string) => string;
@@ -953,7 +965,6 @@ export declare const API_ROUTES: {
         readonly SESSION_ACTIVITY: "/api/auth/session/activity";
         readonly SESSION_VALIDATE: "/api/auth/session/validate";
         readonly EVENT_INIT: "/api/auth/event/init";
-        readonly RESEND_VERIFICATION: "/api/auth/resend-verification";
     };
     readonly ACCOUNT: {
         /** @param userId — Firestore user document id */
@@ -979,6 +990,7 @@ export declare const API_ROUTES: {
         readonly HISTORY_MERGE: "/api/user/history/merge";
         readonly REVIEWS: "/api/user/reviews";
         readonly BIDS: "/api/user/bids";
+        readonly BID_BY_ID: (id: string) => string;
         readonly EXPORT: "/api/user/export";
         /** Claimed-coupons wallet — GET list, POST claim, DELETE by id. */
         readonly COUPONS: "/api/user/coupons";
@@ -1078,6 +1090,12 @@ export declare const API_ROUTES: {
         readonly EVENTS: "/api/admin/events";
         readonly EVENT_BY_ID: (id: string) => string;
         readonly EVENT_STATUS: (id: string) => string;
+        /**
+         * The ONLY sanctioned writer of `lotteryConfig`. The generic EVENT_BY_ID
+         * PATCH rejects that field — it is `.passthrough()`, and letting a slot
+         * array through it erased every already-pulled slot.
+         */
+        readonly EVENT_LOTTERY_CONFIG: (id: string) => string;
         readonly EVENT_STATS: (id: string) => string;
         readonly EVENT_ENTRIES: (id: string) => string;
         readonly EVENT_ENTRIES_EXPORT: (id: string) => string;

package/dist/constants/api-endpoints.js

@@ -37,7 +37,13 @@ export const AUTH_ENDPOINTS = {
     SESSION_ACTIVITY: "/api/auth/session/activity",
     SESSION_VALIDATE: "/api/auth/session/validate",
     EVENT_INIT: "/api/auth/event/init",
-    RESEND_VERIFICATION: "/api/auth/resend-verification",
+    /*
+     * RESEND_VERIFICATION was here and is gone. The route was deleted in the
+     * Firebase-native auth migration (Root Cause #54: the Admin SDK cannot send
+     * email, only generate action links), and the constant outlived it — so the
+     * one hook that used it 404'd on every call. `useResendVerification` now
+     * calls the client SDK directly and needs no endpoint. Do not re-add this.
+     */
 };
 // ---------------------------------------------------------------------------
 // User / Account
@@ -66,6 +72,7 @@ export const ACCOUNT_ENDPOINTS = {
     HISTORY_MERGE: "/api/user/history/merge",
     REVIEWS: "/api/user/reviews",
     BIDS: "/api/user/bids",
+    BID_BY_ID: (id) => `/api/user/bids/${id}`,
     EXPORT: "/api/user/export",
     /** Claimed-coupons wallet — GET list, POST claim, DELETE by id. */
     COUPONS: "/api/user/coupons",
@@ -177,6 +184,12 @@ export const ADMIN_ENDPOINTS = {
     EVENTS: "/api/admin/events",
     EVENT_BY_ID: (id) => `/api/admin/events/${id}`,
     EVENT_STATUS: (id) => `/api/admin/events/${id}/status`,
+    /**
+     * The ONLY sanctioned writer of `lotteryConfig`. The generic EVENT_BY_ID
+     * PATCH rejects that field — it is `.passthrough()`, and letting a slot
+     * array through it erased every already-pulled slot.
+     */
+    EVENT_LOTTERY_CONFIG: (id) => `/api/admin/events/${id}/lottery-config`,
     EVENT_STATS: (id) => `/api/admin/events/${id}/stats`,
     EVENT_ENTRIES: (id) => `/api/admin/events/${id}/entries`,
     EVENT_ENTRIES_EXPORT: (id) => `/api/admin/events/${id}/entries/export`,

package/dist/constants/field-names.d.ts

@@ -122,7 +122,7 @@ export declare const PRODUCT_FIELDS: {
      * matches zero documents — always map across via this constant.
      */
     readonly SUBLISTING_CATEGORY_ID: "sublistingCategoryId";
-    readonly SEARCH_TOKENS: "searchTokens";
+    readonly SEARCH_TXT: "searchTxt";
     readonly CREATED_AT: "createdAt";
     readonly UPDATED_AT: "updatedAt";
     readonly STATUS_VALUES: {
@@ -812,7 +812,7 @@ export declare const FAQ_FIELDS: {
     readonly ORDER: "order";
     readonly PRIORITY: "priority";
     readonly TAGS: "tags";
-    readonly SEARCH_TOKENS: "searchTokens";
+    readonly SEARCH_TXT: "searchTxt";
     readonly RELATED_FAQS: "relatedFAQs";
     readonly USE_SITE_SETTINGS: "useSiteSettings";
     readonly VARIABLES: "variables";

package/dist/constants/field-names.js

@@ -131,7 +131,7 @@ export const PRODUCT_FIELDS = {
      * matches zero documents — always map across via this constant.
      */
     SUBLISTING_CATEGORY_ID: "sublistingCategoryId",
-    SEARCH_TOKENS: "searchTokens",
+    SEARCH_TXT: "searchTxt",
     CREATED_AT: "createdAt",
     UPDATED_AT: "updatedAt",
     STATUS_VALUES: {
@@ -949,7 +949,7 @@ export const FAQ_FIELDS = {
     ORDER: "order",
     PRIORITY: "priority",
     TAGS: "tags",
-    SEARCH_TOKENS: "searchTokens",
+    SEARCH_TXT: "searchTxt",
     RELATED_FAQS: "relatedFAQs",
     USE_SITE_SETTINGS: "useSiteSettings",
     VARIABLES: "variables",

package/dist/core/newsletter.repository.js

@@ -16,7 +16,20 @@ export const NEWSLETTER_SUBSCRIBER_FIELDS = {
         POPUP: "popup",
     },
 };
-const NEWSLETTER_PII_FIELDS = [];
+/**
+ * Subscriber email, encrypted at rest.
+ *
+ * Was an empty array, so the encrypt/decrypt calls wrapped around it were both
+ * no-ops and every subscriber address sat in cleartext — with a perfectly good
+ * `emailIndex` beside it.
+ *
+ * Safe to enable because the lookup path never depended on the plaintext:
+ * `emailIndex` is written explicitly on create and queried first on read, with
+ * a plaintext-equality fallback for rows written before this, and
+ * `decryptNewsletterDoc` already covers all eight read sites. `encryptPiiFields`
+ * derives the same `emailIndex` name, so the two agree rather than conflict.
+ */
+const NEWSLETTER_PII_FIELDS = ["email"];
 function resolveRepository() {
     const provider = getProviders().db;
     if (!provider) {

package/dist/features/about/components/FAQPageView.js

@@ -25,7 +25,7 @@ export async function FAQPageView({ category, faqs = [], } = {}) {
         : [];
     const visibleFaqs = (category ? faqs.filter((f) => f.category === category) : faqs).map(toDisplayFaq);
     const activeCategory = categories.find((c) => c.slug === category);
-    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(Section, { color: "inverse", tone: "accent-banner", padding: "banner", children: _jsxs(Container, { size: "md", className: "text-center", children: [_jsx(Heading, { color: "inverse", level: 1, variant: "none", className: "mb-3", children: activeCategory ? activeCategory.label : t("title") }), _jsx(Text, { color: "inverse", variant: "none", className: "/80 max-w-2xl mx-auto", children: t("subtitle") })] }) }), _jsx(Container, { size: "md", padding: "content-banner", children: _jsxs(Stack, { direction: "md-row", gap: "xl", children: [categories.length > 0 && (_jsxs(Aside, { className: "md:w-56 flex-shrink-0", children: [_jsx(Heading, { level: 3, className: "uppercase tracking-wide mb-3", color: "muted", size: "sm", weight: "semibold", children: t("categoriesLabel") }), _jsxs(Nav, { "aria-label": "FAQ categories", spacing: "xs", children: [_jsxs(TextLink, { rounded: "lg", href: String(ROUTES.PUBLIC.FAQS), paddingX: "sm", paddingY: "xs", layout: "flex", align: "center", justify: "between", weight: !category ? "semibold" : undefined, className: `transition-colors ${!category ? "bg-primary/10 text-primary" : "hover:bg-[var(--appkit-color-surface)] hover:bg-[var(--appkit-color-surface-elevated)]"}`, size: "sm", children: [_jsxs(Span, { className: `${flex.row}`, gap: "md", children: [_jsx(HelpCircle, { className: "w-4 h-4" }), t("allCategories")] }), _jsx(ChevronRight, { className: "w-3.5 h-3.5 opacity-50" })] }), categories.map((cat) => (_jsxs(TextLink, { rounded: "lg", href: String(ROUTES.PUBLIC.FAQ_CATEGORY(cat.slug)), paddingX: "sm", paddingY: "xs", layout: "flex", align: "center", justify: "between", weight: category === cat.slug ? "semibold" : undefined, className: `transition-colors ${category === cat.slug ? "bg-primary/10 text-primary" : "hover:bg-[var(--appkit-color-surface)] hover:bg-[var(--appkit-color-surface-elevated)]"}`, size: "sm", children: [_jsxs(Span, { className: `${flex.row}`, gap: "md", children: [_jsx(Span, { children: cat.icon }), cat.label] }), _jsx(ChevronRight, { className: "w-3.5 h-3.5 opacity-50" })] }, cat.slug)))] })] })), _jsxs(Div, { className: "flex-1 min-w-0", children: [visibleFaqs.length === 0 ? (_jsxs(Section, { className: `text-center`, border: "default", surface: "subtle", rounded: "2xl", padding: "y-4xl", children: [_jsx(HelpCircle, { className: "w-10 h-10 mx-auto mb-3 text-zinc-300 dark:text-[var(--appkit-color-text-muted)]" }), _jsx(Heading, { level: 3, className: "mb-2", size: "base", children: t("emptyTitle") }), _jsx(Text, { variant: "secondary", size: "sm", children: t("emptyText") })] })) : (_jsx(FAQSearchableList, { faqs: visibleFaqs, labels: {
+    return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(Section, { color: "inverse", tone: "accent-banner", padding: "banner", children: _jsxs(Container, { size: "md", className: "text-center", children: [_jsx(Heading, { color: "inverse", level: 1, variant: "none", className: "mb-3", children: activeCategory ? activeCategory.label : t("title") }), _jsx(Text, { color: "inverse", variant: "none", className: "/80 max-w-2xl mx-auto", children: t("subtitle") })] }) }), _jsx(Container, { size: "md", padding: "content-banner", children: _jsxs(Stack, { direction: "md-row", gap: "xl", children: [categories.length > 0 && (_jsxs(Aside, { className: "md:w-56 flex-shrink-0", children: [_jsx(Heading, { level: 3, className: "uppercase tracking-wide mb-3", color: "muted", size: "sm", weight: "semibold", children: t("categoriesLabel") }), _jsxs(Nav, { "aria-label": "FAQ categories", spacing: "xs", children: [_jsxs(TextLink, { rounded: "lg", href: String(ROUTES.PUBLIC.FAQS), paddingX: "sm", paddingY: "xs", layout: "flex", align: "center", justify: "between", weight: !category ? "semibold" : undefined, className: `transition-colors ${!category ? "bg-primary/10 text-primary" : "hover:bg-surface-hover"}`, size: "sm", children: [_jsxs(Span, { className: `${flex.row}`, gap: "md", children: [_jsx(HelpCircle, { className: "w-4 h-4" }), t("allCategories")] }), _jsx(ChevronRight, { className: "w-3.5 h-3.5 opacity-50" })] }), categories.map((cat) => (_jsxs(TextLink, { rounded: "lg", href: String(ROUTES.PUBLIC.FAQ_CATEGORY(cat.slug)), paddingX: "sm", paddingY: "xs", layout: "flex", align: "center", justify: "between", weight: category === cat.slug ? "semibold" : undefined, className: `transition-colors ${category === cat.slug ? "bg-primary/10 text-primary" : "hover:bg-surface-hover"}`, size: "sm", children: [_jsxs(Span, { className: `${flex.row}`, gap: "md", children: [_jsx(Span, { children: cat.icon }), cat.label] }), _jsx(ChevronRight, { className: "w-3.5 h-3.5 opacity-50" })] }, cat.slug)))] })] })), _jsxs(Div, { className: "flex-1 min-w-0", children: [visibleFaqs.length === 0 ? (_jsxs(Section, { className: `text-center`, border: "default", surface: "subtle", rounded: "2xl", padding: "y-4xl", children: [_jsx(HelpCircle, { className: "w-10 h-10 mx-auto mb-3 text-zinc-300 dark:text-[var(--appkit-color-text-muted)]" }), _jsx(Heading, { level: 3, className: "mb-2", size: "base", children: t("emptyTitle") }), _jsx(Text, { variant: "secondary", size: "sm", children: t("emptyText") })] })) : (_jsx(FAQSearchableList, { faqs: visibleFaqs, labels: {
                                         searchPlaceholder: t("searchPlaceholder"),
                                         noResults: t("searchNoResults"),
                                     } })), _jsxs(Section, { className: `mt-10 text-center`, border: "default", surface: "subtle", rounded: "2xl", padding: "lg", children: [_jsx(Heading, { level: 3, className: "mb-2", size: "base", children: t("stillNeedHelpTitle") }), _jsx(Text, { variant: "secondary", className: "mb-4", size: "sm", children: t("stillNeedHelpText") }), _jsxs(Row, { align: "center", justify: "center", gap: "md", wrap: true, children: [_jsx(TextLink, { href: String(ROUTES.PUBLIC.HELP), children: t("helpCenter") }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.CONTACT), variant: "muted", children: t("contactUs") })] })] })] })] }) })] }));

package/dist/features/about/components/FeesView.js

@@ -95,7 +95,7 @@ export async function FeesView({} = {}) {
     return (_jsxs(Div, { className: "-mx-4 md:-mx-6 lg:-mx-8 -mt-6 sm:-mt-8 lg:-mt-10", children: [_jsx(Section, { color: "inverse", tone: "accent-banner", padding: "banner", children: _jsxs(Div, { className: `${page.container.sm} text-center`, children: [_jsx(Heading, { color: "inverse", level: 1, variant: "none", className: "mb-4", children: t("title") }), _jsx(Text, { color: "inverse", variant: "none", className: "/80 max-w-2xl mx-auto", children: t("subtitle") })] }) }), _jsxs(Stack, { gap: "section", className: `${page.container.sm}`, padding: "content-banner", children: [renderFeeTableSection(t, themed, FEE_ROWS), renderPayoutExampleSection(t, themed, OFFER_PAYOUT_ROWS), renderDisclaimerSection(t, themed)] })] }));
 }
 function renderFeeTableSection(t, themed, rows) {
-    return (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-6", children: t("tableTitle") }), _jsx(Div, { className: `${__O.xAuto}`, border: "default", rounded: "xl", children: _jsxs(Table, { size: "sm", children: [_jsx(Thead, { className: themed.bgSecondary, children: _jsxs(Tr, { children: [_jsx(Th, { className: "text-left", padding: "md", weight: "semibold", children: t("colFeeType") }), _jsx(Th, { className: "text-left", padding: "md", weight: "semibold", children: t("colRate") }), _jsx(Th, { className: "text-left", padding: "md", weight: "semibold", children: t("colPaidBy") }), _jsx(Th, { className: "text-left hidden md:table-cell", padding: "md", weight: "semibold", children: t("colNote") })] }) }), _jsx(Tbody, { className: "divide-y divide-neutral-100 divide-[var(--appkit-color-border)]", children: rows.map((row) => (_jsxs(Tr, { className: `${themed.bgPrimary} hover:bg-neutral-50 hover:bg-[var(--appkit-color-surface-elevated)]/50`, children: [_jsx(Td, { weight: "medium", padding: "md", children: row.category }), _jsx(Td, { className: CLS_RATE_CELL, children: row.rate }), _jsx(Td, { padding: "md", children: _jsx(Caption, { children: row.who }) }), _jsx(Td, { className: "text-[var(--appkit-color-text-muted)] hidden md:table-cell", padding: "md", size: "xs", children: row.note })] }, row.category))) })] }) }), _jsx(Caption, { className: "mt-3 block", color: "muted", children: t("tableNote") })] }));
+    return (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-6", children: t("tableTitle") }), _jsx(Div, { className: `${__O.xAuto}`, border: "default", rounded: "xl", children: _jsxs(Table, { size: "sm", children: [_jsx(Thead, { className: themed.bgSecondary, children: _jsxs(Tr, { children: [_jsx(Th, { className: "text-left", padding: "md", weight: "semibold", children: t("colFeeType") }), _jsx(Th, { className: "text-left", padding: "md", weight: "semibold", children: t("colRate") }), _jsx(Th, { className: "text-left", padding: "md", weight: "semibold", children: t("colPaidBy") }), _jsx(Th, { className: "text-left hidden md:table-cell", padding: "md", weight: "semibold", children: t("colNote") })] }) }), _jsx(Tbody, { className: "divide-y divide-neutral-100 divide-[var(--appkit-color-border)]", children: rows.map((row) => (_jsxs(Tr, { className: `${themed.bgPrimary} hover:bg-surface-hover`, children: [_jsx(Td, { weight: "medium", padding: "md", children: row.category }), _jsx(Td, { className: CLS_RATE_CELL, children: row.rate }), _jsx(Td, { padding: "md", children: _jsx(Caption, { children: row.who }) }), _jsx(Td, { className: "text-[var(--appkit-color-text-muted)] hidden md:table-cell", padding: "md", size: "xs", children: row.note })] }, row.category))) })] }) }), _jsx(Caption, { className: "mt-3 block", color: "muted", children: t("tableNote") })] }));
 }
 function renderPayoutExampleSection(t, themed, rows) {
     return (_jsxs(Section, { children: [_jsx(Heading, { level: 2, className: "mb-3", children: t("payoutExampleTitle") }), _jsx(Text, { variant: "secondary", className: "mb-6", children: t("payoutExampleSubtitle") }), _jsxs(Div, { className: `${__P.p5} max-w-sm`, border: "default", surface: "muted", rounded: "xl", children: [_jsx(Heading, { level: 3, className: "mb-4", size: "base", children: t("payoutExampleProduct") }), _jsx(Stack, { gap: "sm", children: rows.map((row, i) => (_jsxs(Row, { textWeight: "bold", textSize: "sm", className: `${row.highlight ? "border-t border-[var(--appkit-color-border)] mt-2" : ""}`, paddingY: row.highlight ? "t-xs" : undefined, justify: "between", children: [_jsx(Text, { className: row.highlight ? "font-bold" : "text-[var(--appkit-color-text-muted)]", children: row.label }), _jsx(Text, { className: row.highlight ? CLS_HIGHLIGHT : "", children: row.example })] }, i))) })] })] }));

package/dist/features/account/components/AddressForm.d.ts

@@ -5,6 +5,7 @@ export interface AddressFormLabels {
     phone: string;
     addressLine1: string;
     addressLine2: string;
+    landmark: string;
     city: string;
     state: string;
     postalCode: string;
@@ -20,6 +21,7 @@ export interface AddressFormPlaceholders {
     phone: string;
     addressLine1: string;
     addressLine2: string;
+    landmark: string;
     city: string;
     state: string;
     postalCode: string;

package/dist/features/account/components/AddressForm.js

@@ -15,6 +15,7 @@ const addressFormSchema = z.object({
     phone: z.string().min(1, "Phone number is required"),
     addressLine1: z.string().min(1, "Address is required"),
     addressLine2: z.string().optional(),
+    landmark: z.string().max(100, "Keep the landmark under 100 characters.").optional(),
     city: z.string().min(1, "City is required"),
     state: z.string().min(1, "State is required"),
     postalCode: z.string().min(1, "Postal code is required"),
@@ -27,6 +28,7 @@ const DEFAULT_LABELS = {
     phone: "Phone Number",
     addressLine1: "Address Line 1",
     addressLine2: "Address Line 2",
+    landmark: "Landmark",
     city: "City",
     state: "State",
     postalCode: "Postal Code",
@@ -42,6 +44,7 @@ const DEFAULT_PLACEHOLDERS = {
     phone: "Enter phone number",
     addressLine1: "Street address, P.O. box",
     addressLine2: "Apartment, suite, unit, building, floor, etc.",
+    landmark: "Opposite the Metro station, next to the temple, etc.",
     city: "City",
     state: "State/Province",
     postalCode: "Postal/ZIP code",
@@ -58,6 +61,7 @@ export function AddressForm({ initialData, onSubmit, onCancel, isLoading = false
         phone: initialData?.phone || "",
         addressLine1: initialData?.addressLine1 || "",
         addressLine2: initialData?.addressLine2 || "",
+        landmark: initialData?.landmark || "",
         city: initialData?.city || "",
         state: initialData?.state || "",
         postalCode: initialData?.postalCode || "",
@@ -114,5 +118,5 @@ export function AddressForm({ initialData, onSubmit, onCancel, isLoading = false
             submitLabel: effectiveSubmitLabel,
             cancelLabel: mergedLabels.cancel,
             isLoading,
-        }, children: ({ setFieldError, clearErrors }) => (_jsxs(_Fragment, { children: [_jsx(FormField, { label: mergedLabels.label, name: "label", type: "text", value: formData.label, onChange: (value) => handleChange("label", value), placeholder: mergedPlaceholders.label, required: true }), _jsx(FormField, { label: mergedLabels.fullName, name: "fullName", type: "text", value: formData.fullName, onChange: (value) => handleChange("fullName", value), placeholder: mergedPlaceholders.fullName, required: true }), _jsx(FormField, { label: mergedLabels.phone, name: "phone", type: "tel", value: formData.phone, onChange: (value) => handleChange("phone", value), placeholder: mergedPlaceholders.phone, required: true }), _jsx(FormField, { label: mergedLabels.addressLine1, name: "addressLine1", type: "text", value: formData.addressLine1, onChange: (value) => handleChange("addressLine1", value), placeholder: mergedPlaceholders.addressLine1, required: true }), _jsx(FormField, { label: mergedLabels.addressLine2, name: "addressLine2", type: "text", value: formData.addressLine2, onChange: (value) => handleChange("addressLine2", value), placeholder: mergedPlaceholders.addressLine2 }), _jsxs(FormGroup, { columns: 3, children: [_jsx(FormField, { label: mergedLabels.city, name: "city", type: "text", value: formData.city, onChange: (value) => handleChange("city", value), placeholder: mergedPlaceholders.city, required: true }), _jsx(FormField, { label: mergedLabels.state, name: "state", type: "text", value: formData.state, onChange: (value) => handleChange("state", value), placeholder: mergedPlaceholders.state, required: true }), _jsx(FormField, { label: mergedLabels.postalCode, name: "postalCode", type: "text", value: formData.postalCode, onChange: (value) => handleChange("postalCode", value), placeholder: mergedPlaceholders.postalCode, required: true })] }), _jsx(FormField, { label: mergedLabels.country, name: "country", type: "text", value: formData.country, onChange: (value) => handleChange("country", value), placeholder: mergedPlaceholders.country, required: true }), _jsx(Checkbox, { checked: formData.isDefault, onChange: (e) => handleChange("isDefault", e.target.checked), label: mergedLabels.setDefault }), _jsx(FormErrorSummary, {}), _jsxs(Row, { padding: "t-xs", align: "center", justify: "start", gap: "xs", children: [_jsx(Button, { type: "button", variant: "outline", onClick: onCancel, disabled: isLoading, children: mergedLabels.cancel }), _jsx(Button, { type: "submit", variant: "primary", disabled: isLoading, isLoading: isLoading, onClick: () => void submitAddress({ setFieldError, clearErrors }), children: isLoading ? mergedLabels.loading : effectiveSubmitLabel })] })] })) }));
+        }, children: ({ setFieldError, clearErrors }) => (_jsxs(_Fragment, { children: [_jsx(FormField, { label: mergedLabels.label, name: "label", type: "text", value: formData.label, onChange: (value) => handleChange("label", value), placeholder: mergedPlaceholders.label, required: true }), _jsx(FormField, { label: mergedLabels.fullName, name: "fullName", type: "text", value: formData.fullName, onChange: (value) => handleChange("fullName", value), placeholder: mergedPlaceholders.fullName, required: true }), _jsx(FormField, { label: mergedLabels.phone, name: "phone", type: "tel", value: formData.phone, onChange: (value) => handleChange("phone", value), placeholder: mergedPlaceholders.phone, required: true }), _jsx(FormField, { label: mergedLabels.addressLine1, name: "addressLine1", type: "text", value: formData.addressLine1, onChange: (value) => handleChange("addressLine1", value), placeholder: mergedPlaceholders.addressLine1, required: true }), _jsx(FormField, { label: mergedLabels.addressLine2, name: "addressLine2", type: "text", value: formData.addressLine2, onChange: (value) => handleChange("addressLine2", value), placeholder: mergedPlaceholders.addressLine2 }), _jsx(FormField, { label: mergedLabels.landmark, name: "landmark", type: "text", value: formData.landmark ?? "", onChange: (value) => handleChange("landmark", value), placeholder: mergedPlaceholders.landmark }), _jsxs(FormGroup, { columns: 3, children: [_jsx(FormField, { label: mergedLabels.city, name: "city", type: "text", value: formData.city, onChange: (value) => handleChange("city", value), placeholder: mergedPlaceholders.city, required: true }), _jsx(FormField, { label: mergedLabels.state, name: "state", type: "text", value: formData.state, onChange: (value) => handleChange("state", value), placeholder: mergedPlaceholders.state, required: true }), _jsx(FormField, { label: mergedLabels.postalCode, name: "postalCode", type: "text", value: formData.postalCode, onChange: (value) => handleChange("postalCode", value), placeholder: mergedPlaceholders.postalCode, required: true })] }), _jsx(FormField, { label: mergedLabels.country, name: "country", type: "text", value: formData.country, onChange: (value) => handleChange("country", value), placeholder: mergedPlaceholders.country, required: true }), _jsx(Checkbox, { checked: formData.isDefault, onChange: (e) => handleChange("isDefault", e.target.checked), label: mergedLabels.setDefault }), _jsx(FormErrorSummary, {}), _jsxs(Row, { padding: "t-xs", align: "center", justify: "start", gap: "xs", children: [_jsx(Button, { type: "button", variant: "outline", onClick: onCancel, disabled: isLoading, children: mergedLabels.cancel }), _jsx(Button, { type: "submit", variant: "primary", disabled: isLoading, isLoading: isLoading, onClick: () => void submitAddress({ setFieldError, clearErrors }), children: isLoading ? mergedLabels.loading : effectiveSubmitLabel })] })] })) }));
 }

package/dist/features/account/components/UserBidsView.js

@@ -51,5 +51,5 @@ export function UserBidsView() {
         },
     };
     const badge = detail ? bidStatusBadge(detail.status) : null;
-    return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(RecordDetailModal, { isOpen: detail !== null, onClose: () => setDetail(null), title: detail?.productTitle || "Bid", badges: badge ? [{ label: badge.label }] : undefined, fields: detail ? buildBidDetailFields(detail, "buyer") : undefined, footer: detail ? (_jsx(TextLink, { href: String(ROUTES.PUBLIC.AUCTION_DETAIL(detail.productId)), children: "View auction \u2192" })) : undefined })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(DataListingView, { config: config }), _jsx(RecordDetailModal, { isOpen: detail !== null, onClose: () => setDetail(null), title: detail?.productTitle || "Bid", badges: badge ? [{ label: badge.label }] : undefined, fields: detail ? buildBidDetailFields(detail, "buyer") : undefined, footer: detail ? (_jsxs(_Fragment, { children: [_jsx(TextLink, { href: String(ROUTES.USER.BID_DETAIL(detail.id)), children: "Open full page \u2192" }), _jsx(TextLink, { href: String(ROUTES.PUBLIC.AUCTION_DETAIL(detail.productId)), children: "View auction \u2192" })] })) : undefined })] }));
 }

package/dist/features/account/components/UserSidebar.js

@@ -27,7 +27,7 @@ function NavLink({ item, isActive, onClick }) {
     };
     const linkClass = `flex items-center justify-end gap-[var(--appkit-space-2-5)] rounded-lg px-[var(--appkit-space-3)] py-[var(--appkit-space-2)] text-[0.8125rem] font-medium leading-tight transition-colors ${isActive
         ? "bg-primary-50 dark:bg-primary-900/25 text-primary-700 dark:text-primary-300"
-        : "text-[var(--appkit-color-text-muted)] hover:bg-zinc-50 hover:bg-[var(--appkit-color-surface-elevated)] hover:text-zinc-900 dark:hover:text-zinc-100"}`;
+        : "text-[var(--appkit-color-text-muted)] hover:bg-surface-hover hover:text-zinc-900 dark:hover:text-zinc-100"}`;
     return (_jsxs(_Fragment, { children: [_jsxs(Link, { href: item.href, onClick: handleClick, className: linkClass, children: [item.icon && _jsx(Span, { size: "base", className: "shrink-0 opacity-70", children: item.icon }), _jsx(Span, { className: "truncate", children: item.label })] }), showConfirm && item.confirm && (_jsx(ConfirmDeleteModal, { isOpen: true, title: item.confirm.title ?? "Confirm", message: item.confirm.message, confirmText: "Continue", variant: "warning", onConfirm: () => {
                     setShowConfirm(false);
                     onClick?.();

package/dist/features/account/components/UserSupportView.js

@@ -7,6 +7,8 @@ import { Button, Div, FormActions, Row, Select, SideDrawer, Span, Stack, Text, U
 import { FieldInput } from "../../../ui/forms/FieldInput";
 import { FieldTextarea } from "../../../ui/forms/FieldTextarea";
 import { apiClient } from "../../../http";
+import { supportTicketCreateSchema } from "../../support/schemas/ticket-create-form";
+import { ValidationError } from "../../../errors/validation-error";
 import { SUPPORT_ENDPOINTS } from "../../../constants/api-endpoints";
 const __P = {
     p3: "p-[var(--appkit-space-3)]",
@@ -33,7 +35,7 @@ const CATEGORY_OPTIONS = [
     { label: "Appeal a ban (unban request)", value: "unban_request" },
     { label: "General", value: "general" },
 ];
-const CLS_MSG_USER = "bg-zinc-50 border border-zinc-200 bg-[var(--appkit-color-surface)]/40 border-[var(--appkit-color-border)]";
+const CLS_MSG_USER = "border bg-[var(--appkit-color-surface)]/40 border-[var(--appkit-color-border)]";
 const CLS_MSG_STAFF = "bg-info-surface border border-info dark:bg-info-surface dark:border-info";
 const STATUS_BADGE = {
     open: "bg-info-surface text-info",
@@ -68,12 +70,32 @@ export function UserSupportView(_props) {
     const invalidate = () => queryClient.invalidateQueries({ queryKey: ["user", "support-tickets"] });
     const createMutation = useApiMutation({
         mutationFn: async () => {
-            await apiClient.post(SUPPORT_ENDPOINTS.TICKETS, {
+            /*
+             * This drawer validated NOTHING. Its sibling page
+             * (`/user/support/new`) hand-rolled a `canSubmit` boolean that required
+             * an order id for an `order_issue` ticket — a real rule, since an order
+             * complaint with no order is unactionable — and the route did not
+             * enforce it either. So the same ticket was acceptable or not purely
+             * depending on which surface the user happened to open.
+             *
+             * One schema now, across both surfaces and the route.
+             */
+            const parsed = supportTicketCreateSchema.safeParse({
                 subject: newSubject.trim(),
                 category: newCategory,
                 description: newDescription.trim(),
                 orderId: newOrderId.trim() || undefined,
             });
+            if (!parsed.success) {
+                /*
+                 * ValidationError, not a bare Error — it carries the issue LIST, so
+                 * the failure keeps which field caused it. A plain Error flattens the
+                 * whole thing to one string, which is what `audit-unvalidated-safeparse`
+                 * exists to stop. It caught this in my own code.
+                 */
+                throw new ValidationError(parsed.error.issues[0]?.message ?? "Check the ticket details.", parsed.error.issues);
+            }
+            await apiClient.post(SUPPORT_ENDPOINTS.TICKETS, parsed.data);
         },
         onSuccess: () => {
             showToast("Support ticket created.", "success");

package/dist/features/account/hooks/useAddresses.d.ts

@@ -9,6 +9,18 @@ export interface Address {
     state: string;
     postalCode: string;
     country: string;
+    /**
+     * A nearby reference point ("opposite the Metro station").
+     *
+     * Store addresses have always accepted it — `POST /api/store/addresses`
+     * declares `landmark: z.string().max(100).optional()` and
+     * `SellerAddressesView`'s drawer collects it — while this shape did not.
+     * So an address created in that drawer WITH a landmark, then edited through
+     * any surface built on `AddressForm`, was saved back with `landmark`
+     * absent and lost it. Added here, on the form, and on the `Address` type so
+     * the round trip is lossless.
+     */
+    landmark?: string;
     isDefault?: boolean;
 }
 export interface AddressFormData {
@@ -21,6 +33,8 @@ export interface AddressFormData {
     state: string;
     postalCode: string;
     country: string;
+    /** See Address.landmark — the form must carry it or an edit drops it. */
+    landmark?: string;
     isDefault?: boolean;
 }
 interface SetDefaultAddressData {
@@ -46,8 +60,22 @@ export declare function useCreateAddress(options?: {
     onSuccess?: (data: Address) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<Address, Error, AddressFormData, unknown>;
-export declare function useUpdateAddress(id: string, options?: {
+/**
+ * Update options.
+ *
+ * `method` exists because the two portals disagree: `/api/user/addresses/[id]`
+ * exports PATCH and `/api/store/addresses/[id]` exports PUT, and
+ * `SellerAddressesView` hardcodes PUT against the latter. Changing the route's
+ * verb would break that working call site, so the hook bends instead.
+ *
+ * Caught by `audit-client-verb-match` before the store pages were written —
+ * this hook would have 405'd the moment they reused it.
+ */
+export interface UpdateAddressOptions {
     byIdEndpoint?: (id: string) => string;
+    method?: "PUT" | "PATCH";
+}
+export declare function useUpdateAddress(id: string, options?: UpdateAddressOptions & {
     onSuccess?: (data: Address) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<Address, Error, AddressFormData, unknown>;

package/dist/features/account/hooks/useAddresses.js

@@ -48,8 +48,11 @@ export function useCreateAddress(options) {
 export function useUpdateAddress(id, options) {
     const queryClient = useQueryClient();
     const byIdEndpoint = options?.byIdEndpoint ?? DEFAULT_ENDPOINTS.byId;
+    const method = options?.method ?? "PATCH";
     return useMutation({
-        mutationFn: (data) => apiClient.patch(byIdEndpoint(id), data),
+        mutationFn: (data) => method === "PUT"
+            ? apiClient.put(byIdEndpoint(id), data)
+            : apiClient.patch(byIdEndpoint(id), data),
         onSuccess: (data) => {
             queryClient.invalidateQueries({ queryKey: ["addresses"] });
             options?.onSuccess?.(data);

package/dist/features/account/hooks/useProfile.d.ts

@@ -1,4 +1,4 @@
-import { type JsonValue } from "@mohasinac/appkit/client";
+import type { JsonValue } from "../../../schemas/types";
 export interface UserProfile {
     uid: string;
     email: string | null;

package/dist/features/account/hooks/useProfile.js

@@ -1,4 +1,4 @@
-import { useApiMutation } from "@mohasinac/appkit/client";
+import { useApiMutation } from "../../../client/api/useApiMutation";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { apiClient } from "../../../http";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints";

package/dist/features/addresses/repository/addresses.repository.d.ts

@@ -11,6 +11,19 @@ export declare class AddressesRepository extends BaseRepository<AddressDocument>
     listByOwnerType(ownerType: AddressOwnerType, limit?: number): Promise<AddressDocument[]>;
     countByOwner(ownerType: AddressOwnerType, ownerId: string): Promise<number>;
     createForOwner(ownerType: AddressOwnerType, ownerId: string, input: AddressCreateInput): Promise<AddressDocument>;
+    /**
+     * Read one address, scoped to its owner.
+     *
+     * The owner check is `ownerType` AND `ownerId` — the same pair
+     * `updateForOwner` and `deleteForOwner` use, because `addresses` is one
+     * top-level collection holding both buyer and store addresses discriminated
+     * by `ownerType` (SB-UNI-A). Checking only `ownerId` would let a seller read
+     * their own personal address through the store endpoint and vice versa.
+     *
+     * Returns null rather than throwing: the caller turns it into a 404, and a
+     * missing address and a foreign one must be indistinguishable to the client.
+     */
+    getForOwner(ownerType: AddressOwnerType, ownerId: string, addressId: string): Promise<AddressDocument | null>;
     updateForOwner(ownerType: AddressOwnerType, ownerId: string, addressId: string, input: AddressUpdateInput): Promise<AddressDocument>;
     deleteForOwner(ownerType: AddressOwnerType, ownerId: string, addressId: string): Promise<void>;
     setDefault(ownerType: AddressOwnerType, ownerId: string, addressId: string): Promise<AddressDocument>;

package/dist/features/addresses/repository/addresses.repository.js

@@ -115,6 +115,25 @@ export class AddressesRepository extends BaseRepository {
             throw new DatabaseError(`Failed to create address for ${ownerType}:${ownerId}`, error);
         }
     }
+    /**
+     * Read one address, scoped to its owner.
+     *
+     * The owner check is `ownerType` AND `ownerId` — the same pair
+     * `updateForOwner` and `deleteForOwner` use, because `addresses` is one
+     * top-level collection holding both buyer and store addresses discriminated
+     * by `ownerType` (SB-UNI-A). Checking only `ownerId` would let a seller read
+     * their own personal address through the store endpoint and vice versa.
+     *
+     * Returns null rather than throwing: the caller turns it into a 404, and a
+     * missing address and a foreign one must be indistinguishable to the client.
+     */
+    async getForOwner(ownerType, ownerId, addressId) {
+        const existing = await this.findById(addressId);
+        if (!existing || existing.ownerType !== ownerType || existing.ownerId !== ownerId) {
+            return null;
+        }
+        return existing;
+    }
     async updateForOwner(ownerType, ownerId, addressId, input) {
         const existing = await this.findById(addressId);
         if (!existing || existing.ownerType !== ownerType || existing.ownerId !== ownerId) {

package/dist/features/admin/actions/chat-actions.js

@@ -14,6 +14,7 @@ import { getAdminRealtimeDb } from "../../../providers/db-firebase/index";
 import { AuthorizationError, NotFoundError, ValidationError, } from "../../../errors/index";
 import { ERROR_MESSAGES } from "../../../errors/messages";
 import { serverLogger } from "../../../monitoring/index";
+import { normalizeError } from "../../../errors/normalize";
 export async function getChatRooms(userId, chatEnabled) {
     if (!chatEnabled)
         throw new AuthorizationError("Chat is temporarily unavailable.");
@@ -77,7 +78,10 @@ export async function sendChatMessage(userId, chatId, message) {
             : (room.buyerName ?? "Member");
     await msgRef.set({ userId, userName, message, timestamp: Date.now() });
     chatRepository.updateLastMessage(chatId, message).catch((err) => {
-        serverLogger.warn("Failed to update chat lastMessage", { chatId, err });
+        serverLogger.warn("Failed to update chat lastMessage", {
+            chatId,
+            error: normalizeError(err).message,
+        });
     });
     serverLogger.debug("sendChatMessage", { userId, chatId });
     return { messageId: id, timestamp: Date.now() };

package/dist/features/admin/components/AdminAdsView.js

@@ -116,7 +116,7 @@ export function AdminAdsView({ endpoint = ADMIN_ENDPOINTS.ADS, labels = {}, crea
             render: (row) => {
                 const nextStatus = row.status === "active" ? "paused" : "active";
                 const cannotPublish = nextStatus === "active" && row.publishReady === false;
-                return (_jsxs(Row, { align: "center", gap: "sm", children: [renderEditLink ? renderEditLink(row) : (_jsx(TextLink, { variant: "bare", href: `/admin/ads/${row.id}/edit`, rounded: "md", paddingX: "sm", size: "xs", layout: "inline-flex", align: "center", className: "h-8 border border-neutral-200 border-[var(--appkit-color-border)]", children: "Edit" })), _jsx(Button, { size: "sm", variant: "outline", disabled: statusMutation.isPending || cannotPublish, onClick: () => statusMutation.mutate({ id: row.id, nextStatus }), children: row.status === "active" ? "Pause" : "Publish" })] }));
+                return (_jsxs(Row, { align: "center", gap: "sm", children: [renderEditLink ? renderEditLink(row) : (_jsx(TextLink, { variant: "bare", href: `/admin/ads/${row.id}/edit`, rounded: "md", paddingX: "sm", size: "xs", layout: "inline-flex", align: "center", className: "h-8 border border-[var(--appkit-color-border)]", children: "Edit" })), _jsx(Button, { size: "sm", variant: "outline", disabled: statusMutation.isPending || cannotPublish, onClick: () => statusMutation.mutate({ id: row.id, nextStatus }), children: row.status === "active" ? "Pause" : "Publish" })] }));
             },
         },
     ];