@mohasinac/appkit 4.26.0 → 4.28.0

package/dist/features/auctions/components/MarketplaceAuctionCard.js

@@ -3,7 +3,8 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { normalizeError } from "../../../errors/normalize";
 import { useCallback, useEffect, useRef, useState } from "react";
 import { useRouter } from "next/navigation";
-import { Clock, Gavel, Heart, Play, ShoppingBag, Star } from "lucide-react";
+import { Clock, Gavel, Play, ShoppingBag, Star } from "lucide-react";
+import { WishlistHeartButton } from "../../wishlist/components/WishlistHeartButton";
 import { useLongPress } from "../../../react/hooks/useLongPress";
 import { MediaImage } from "../../media";
 import { useWishlistToggle } from "../../wishlist";
@@ -17,19 +18,17 @@ const CLS_STAR_ICON = "h-5 w-5 fill-warning text-warning";
 const CLS_LIVE_BADGE = "rounded-full bg-error-solid px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] text-error-on-solid";
 const CLS_ENDING_BADGE = "rounded-full bg-warning-solid px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] text-warning-on-solid";
 const CLS_RESERVE_BADGE = "inline-flex items-center gap-[var(--appkit-space-1)] rounded-full bg-warning-solid px-[var(--appkit-space-2)] py-[var(--appkit-space-0-5)] text-warning-on-solid";
-const CLS_HEART_ON = "fill-error text-error";
-const CLS_HEART_OFF = "text-zinc-400";
 function renderAuctionCardHero(props) {
     const { product, auctionHref, currentSrc, hovered, images, imageIndex, hasVideo, isEnded, isEndingSoon, isSelected, selectable, mergedLabels, onSelect, setHovered, handleSelect } = props;
     return (_jsxs(BaseListingCard.Hero, { aspect: "square", variant: "grid", onMouseEnter: () => setHovered(true), onMouseLeave: () => setHovered(false), children: [_jsx(TextLink, { href: auctionHref ?? "#", className: "absolute inset-0 block", children: _jsx(MediaImage, { src: currentSrc, alt: product.title, size: "card", fallback: "Auction image", className: `transition-transform duration-500 ${hovered && images.length > 1 ? "scale-105" : "scale-100"}` }) }), hasVideo && imageIndex === 0 ? (_jsx(Div, { className: "absolute right-2 top-2", children: _jsx(Span, { surface: "overlay-sm", layout: "flex-center", color: "inverse", className: "h-8 w-8", rounded: "full", children: _jsx(Play, { className: "h-4 w-4", "aria-label": mergedLabels.videoLabel }) }) })) : null, images.length > 1 ? (_jsx(Row, { gap: "xs", className: "pointer-events-none absolute bottom-2 left-1/2 -translate-x-1/2", children: images.map((_, index) => (_jsx(Span, { className: `transition-all duration-200 ${index === imageIndex ? "h-1.5 w-3 bg-[white]" : "h-1.5 w-1.5 bg-[white]/60"}`, rounded: "full" }, `${product.id}-image-${index}`))) })) : null, product.featured ? (_jsx(Div, { className: "pointer-events-none absolute left-2 top-2 z-10", children: _jsx(Star, { className: CLS_STAR_ICON }) })) : null, onSelect && (_jsx(BaseListingCard.Checkbox, { selected: isSelected, onSelect: handleSelect, label: isSelected ? mergedLabels.deselectItem : mergedLabels.selectItem, className: selectable || isSelected ? "opacity-100" : "opacity-0 pointer-events-none group-hover:opacity-100 group-hover:pointer-events-auto transition-opacity" })), _jsxs(Stack, { className: `absolute left-2 z-10 ${product.featured ? "top-8" : "top-2"}`, gap: "xs", children: [!isEnded ? _jsx(Span, { size: "xs", weight: "bold", className: CLS_LIVE_BADGE, children: mergedLabels.liveBadge }) : null, isEndingSoon ? _jsx(Span, { size: "xs", weight: "bold", className: CLS_ENDING_BADGE, children: mergedLabels.endingSoon }) : null, isEnded ? _jsx(Span, { color: "inverse", size: "xs", weight: "bold", surface: "overlay-lg", rounded: "full", padding: "pill-xs", children: mergedLabels.ended }) : null, product.status === "sold" ? _jsx(Span, { color: "inverse", size: "xs", weight: "bold", surface: "overlay-xl", rounded: "full", padding: "pill-xs", children: mergedLabels.sold }) : null] }), _jsx(Div, { className: "pointer-events-none absolute bottom-2 right-2 z-10", children: _jsxs(Span, { size: "xs", weight: "semibold", className: CLS_RESERVE_BADGE, children: [_jsx(Gavel, { className: "h-3 w-3" }), mergedLabels.typeBadge] }) })] }));
 }
 function renderAuctionCardInfoList(props) {
     const { product, auctionHref, displayBid, bidCount, isEnded, remaining, inWishlist, wishlistLoading, wishlistActions, countdownClass, mergedLabels, handleWishlist, handleNavigate } = props;
-    return (_jsxs(_Fragment, { children: [_jsxs(Row, { className: "min-w-0", align: "start", justify: "between", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: `flex-1 leading-snug transition-colors hover:text-primary`, color: "primary", truncate: 2, size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(Button, { rounded: "full", type: "button", variant: "ghost", onClick: handleWishlist, disabled: wishlistLoading, "aria-label": inWishlist ? mergedLabels.removeFromWishlist : mergedLabels.addToWishlist, className: "shrink-0 p-[0.25rem]", children: _jsx(Heart, { className: `h-3.5 w-3.5 ${inWishlist ? CLS_HEART_ON : CLS_HEART_OFF}` }) })) : null] }), _jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Text, { className: "text-primary", size: "sm", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), _jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", className: `items-[center] py-[0.125rem] text-[11px] ${countdownClass}`, padding: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-2.5 w-2.5" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), bidCount > 0 && _jsx(Caption, { className: "text-[11px]", children: mergedLabels.totalBids(bidCount) })] }), !isEnded && (_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", className: "self-start px-[0.625rem] mt-0.5", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }))] }));
+    return (_jsxs(_Fragment, { children: [_jsxs(Row, { className: "min-w-0", align: "start", justify: "between", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: `flex-1 leading-snug transition-colors hover:text-primary`, color: "primary", truncate: 2, size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(WishlistHeartButton, { size: "inline", inWishlist: inWishlist, isLoading: wishlistLoading, addLabel: mergedLabels.addToWishlist, removeLabel: mergedLabels.removeFromWishlist, onToggle: handleWishlist })) : null] }), _jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Text, { className: "text-primary", size: "sm", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), _jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", className: `items-[center] py-[0.125rem] text-[11px] ${countdownClass}`, padding: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-2.5 w-2.5" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), bidCount > 0 && _jsx(Caption, { className: "text-[11px]", children: mergedLabels.totalBids(bidCount) })] }), !isEnded && (_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", className: "self-start px-[0.625rem] mt-0.5", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }))] }));
 }
 function renderAuctionCardInfoGrid(props) {
     const { product, auctionHref, displayBid, bidCount, hasCurrentBid, isEnded, remaining, resolvedBuyoutPrice, inWishlist, wishlistLoading, wishlistActions, countdownClass, mergedLabels, handleWishlist, handleNavigate } = props;
-    return (_jsxs(_Fragment, { children: [_jsxs(Row, { align: "start", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: "min-w-0 flex-1 leading-snug transition-colors hover:text-primary", color: "primary", size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(Button, { rounded: "full", type: "button", variant: "ghost", onClick: handleWishlist, disabled: wishlistLoading, "aria-label": inWishlist ? mergedLabels.removeFromWishlist : mergedLabels.addToWishlist, className: "-mt-0.5 p-[0.25rem]", children: _jsx(Heart, { className: `h-4 w-4 ${inWishlist ? CLS_HEART_ON : CLS_HEART_OFF}` }) })) : null] }), _jsxs(Div, { children: [_jsx(Caption, { children: isEnded && hasCurrentBid ? mergedLabels.winningBid : hasCurrentBid ? mergedLabels.currentBid : mergedLabels.startingBid }), _jsx(Text, { className: "leading-none text-primary", size: "base", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), isEnded && product.winnerDisplayName && (_jsxs(Caption, { className: "mt-0.5", color: "muted", children: [mergedLabels.wonBy, ": ", maskDisplayName(product.winnerDisplayName)] }))] }), _jsxs(Row, { wrap: true, justify: "between", gap: "sm", className: "gap-x-2 gap-y-1", children: [_jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", textSize: "xs", className: `items-[center] ${countdownClass}`, paddingY: "y-2xs", paddingX: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-3 w-3" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), _jsx(Caption, { children: mergedLabels.totalBids(bidCount) })] }), _jsx(Row, { wrap: true, gap: "xs", className: "mt-auto", children: isEnded ? (_jsx(Button, { gap: "xs", type: "button", variant: "ghost", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1 cursor-not-allowed opacity-60", disabled: true, children: _jsx(Span, { children: mergedLabels.ended }) })) : (_jsxs(_Fragment, { children: [_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }), resolvedBuyoutPrice ? (
+    return (_jsxs(_Fragment, { children: [_jsxs(Row, { align: "start", gap: "sm", children: [_jsx(TextLink, { href: auctionHref ?? "#", className: "min-w-0 flex-1 leading-snug transition-colors hover:text-primary", color: "primary", size: "sm", weight: "medium", children: product.title }), wishlistActions ? (_jsx(WishlistHeartButton, { size: "inline", inWishlist: inWishlist, isLoading: wishlistLoading, addLabel: mergedLabels.addToWishlist, removeLabel: mergedLabels.removeFromWishlist, onToggle: handleWishlist })) : null] }), _jsxs(Div, { children: [_jsx(Caption, { children: isEnded && hasCurrentBid ? mergedLabels.winningBid : hasCurrentBid ? mergedLabels.currentBid : mergedLabels.startingBid }), _jsx(Text, { className: "leading-none text-primary", size: "base", weight: "bold", children: formatCurrency(displayBid, getDefaultCurrency()) }), isEnded && product.winnerDisplayName && (_jsxs(Caption, { className: "mt-0.5", color: "muted", children: [mergedLabels.wonBy, ": ", maskDisplayName(product.winnerDisplayName)] }))] }), _jsxs(Row, { wrap: true, justify: "between", gap: "sm", className: "gap-x-2 gap-y-1", children: [_jsxs(Div, { layout: "inline-flex", gap: "1", textWeight: "semibold", textSize: "xs", className: `items-[center] ${countdownClass}`, paddingY: "y-2xs", paddingX: "x-xs", rounded: "full", children: [_jsx(Clock, { className: "h-3 w-3" }), _jsx(Span, { children: formatCountdownLabel(remaining, mergedLabels.ended) })] }), _jsx(Caption, { children: mergedLabels.totalBids(bidCount) })] }), _jsx(Row, { wrap: true, gap: "xs", className: "mt-auto", children: isEnded ? (_jsx(Button, { gap: "xs", type: "button", variant: "ghost", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1 cursor-not-allowed opacity-60", disabled: true, children: _jsx(Span, { children: mergedLabels.ended }) })) : (_jsxs(_Fragment, { children: [_jsxs(Button, { gap: "xs", type: "button", variant: "warning", size: "sm", textSize: "xs", paddingX: "xs", className: "flex-1", onClick: handleNavigate, children: [_jsx(Gavel, { className: "h-3 w-3" }), _jsx(Span, { children: mergedLabels.placeBid })] }), resolvedBuyoutPrice ? (
                         /* `secondary`, not `danger` — this button only navigates to the
                            PDP, and `danger` is reserved for destructive actions (Rule #7
                            kinds). ACTIONS.AUCTION["buy-it-now"] is itself `secondary`. */

package/dist/features/auctions/components/PlaceBidFormClient.d.ts

@@ -5,6 +5,31 @@ export interface PlaceBidInput {
     bidAmount: number;
     autoMaxBid?: number;
 }
+/**
+ * The `ActionResult` envelope every server action in this app returns.
+ *
+ * 🛑 Exactly ONE level. `onPlaceBid`/`onBuyNow` used to be typed
+ * `Promise<unknown>`, and the consumer's actions returned a *doubly*-wrapped
+ * `{ ok: true, data: { ok: false, error } }`. Reading the outer `ok` therefore
+ * saw `true` for every possible outcome — including every failure — so Buy Now
+ * placed a real bid and a real locked cart line and then silently
+ * `router.refresh()`ed a page that renders nothing from the cart. Typing these
+ * props is what makes a re-introduced second envelope a compile error rather
+ * than a silent no-op button.
+ */
+export type BidActionEnvelope<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: string;
+    code?: string;
+    issues?: unknown[];
+};
+/** The subset of `BuyNowAuctionResult` this component actually consumes. */
+export interface BuyNowSuccess {
+    checkoutUrl?: string;
+}
 export interface PlaceBidFormClientProps {
     productId: string;
     currentBid: number;
@@ -17,8 +42,8 @@ export interface PlaceBidFormClientProps {
     buyNowPrice: number | null;
     bidCount: number;
     tags?: string[];
-    onPlaceBid: (input: PlaceBidInput) => Promise<unknown>;
-    onBuyNow?: () => Promise<unknown>;
+    onPlaceBid: (input: PlaceBidInput) => Promise<BidActionEnvelope<unknown>>;
+    onBuyNow?: () => Promise<BidActionEnvelope<BuyNowSuccess>>;
 }
 export declare function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, startingBid, tiers, minBidIncrementOverride, currency, isEnded, auctionEndDate, buyNowPrice, bidCount: ssrBidCount, tags, onPlaceBid, onBuyNow, }: PlaceBidFormClientProps): React.JSX.Element;
 /**

package/dist/features/auctions/components/PlaceBidFormClient.js

@@ -48,6 +48,12 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
     const [isBuyNowPending, startBuyNowTransition] = useTransition();
     const [success, setSuccess] = useState(false);
     const [showLoginModal, setShowLoginModal] = useState(false);
+    /**
+     * Buy Now has no field to hang an error off — it is a standalone button, not
+     * a form input — so it needs its own slot. Without one, every domain failure
+     * (`AUCTION_ENDED`, `BUY_NOW_UNAVAILABLE`, rate-limit) was silent.
+     */
+    const [buyNowError, setBuyNowError] = useState(null);
     /** Last amount the form itself wrote — see `seedAmount` below. */
     const lastSeeded = useRef(minBid);
     /**
@@ -140,43 +146,59 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
         }
     }
     function bidErrorMessage(result) {
-        if (!result || typeof result !== "object" || !("ok" in result))
-            return null;
-        const r = result;
-        if (r.ok !== false)
+        if (result.ok)
             return null;
-        return (r.code && BID_ERROR_DISPLAY[r.code]) ?? r.error ?? "Failed to place bid. Please try again.";
+        return ((result.code && BID_ERROR_DISPLAY[result.code]) ??
+            result.error ??
+            "Failed to place bid. Please try again.");
+    }
+    /**
+     * Show a Buy Now failure.
+     *
+     * Every failure used to be indistinguishable from success and was discarded.
+     * An auth failure never THROWS across a server-action boundary — it arrives
+     * as a code — so `isAuthError` in the catch below could never fire for it.
+     *
+     * ONLY `UNAUTHENTICATED` (401) means "sign in". `FORBIDDEN` (403) is "signed
+     * in, but not allowed" — bidding on your own auction, or an active
+     * `place_bids` soft ban. A login prompt for those tells the buyer to fix
+     * something that is not the problem.
+     */
+    function reportBuyNowFailure(code, message) {
+        if (code === "UNAUTHENTICATED") {
+            setShowLoginModal(true);
+            return;
+        }
+        setBuyNowError((code && BID_ERROR_DISPLAY[code]) ??
+            message ??
+            "Buy Now failed. Please try again.");
     }
     function handleBuyNow() {
         if (!onBuyNow)
             return;
         setSuccess(false);
+        setBuyNowError(null);
         startBuyNowTransition(async () => {
             try {
                 const result = await onBuyNow();
-                if (result &&
-                    typeof result === "object" &&
-                    "ok" in result &&
-                    result.ok === false) {
-                    setSuccess(false);
+                if (!result.ok) {
+                    reportBuyNowFailure(result.code, result.error);
                     return;
                 }
                 setSuccess(true);
                 // Buy-Now writes a locked cart line, so send the buyer straight to the
-                // auction checkout lane to pay for it. This used to just call
-                // `router.refresh()` and discard the action's result entirely, leaving
-                // the buyer on the product page with no indication that anything was
-                // owed — the action returned an orderId nobody ever used.
-                const checkoutUrl = result?.checkoutUrl;
-                if (checkoutUrl)
-                    router.push(checkoutUrl);
+                // auction checkout lane to pay for it. `buyNowAuction` deliberately
+                // never touches the product document, so falling through to
+                // `router.refresh()` re-renders a byte-identical page — which is
+                // exactly what "the button does nothing" looked like.
+                if (result.data.checkoutUrl)
+                    router.push(result.data.checkoutUrl);
                 else
                     router.refresh();
             }
             catch (err) {
                 void normalizeError(err);
-                if (isAuthError(err))
-                    setShowLoginModal(true);
+                reportBuyNowFailure(isAuthError(err) ? "UNAUTHENTICATED" : undefined, err instanceof Error ? err.message : undefined);
             }
         });
     }
@@ -212,7 +234,7 @@ export function PlaceBidFormClient({ productId, currentBid: ssrCurrentBid, start
                                     return applyZodIssues(parsed.error.issues, setFieldError);
                                 setSuccess(false);
                                 startTransition(() => submitBid(parsed.data.bidAmount, setFieldError));
-                            }, children: isEnded ? "Auction Ended" : "Place Bid" }), buyNowAvailable && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "secondary", size: "md", className: "w-full", type: "button", disabled: isBuyNowPending || isPending, isLoading: isBuyNowPending, onClick: handleBuyNow, children: `Buy Now — ${formatCurrency(buyNowPrice, currency)}` }), _jsxs(Text, { align: "center", size: "xs", color: "muted", children: ["Skips the bidding. The auction stays live until you pay \u2014 complete checkout within ", AUCTION_BUYOUT_WINDOW_MINUTES, " minutes."] })] }))] })) }), tags.length > 0 && (_jsx(Div, { border: "default", className: "border-t", padding: "t-md", children: _jsx(Row, { wrap: true, gap: "xs", children: tags.map((tag) => (_jsx(Span, { rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", size: "xs", children: tag }, tag))) }) }))] }));
+                            }, children: isEnded ? "Auction Ended" : "Place Bid" }), buyNowAvailable && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "secondary", size: "md", className: "w-full", type: "button", disabled: isBuyNowPending || isPending, isLoading: isBuyNowPending, onClick: handleBuyNow, children: `Buy Now — ${formatCurrency(buyNowPrice, currency)}` }), buyNowError && (_jsx(Text, { align: "center", size: "xs", variant: "error", role: "alert", children: buyNowError })), _jsxs(Text, { align: "center", size: "xs", color: "muted", children: ["Skips the bidding. The auction stays live until you pay \u2014 complete checkout within ", AUCTION_BUYOUT_WINDOW_MINUTES, " minutes."] })] }))] })) }), tags.length > 0 && (_jsx(Div, { border: "default", className: "border-t", padding: "t-md", children: _jsx(Row, { wrap: true, gap: "xs", children: tags.map((tag) => (_jsx(Span, { rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", size: "xs", children: tag }, tag))) }) }))] }));
 }
 /**
  * `PlaceBidModalButton` — opens a modal that hosts the same PlaceBidFormClient.

package/dist/features/auth/components/SocialAuthButtons.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { Button, Div, Row, Span } from "../../../ui";
 export function SocialAuthButtons({ onGoogle, disabled, dividerLabel, googleLabel, }) {
-    return (_jsxs(_Fragment, { children: [_jsxs(Div, { className: "relative", children: [_jsx(Row, { className: "absolute inset-0", align: "center", children: _jsx(Div, { className: "w-full border-t border-neutral-200" }) }), _jsx(Row, { textSize: "sm", className: "relative", justify: "center", children: _jsx(Span, { padding: "x-xs", surface: "default", color: "muted", children: dividerLabel }) })] }), _jsx(Div, { layout: "grid", gap: "3", className: "grid-cols-1", children: _jsxs(Button, { rounded: "md", type: "button", onClick: onGoogle, disabled: disabled, variant: "outline", paddingX: "md", paddingY: "sm", textSize: "sm", weight: "medium", className: "inline- justify-[center] border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface)] text-[var(--appkit-color-text)] dark:text-[var(--appkit-color-text)] hover:bg-neutral-50 hover:bg-[var(--appkit-color-surface-elevated)] disabled:cursor-not-allowed disabled:opacity-50", children: [_jsxs("svg", { className: "mr-2 h-5 w-5", viewBox: "0 0 24 24", "aria-hidden": "true", children: [_jsx("path", { fill: "currentColor", d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" }), _jsx("path", { fill: "currentColor", d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" }), _jsx("path", { fill: "currentColor", d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" }), _jsx("path", { fill: "currentColor", d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" })] }), googleLabel] }) })] }));
+    return (_jsxs(_Fragment, { children: [_jsxs(Div, { className: "relative", children: [_jsx(Row, { className: "absolute inset-0", align: "center", children: _jsx(Div, { className: "w-full border-t border-neutral-200" }) }), _jsx(Row, { textSize: "sm", className: "relative", justify: "center", children: _jsx(Span, { padding: "x-xs", surface: "default", color: "muted", children: dividerLabel }) })] }), _jsx(Div, { layout: "grid", gap: "3", className: "grid-cols-1", children: _jsxs(Button, { rounded: "md", type: "button", onClick: onGoogle, disabled: disabled, variant: "outline", paddingX: "md", paddingY: "sm", textSize: "sm", weight: "medium", className: "inline- justify-[center] border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface)] text-[var(--appkit-color-text)] dark:text-[var(--appkit-color-text)] hover:bg-surface-hover disabled:cursor-not-allowed disabled:opacity-50", children: [_jsxs("svg", { className: "mr-2 h-5 w-5", viewBox: "0 0 24 24", "aria-hidden": "true", children: [_jsx("path", { fill: "currentColor", d: "M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z" }), _jsx("path", { fill: "currentColor", d: "M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" }), _jsx("path", { fill: "currentColor", d: "M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" }), _jsx("path", { fill: "currentColor", d: "M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" })] }), googleLabel] }) })] }));
 }

package/dist/features/auth/hooks/useAuth.d.ts

@@ -74,10 +74,32 @@ export declare function useVerifyEmail(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, VerifyEmailData, unknown>;
+/**
+ * Re-send the verification email — Firebase-native, like the send that
+ * happens at registration.
+ *
+ * ## What this used to do, and why it could not work
+ *
+ * It POSTed `/api/auth/resend-verification`, a route **deleted** in the
+ * Firebase-native auth migration. Root Cause #54 is the reason it can never
+ * come back: the Admin SDK cannot send email at all — it only *generates*
+ * action links — so the only way to deliver a verification mail without
+ * routing it through Resend is the CLIENT SDK's own
+ * `sendEmailVerification()`, which uses Firebase's hosted template.
+ *
+ * So every call 404'd, and `useRegister` above says in as many words that
+ * "the user can re-request verification later" — a documented recovery path
+ * that did not exist. Found by `audit-client-verb-match`'s NO_ROUTE rule.
+ *
+ * `ResendVerificationData.email` is accepted and unused: the client SDK
+ * re-sends for the CURRENTLY signed-in user and takes no address, so honouring
+ * an arbitrary email here would be a lie about what happens. Kept in the
+ * signature so the two existing call shapes stay source-compatible.
+ */
 export declare function useResendVerification(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
-}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, ResendVerificationData, unknown>;
+}): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, void | ResendVerificationData, unknown>;
 export declare function useForgotPassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -337,9 +337,35 @@ export function useVerifyEmail(options) {
         onError: options?.onError,
     });
 }
+/**
+ * Re-send the verification email — Firebase-native, like the send that
+ * happens at registration.
+ *
+ * ## What this used to do, and why it could not work
+ *
+ * It POSTed `/api/auth/resend-verification`, a route **deleted** in the
+ * Firebase-native auth migration. Root Cause #54 is the reason it can never
+ * come back: the Admin SDK cannot send email at all — it only *generates*
+ * action links — so the only way to deliver a verification mail without
+ * routing it through Resend is the CLIENT SDK's own
+ * `sendEmailVerification()`, which uses Firebase's hosted template.
+ *
+ * So every call 404'd, and `useRegister` above says in as many words that
+ * "the user can re-request verification later" — a documented recovery path
+ * that did not exist. Found by `audit-client-verb-match`'s NO_ROUTE rule.
+ *
+ * `ResendVerificationData.email` is accepted and unused: the client SDK
+ * re-sends for the CURRENTLY signed-in user and takes no address, so honouring
+ * an arbitrary email here would be a lie about what happens. Kept in the
+ * signature so the two existing call shapes stay source-compatible.
+ */
 export function useResendVerification(options) {
     return useMutation({
-        mutationFn: (data) => apiClient.post(AUTH_ENDPOINTS.RESEND_VERIFICATION, data),
+        mutationFn: async () => {
+            const authProvider = getClientAuthProvider();
+            await authProvider.sendEmailVerification();
+            return { success: true };
+        },
         onSuccess: options?.onSuccess,
         onError: options?.onError,
     });

package/dist/features/auth/permissions/constants.d.ts

@@ -11,7 +11,7 @@
  * Permission naming: admin:resource:action
  * Ban action naming: plain verb phrase — write_reviews, place_bids, etc.
  */
-export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:offers:read" | "admin:offers:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:shipments:read" | "admin:shipments:write" | "admin:catalogue:read" | "admin:catalogue:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
+export type Permission = "admin:dashboard:view" | "admin:users:read" | "admin:users:write" | "admin:users:delete" | "admin:user-bans:read" | "admin:user-bans:write" | "admin:products:read" | "admin:products:write" | "admin:products:delete" | "admin:orders:read" | "admin:orders:write" | "admin:returns:read" | "admin:returns:write" | "admin:stores:read" | "admin:stores:write" | "admin:store-addresses:read" | "admin:addresses:read" | "admin:addresses:write" | "admin:analytics:view" | "admin:payouts:read" | "admin:payouts:write" | "admin:audit-log:read" | "admin:categories:read" | "admin:categories:write" | "admin:categories:delete" | "admin:brands:read" | "admin:brands:write" | "admin:brands:delete" | "admin:coupons:read" | "admin:coupons:write" | "admin:coupons:delete" | "admin:deals:read" | "admin:deals:write" | "admin:featured:read" | "admin:featured:write" | "admin:reviews:read" | "admin:reviews:write" | "admin:reviews:delete" | "admin:blog:read" | "admin:blog:write" | "admin:blog:delete" | "admin:blog:publish" | "admin:bids:read" | "admin:bids:write" | "admin:offers:read" | "admin:offers:write" | "admin:media:read" | "admin:media:write" | "admin:media:delete" | "admin:site:read" | "admin:site:write" | "admin:settings:write" | "admin:navigation:read" | "admin:navigation:write" | "admin:sections:read" | "admin:sections:write" | "admin:carousel:read" | "admin:carousel:write" | "admin:carousel:delete" | "admin:ads:read" | "admin:ads:write" | "admin:ads:delete" | "admin:faqs:read" | "admin:faqs:write" | "admin:faqs:delete" | "admin:tester-checklist:read" | "admin:tester-checklist:write" | "admin:tester-checklist:delete" | "admin:tester-feedback:read" | "admin:tester-feedback:write" | "admin:newsletter:read" | "admin:newsletter:write" | "admin:contact:read" | "admin:events:read" | "admin:events:write" | "admin:events:delete" | "admin:event-entries:read" | "admin:event-entries:write" | "admin:support-tickets:read" | "admin:support-tickets:write" | "admin:shipments:read" | "admin:shipments:write" | "admin:catalogue:read" | "admin:catalogue:write" | "admin:grouped-listings:read" | "admin:grouped-listings:write" | "admin:support-tickets:assign" | "admin:support-tickets:close" | "admin:scammers:read" | "admin:scammers:write" | "admin:scammers:verify" | "admin:scammers:delete" | "admin:sessions:read" | "admin:sessions:delete" | "admin:notifications:read" | "admin:notifications:write" | "admin:carts:read" | "admin:wishlists:read" | "admin:feature-flags:read" | "admin:feature-flags:write" | "admin:copilot:view" | "admin:team:read" | "admin:team:write" | "admin:maintenance:view-server-errors" | "admin:maintenance:view-client-errors" | "admin:maintenance:view-function-errors" | "admin:maintenance:view-cloud-logs" | "admin:maintenance:view-payment-rollbacks" | "admin:maintenance:run-analysis" | "admin:maintenance:purge-errors";
 /**
  * Granular user actions that can be soft-banned individually.
  * A user may have multiple simultaneous soft bans of different types.

package/dist/features/auth/permissions/constants.js

@@ -126,6 +126,8 @@ export const PERMISSION_GROUPS = {
     ],
     catalog_manager: [
         "admin:dashboard:view",
+        "admin:grouped-listings:read",
+        "admin:grouped-listings:write",
         "admin:categories:read",
         "admin:categories:write",
         "admin:categories:delete",
@@ -277,6 +279,7 @@ export const ROUTE_PERMISSION_MAP = {
     "/admin/audit-log": "admin:audit-log:read",
     "/admin/shipments": "admin:shipments:read",
     "/admin/catalogue-approvals": "admin:catalogue:read",
+    "/admin/grouped-listings": "admin:grouped-listings:read",
     "/admin/categories": "admin:categories:read",
     "/admin/brands": "admin:brands:read",
     "/admin/coupons": "admin:coupons:read",

package/dist/features/auth/repository/session.repository.d.ts

@@ -1,9 +1,24 @@
-import type { DocumentReference } from "firebase-admin/firestore";
+import type { DocumentReference, DocumentSnapshot } from "firebase-admin/firestore";
 import { BaseRepository, type FirebaseSieveFields, type FirebaseSieveResult, type SieveModel } from "../../../providers/db-firebase";
 import { type SessionCreateInput, type SessionDocument, type SessionUpdateInput } from "../schemas";
 export declare class SessionRepository extends BaseRepository<SessionDocument> {
     static readonly SIEVE_FIELDS: FirebaseSieveFields;
+    /**
+     * Session PII, encrypted by BaseRepository's write hooks.
+     *
+     * This repository had no encryption at all — `createSession` calls
+     * `createWithId`, and before the hooks existed that method applied nothing —
+     * so device IPs, user agents and city were stored in cleartext.
+     *
+     * `deviceInfo.browser` / `deviceInfo.os` are deliberately NOT here: they are
+     * low-entropy strings the admin sessions view filters on (see SIEVE_FIELDS
+     * above), and encrypting them would break those queries while revealing
+     * nothing an IP does not.
+     */
+    protected piiFields: readonly ["deviceInfo.ip", "deviceInfo.userAgent", "location.city"];
     constructor();
+    /** Decrypt on read so callers see the same shape they wrote. */
+    protected mapDoc<D = SessionDocument>(snap: DocumentSnapshot): D;
     list(model: SieveModel): Promise<FirebaseSieveResult<SessionDocument>>;
     listForUser(userId: string, model: SieveModel): Promise<FirebaseSieveResult<SessionDocument>>;
     createSession(userId: string, data: Omit<SessionCreateInput, "userId" | "expiresAt" | "isActive">): Promise<SessionDocument>;

package/dist/features/auth/repository/session.repository.js

@@ -3,10 +3,33 @@ import { DatabaseError } from "../../../errors";
 import { serverLogger } from "../../../monitoring";
 import { BaseRepository, parseSieveDateValue, } from "../../../providers/db-firebase";
 import { generateSessionId } from "../token-helpers";
+import { decryptPiiFields } from "../../../security/pii-encrypt";
 import { SESSION_COLLECTION, SESSION_EXPIRATION_MS, SESSION_FIELDS, } from "../schemas";
 export class SessionRepository extends BaseRepository {
     constructor() {
         super(SESSION_COLLECTION);
+        /**
+         * Session PII, encrypted by BaseRepository's write hooks.
+         *
+         * This repository had no encryption at all — `createSession` calls
+         * `createWithId`, and before the hooks existed that method applied nothing —
+         * so device IPs, user agents and city were stored in cleartext.
+         *
+         * `deviceInfo.browser` / `deviceInfo.os` are deliberately NOT here: they are
+         * low-entropy strings the admin sessions view filters on (see SIEVE_FIELDS
+         * above), and encrypting them would break those queries while revealing
+         * nothing an IP does not.
+         */
+        this.piiFields = [
+            "deviceInfo.ip",
+            "deviceInfo.userAgent",
+            "location.city",
+        ];
+    }
+    /** Decrypt on read so callers see the same shape they wrote. */
+    mapDoc(snap) {
+        const raw = super.mapDoc(snap);
+        return decryptPiiFields(raw, [...this.piiFields]);
     }
     async list(model) {
         return this.sieveQuery(model, SessionRepository.SIEVE_FIELDS);

package/dist/features/auth/repository/user.repository.js

@@ -1,7 +1,7 @@
 import { normalizeError } from "../../../errors/normalize";
 import { DatabaseError } from "../../../errors";
 import { BaseRepository, getFirestoreCount, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase";
-import { USER_PII_FIELDS, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptPiiFields, encryptShippingConfig, piiBlindIndex, } from "../../../security";
+import { USER_PII_FIELDS, USER_PII_INDEX_MAP, piiIndicesFor, decryptPayoutDetails, decryptPiiFields, decryptShippingConfig, encryptPayoutDetails, encryptPiiFields, encryptShippingConfig, piiBlindIndex, } from "../../../security";
 import { USER_COLLECTION, USER_FIELDS, createUserId, } from "../schemas";
 export class UserRepository extends BaseRepository {
     constructor() {
@@ -23,7 +23,18 @@ export class UserRepository extends BaseRepository {
         // addPiiIndices is intentionally NOT called here — it spreads the original
         // plaintext `data` back into the result, which would overwrite the encrypted
         // ciphertext with the original plaintext values, defeating the encryption.
-        const encrypted = encryptPiiFields(data, [...USER_PII_FIELDS]);
+        //
+        // The mapped indices below are not optional. `encryptPiiFields` derives its
+        // sibling name mechanically as `${field}Index`, so `phoneNumber` produces
+        // `phoneNumberIndex` — but `findByPhone` queries `USER_FIELDS.PHONE_INDEX`,
+        // which is `phoneIndex`. Only the seed paths ever wrote that name, so
+        // **phone lookup could never match a user created by the app.**
+        // `piiIndicesFor` applies USER_PII_INDEX_MAP's real names and, unlike
+        // `addPiiIndices`, carries no plaintext back over the ciphertext.
+        const encrypted = {
+            ...encryptPiiFields(data, [...USER_PII_FIELDS]),
+            ...piiIndicesFor(data, USER_PII_INDEX_MAP),
+        };
         const access = encrypted;
         if (access.payoutDetails) {
             access.payoutDetails = encryptPayoutDetails(access.payoutDetails);

package/dist/features/blog/components/BlogListView.js

@@ -25,7 +25,7 @@ export function BlogCard({ post, href, onClick, className = "" }) {
         : "";
     const isInteractive = !!(href || onClick);
     const card = (_jsxs(Article, { role: onClick && !href ? "button" : undefined, tabIndex: onClick && !href ? 0 : undefined, onKeyDown: onClick && !href
-            ? (e) => (e.key === "Enter" || e.key === " ") && onClick(post)
+            ? (e) => (e.key === "Enter" || e.key === "") && onClick(post)
             : undefined, onClick: onClick && !href ? () => onClick(post) : undefined, className: `group flex flex-col h-full overflow-hidden rounded-xl border border-[var(--appkit-color-border)] bg-[var(--appkit-color-surface)] shadow-sm transition hover:shadow-md ${isInteractive ? "cursor-pointer" : ""} ${className}`, children: [_jsx(Div, { className: `relative aspect-video w-full ${__O.hidden} bg-[var(--appkit-color-surface)] dark:bg-[var(--appkit-color-surface-elevated)] flex-shrink-0`, children: coverImageUrl ? (_jsx(MediaImage, { src: coverImageUrl, alt: post.title, size: "card", className: "transition-transform duration-300 group-hover:scale-105" })) : (_jsx(Row, { surface: "muted", className: "h-full w-full", align: "center", justify: "center", children: _jsx(Span, { className: "opacity-30", size: "4xl", "aria-hidden": "true", children: "\u270D\uFE0F" }) })) }), _jsxs(Stack, { className: `flex-1 ${__P.p5}`, children: [_jsxs(Row, { className: "mb-2", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: "bg-primary/10 text-primary", rounded: "full", padding: "pill-xs", transform: "capitalize", children: post.category }), post.isFeatured && (_jsx(Span, { size: "xs", weight: "medium", className: CLS_FEATURED_BADGE, children: "Featured" })), post.readTimeMinutes && (_jsxs(Span, { size: "xs", color: "muted", children: [post.readTimeMinutes, " min read"] }))] }), _jsx(Heading, { level: 3, className: `group-hover:text-primary`, color: "primary", truncate: 2, size: "base", weight: "semibold", children: post.title }), post.excerpt && (_jsx(Text, { className: `mt-2 flex-1`, color: "muted", truncate: 3, size: "sm", children: post.excerpt })), _jsxs(Row, { className: "mt-auto", padding: "t-sm", gap: "3", children: [post.authorAvatar ? (_jsx(Div, { className: "relative h-7 w-7 flex-shrink-0", rounded: "full", overflow: "hidden", children: _jsx(MediaImage, { src: post.authorAvatar, alt: post.authorName ?? "author", size: "avatar" }) })) : post.authorName ? (_jsx(Row, { textWeight: "bold", textSize: "xs", className: "h-7 w-7 flex-shrink-0 bg-primary/10 text-primary", align: "center", justify: "center", rounded: "full", children: post.authorName.charAt(0).toUpperCase() })) : null, _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)] min-w-0", size: "xs", children: [post.authorName && (_jsx(Span, { weight: "medium", className: "text-neutral-700", children: safeDisplayName(post.authorName, "Author") })), date && _jsxs(Span, { className: "ml-1 text-neutral-400", children: ["\u00B7 ", date] })] })] })] })] }));
     if (href) {
         return (_jsx(Link, { href: href, className: "block h-full", children: card }));
@@ -33,7 +33,7 @@ export function BlogCard({ post, href, onClick, className = "" }) {
     return card;
 }
 export function BlogCategoryTabs({ categories, active, onSelect, labels = {}, }) {
-    return (_jsxs(Div, { layout: "flex", gap: "2", className: `scrollbar-none ${__O.xAuto}`, padding: "b-2xs", children: [_jsx(Button, { onClick: () => onSelect(null), variant: !active ? "primary" : "ghost", size: "sm", className: `whitespace-nowrap rounded-full px-[var(--appkit-space-4)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-sm)] font-medium transition ${!active ? "bg-neutral-900 text-white" : "bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)] text-[var(--appkit-color-text-muted)] text-[var(--appkit-color-text-muted)] hover:bg-neutral-200 dark:hover:bg-slate-700"}`, children: labels.all ?? "All" }), categories.map((cat) => (_jsx(Button, { onClick: () => onSelect(cat), variant: active === cat ? "primary" : "ghost", size: "sm", className: `whitespace-nowrap rounded-full px-[var(--appkit-space-4)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-sm)] font-medium capitalize transition ${active === cat ? "bg-neutral-900 text-white" : "bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)] text-[var(--appkit-color-text-muted)] text-[var(--appkit-color-text-muted)] hover:bg-neutral-200 dark:hover:bg-slate-700"}`, children: labels[cat] ?? cat }, cat)))] }));
+    return (_jsxs(Div, { layout: "flex", gap: "2", className: `scrollbar-none ${__O.xAuto}`, padding: "b-2xs", children: [_jsx(Button, { onClick: () => onSelect(null), variant: !active ? "primary" : "ghost", size: "sm", className: `whitespace-nowrap rounded-full px-[var(--appkit-space-4)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-sm)] font-medium transition ${!active ? "bg-neutral-900 text-white" : "bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)] text-[var(--appkit-color-text-muted)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover"}`, children: labels.all ?? "All" }), categories.map((cat) => (_jsx(Button, { onClick: () => onSelect(cat), variant: active === cat ? "primary" : "ghost", size: "sm", className: `whitespace-nowrap rounded-full px-[var(--appkit-space-4)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-sm)] font-medium capitalize transition ${active === cat ? "bg-neutral-900 text-white" : "bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)] text-[var(--appkit-color-text-muted)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover"}`, children: labels[cat] ?? cat }, cat)))] }));
 }
 export function BlogListView({ posts, isLoading, totalPages = 1, currentPage = 1, total = 0, onPageChange, onPostClick, emptyLabel = "No posts found", slots, }) {
     if (isLoading) {

package/dist/features/cart/components/CartPriceBreakdown.d.ts

@@ -55,7 +55,17 @@ export interface CartPriceBreakdownProps {
     unavailableNote?: React.ReactNode;
     /** Subtotal to show when `preview` is null (guest carts). */
     fallbackSubtotal?: number;
+    /**
+     * Shown when the preview request FAILED, as opposed to never having run.
+     *
+     * Separate from `unavailableNote` because the two say different things and
+     * the failure case can coexist with a rendered breakdown: on a refetch error
+     * the last good `preview` is deliberately kept, so the buyer sees real
+     * figures plus a note that they may be out of date — strictly better than
+     * blanking to ₹0, which is what a swallowed error used to produce.
+     */
+    errorNote?: React.ReactNode;
     isLoading?: boolean;
     className?: string;
 }
-export declare function CartPriceBreakdown({ preview, itemCount, currency, unavailableNote, fallbackSubtotal, isLoading, className, }: CartPriceBreakdownProps): React.JSX.Element;
+export declare function CartPriceBreakdown({ preview, itemCount, currency, unavailableNote, fallbackSubtotal, errorNote, isLoading, className, }: CartPriceBreakdownProps): React.JSX.Element;

package/dist/features/cart/components/CartPriceBreakdown.js

@@ -9,10 +9,10 @@ function Line({ label, amount, tone = "muted", strong = false, }) {
 function withStoreCount(label, count) {
     return count > 1 ? `${label} (${count} stores)` : label;
 }
-export function CartPriceBreakdown({ preview, itemCount, currency = "INR", unavailableNote, fallbackSubtotal = 0, isLoading = false, className = "", }) {
+export function CartPriceBreakdown({ preview, itemCount, currency = "INR", unavailableNote, fallbackSubtotal = 0, errorNote, isLoading = false, className = "", }) {
     const money = (value) => formatCurrency(value, currency);
     if (!preview) {
-        return (_jsxs(Stack, { gap: "xs", className: className, children: [_jsx(Line, { label: itemCount !== undefined ? `Subtotal (${itemCount} item${itemCount !== 1 ? "s" : ""})` : "Subtotal", amount: money(fallbackSubtotal) }), unavailableNote && (_jsx(Text, { size: "xs", color: "muted", children: unavailableNote }))] }));
+        return (_jsxs(Stack, { gap: "xs", className: className, children: [_jsx(Line, { label: itemCount !== undefined ? `Subtotal (${itemCount} item${itemCount !== 1 ? "s" : ""})` : "Subtotal", amount: money(fallbackSubtotal) }), (errorNote ?? unavailableNote) && (_jsx(Text, { size: "xs", color: errorNote ? "error" : "muted", children: errorNote ?? unavailableNote }))] }));
     }
     const storeCount = preview.stores.length;
     // Count how many stores are actually charged each per-store add-on, so the
@@ -21,5 +21,5 @@ export function CartPriceBreakdown({ preview, itemCount, currency = "INR", unava
     const subtotalLabel = itemCount !== undefined
         ? `Subtotal (${itemCount} item${itemCount !== 1 ? "s" : ""}${storeCount > 1 ? `, ${storeCount} stores` : ""})`
         : "Subtotal";
-    return (_jsxs(Stack, { gap: "xs", className: className, children: [_jsx(Line, { label: subtotalLabel, amount: money(preview.subtotal) }), preview.shippingFee > 0 && (_jsx(Line, { label: withStoreCount("Shipping", storeCount), amount: money(preview.shippingFee) })), preview.codHandlingFee > 0 && (_jsx(Line, { label: "COD handling fee", amount: money(preview.codHandlingFee) })), preview.whatsappNotifyFee > 0 && (_jsx(Line, { label: withStoreCount("WhatsApp updates", countCharged((s) => s.whatsappNotifyFee)), amount: money(preview.whatsappNotifyFee) })), preview.giftWrapFee > 0 && (_jsx(Line, { label: withStoreCount("Gift wrap", countCharged((s) => s.giftWrapFee)), amount: money(preview.giftWrapFee) })), preview.shipmentProtectionFee > 0 && (_jsx(Line, { label: withStoreCount("Shipment protection", countCharged((s) => s.shipmentProtectionFee)), amount: money(preview.shipmentProtectionFee) })), preview.platformFee > 0 && _jsx(Line, { label: "Platform fee", amount: money(preview.platformFee) }), (preview.gstAmount > 0 || preview.gstOnFee > 0) && (_jsx(Line, { label: "GST", amount: money(preview.gstAmount + preview.gstOnFee) })), preview.couponDiscount > 0 && (_jsx(Line, { label: "Coupon discount", amount: `−${money(preview.couponDiscount)}`, tone: "success" })), _jsx(Div, { border: "top-subtle", paddingY: "t-sm", children: _jsx(Line, { label: "Total", amount: money(preview.total), tone: "primary", strong: true }) }), isLoading && (_jsx(Text, { size: "xs", color: "muted", children: "Updating\u2026" }))] }));
+    return (_jsxs(Stack, { gap: "xs", className: className, children: [_jsx(Line, { label: subtotalLabel, amount: money(preview.subtotal) }), preview.shippingFee > 0 && (_jsx(Line, { label: withStoreCount("Shipping", storeCount), amount: money(preview.shippingFee) })), preview.codHandlingFee > 0 && (_jsx(Line, { label: "COD handling fee", amount: money(preview.codHandlingFee) })), preview.whatsappNotifyFee > 0 && (_jsx(Line, { label: withStoreCount("WhatsApp updates", countCharged((s) => s.whatsappNotifyFee)), amount: money(preview.whatsappNotifyFee) })), preview.giftWrapFee > 0 && (_jsx(Line, { label: withStoreCount("Gift wrap", countCharged((s) => s.giftWrapFee)), amount: money(preview.giftWrapFee) })), preview.shipmentProtectionFee > 0 && (_jsx(Line, { label: withStoreCount("Shipment protection", countCharged((s) => s.shipmentProtectionFee)), amount: money(preview.shipmentProtectionFee) })), preview.platformFee > 0 && _jsx(Line, { label: "Platform fee", amount: money(preview.platformFee) }), (preview.gstAmount > 0 || preview.gstOnFee > 0) && (_jsx(Line, { label: "GST", amount: money(preview.gstAmount + preview.gstOnFee) })), preview.couponDiscount > 0 && (_jsx(Line, { label: "Coupon discount", amount: `−${money(preview.couponDiscount)}`, tone: "success" })), _jsx(Div, { border: "top-subtle", paddingY: "t-sm", children: _jsx(Line, { label: "Total", amount: money(preview.total), tone: "primary", strong: true }) }), errorNote ? (_jsx(Text, { size: "xs", color: "error", children: errorNote })) : (isLoading && (_jsx(Text, { size: "xs", color: "muted", children: "Updating\u2026" })))] }));
 }

package/dist/features/cart/components/StoreAddonsPicker.d.ts

@@ -24,6 +24,15 @@ export interface StoreAddonsRates {
     shipmentProtectionFeePercent?: number;
     shipmentProtectionFeeMin?: number;
 }
+/**
+ * True when the site offers at least one paid add-on.
+ *
+ * Exported because the picker renders NOTHING when the answer is false, and a
+ * parent that doesn't know that ends up drawing a bare "Add-ons" heading over
+ * empty space. Callers use this to decide between mounting the picker and
+ * showing an explanatory line instead.
+ */
+export declare function hasAnyStoreAddon(rates: StoreAddonsRates | null | undefined): boolean;
 export interface StoreAddonsPickerProps {
     storeId: string;
     /** This store's subtotal — shipment protection is a percentage of it. */

package/dist/features/cart/components/StoreAddonsPicker.js

@@ -6,12 +6,22 @@ import { IconBox } from "../../../ui/components/IconBox";
 import { FieldCheckbox } from "../../../ui/forms/FieldCheckbox";
 import { FieldTextarea } from "../../../ui/forms/FieldTextarea";
 import { formatCurrency } from "../../../utils/number.formatter";
-export function StoreAddonsPicker({ storeId, storeSubtotal, value, onChange, rates, disabled = false, disabledReason, showGiftMessage = false, currency = "INR", className = "", }) {
-    const anyEnabled = !!rates &&
-        (rates.whatsappNotifyFeeEnabled ||
+/**
+ * True when the site offers at least one paid add-on.
+ *
+ * Exported because the picker renders NOTHING when the answer is false, and a
+ * parent that doesn't know that ends up drawing a bare "Add-ons" heading over
+ * empty space. Callers use this to decide between mounting the picker and
+ * showing an explanatory line instead.
+ */
+export function hasAnyStoreAddon(rates) {
+    return (!!rates &&
+        !!(rates.whatsappNotifyFeeEnabled ||
             rates.giftWrapFeeEnabled ||
-            rates.shipmentProtectionFeeEnabled);
-    if (!anyEnabled)
+            rates.shipmentProtectionFeeEnabled));
+}
+export function StoreAddonsPicker({ storeId, storeSubtotal, value, onChange, rates, disabled = false, disabledReason, showGiftMessage = false, currency = "INR", className = "", }) {
+    if (!hasAnyStoreAddon(rates) || !rates)
         return null;
     const money = (value) => formatCurrency(value, currency);
     const set = (patch) => onChange(storeId, { ...value, ...patch });

package/dist/features/cart/components/index.d.ts

@@ -5,7 +5,7 @@ export { CartView } from "./CartView";
 export type { CartViewProps, CartOrderGroup } from "./CartView";
 export { CartSummary } from "./CartSummary";
 export type { CartSummaryProps } from "./CartSummary";
-export { StoreAddonsPicker } from "./StoreAddonsPicker";
+export { StoreAddonsPicker, hasAnyStoreAddon } from "./StoreAddonsPicker";
 export type { StoreAddonsPickerProps, StoreAddonsValue, StoreAddonsRates, } from "./StoreAddonsPicker";
 export { CartPriceBreakdown } from "./CartPriceBreakdown";
 export type { CartPriceBreakdownProps, CartPriceBreakdownData, CartPriceBreakdownStore, } from "./CartPriceBreakdown";

package/dist/features/cart/components/index.js

@@ -2,7 +2,7 @@ export { CartItemRow, CartDrawer } from "./CartDrawer";
 export { CartGroupLineRow } from "./CartGroupLineRow";
 export { CartView } from "./CartView";
 export { CartSummary } from "./CartSummary";
-export { StoreAddonsPicker } from "./StoreAddonsPicker";
+export { StoreAddonsPicker, hasAnyStoreAddon } from "./StoreAddonsPicker";
 export { CartPriceBreakdown } from "./CartPriceBreakdown";
 export { CheckoutView } from "./CheckoutView";
 export { CheckoutAddressStep } from "./CheckoutAddressStep";

package/dist/features/cart/hooks/useGuestCartMerge.d.ts

@@ -1,11 +1,18 @@
 import { type GuestCartItem } from "../utils/guest-cart";
+import { type NormalizedError } from "../../../errors/normalize";
 export interface UseGuestCartMergeOptions {
     userId: string | null | undefined;
     mergeEndpoint?: string;
     onNavigate?: (url: string) => void;
     mergeFn?: (items: GuestCartItem[]) => Promise<void>;
     onMerged?: (count: number) => void;
-    onMergeFailed?: (error: unknown) => void;
+    /**
+     * Receives a typed NormalizedError, not the raw `unknown` — the hook is the
+     * boundary that knows how to classify the failure, so every consumer would
+     * otherwise repeat the same narrowing. Zero external consumers at the time of
+     * narrowing, so this broke nothing.
+     */
+    onMergeFailed?: (error: NormalizedError) => void;
 }
 /**
  * useGuestCartMerge

package/dist/features/cart/hooks/useGuestCartMerge.js

@@ -3,6 +3,7 @@ import { useEffect, useRef } from "react";
 import { apiClient } from "../../../http";
 import { clearGuestCart, clearGuestReturnTo, getGuestCartItems, getGuestReturnTo, } from "../utils/guest-cart";
 import { CART_ENDPOINTS } from "../../../constants/api-endpoints";
+import { normalizeError } from "../../../errors/normalize";
 /**
  * useGuestCartMerge
  *
@@ -42,7 +43,7 @@ export function useGuestCartMerge(options) {
             }
         })
             .catch((err) => {
-            options.onMergeFailed?.(err);
+            options.onMergeFailed?.(normalizeError(err));
             if (returnTo)
                 clearGuestReturnTo();
         });