@mohasinac/appkit 4.30.19 → 4.31.0

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -396,6 +396,18 @@ const rawTesterChecklistItems = [
             href: "/products",
             cases: [
                 { key: "standard-detail", label: "Standard product detail page loads correctly", href: "/products/product-tester-standard-1" },
+                {
+                    key: "seed-images-are-labelled-tiles",
+                    label: "Every seeded product image is a readable tile showing the item's own name — NOT a broken-image icon and NOT an empty grey box",
+                    description: "Fixed 2026-08-31. BEFORE: 409 of the ~437 seeded image URLs pointed at picsum.photos, which went down (503 from its origin AND its CDN), so nearly every image on the site returned 502 and rendered as the browser's broken-image icon. AFTER: images come from `seedPhoto()`, which names its host in ONE place and renders the item's name on the tile. Open a product grid and confirm the tiles show text like \"Dranzer Phoenix\" rather than broken icons. A grid of identical blank tiles is also a fail — each should differ.",
+                    href: "/products",
+                },
+                {
+                    key: "unreachable-image-degrades-to-placeholder",
+                    label: "An image whose upstream host is unreachable shows a neutral \"Image unavailable\" tile, not a broken-image icon",
+                    description: "This is the safety net under the case above, and it is checked with a URL that CANNOT work — a real one proves nothing. Open /api/media/ext?url=https%3A%2F%2Fexample.invalid%2Fx.png directly in a browser tab. BEFORE it returned 502 with the text \"Failed to fetch external image.\", which an <img> renders as a broken icon. AFTER it must return an SVG tile reading \"Image unavailable\". In devtools the response must carry the header X-Media-Placeholder: 1 and a SHORT Cache-Control (max-age=60) — if that header is missing, the tile is being cached as though it were a real image and the outage would outlive its cause.",
+                    href: "/products",
+                },
                 {
                     key: "auction-detail",
                     label: "Auction detail page shows current bid + a live, ticking countdown correctly",
@@ -461,7 +473,24 @@ const rawTesterChecklistItems = [
                     description: "Added 2026-08-21 — this carousel previously had no test case of its own outside the category/brand check. It is DIFFERENT from the \"Part of / Parts in this group\" set panel: this one is a horizontal themed scroller (titled by the group's theme, e.g. \"Same character\" / \"From the same set\"), it sits lower down near the related-items carousels, and it only shows for products that belong to an active, visible group. Confirm the cards show real titles and images (not placeholders) and that clicking one lands on that item's own detail page.",
                     href: "/products/product-tester-standard-1",
                 },
-                { key: "classified-contact-flow", label: "A classified listing shows a contact-seller flow with deliberately no checkout/buy button", href: "/classified/classified-tester-sandbox-1" },
+                {
+                    key: "classified-offer-is-the-purchase-path",
+                    label: "EVERY classified listing offers a way to transact — either \"Make Offer\" or \"Request to Buy\" — and none offers Add to Cart or Buy Now",
+                    description: "Changed 2026-08-31. BEFORE: the button was \"Contact Seller\" and opened a chat thread; the offer form appeared only on listings where the seller had ticked `allowOffers`, so on the other half the page showed a price and a chat box. AFTER: chat is gone and the offer IS the purchase path, so the panel is never empty. Check BOTH kinds — `classified-beyblade-stadium-set` (negotiable, allowOffers on) must read \"Make Offer\"; `classified-beyblade-burst-collection-bengaluru` (not negotiable) must read \"Request to Buy\". A classified with NO button at all is the regression this case exists to catch.",
+                    href: "/classified/classified-beyblade-stadium-set",
+                },
+                {
+                    key: "classified-buy-request-pinned-to-price",
+                    label: "On a NON-negotiable classified, the Request-to-Buy amount is fixed at the asking price and cannot be edited down",
+                    description: "The amount field is read-only and pre-filled at the listed price. Try to submit a lower number (via the browser's dev tools if the field won't take it) — the server must reject it with \"This seller is not taking lower offers\". BEFORE 2026-08-31 this listing accepted no offer at all: `allowOffers` was unset, so the form never rendered.",
+                    href: "/classified/classified-beyblade-burst-collection-bengaluru",
+                },
+                {
+                    key: "classified-full-price-offer-accepted",
+                    label: "On a NEGOTIABLE classified, an offer at exactly the asking price is ACCEPTED, not rejected",
+                    description: "BEFORE: the shared rule rejected any offer >= the listed price with \"use Add to Cart instead\" — advice that named a button a classified does not have, so a buyer willing to pay full price had no route at all. AFTER: the ceiling is inclusive on a listing with no cart. Enter exactly the listed price and submit; it must succeed. On an ORDINARY product (/products/...) the same amount must still be rejected — that is the half of the rule which did not change.",
+                    href: "/classified/classified-beyblade-stadium-set",
+                },
                 { key: "digitalcode-delivery", label: "Purchasing a digital-code listing delivers the code to the buyer post-purchase", href: "/digital-codes/digitalcode-tester-sandbox-1" },
                 { key: "live-item-detail", label: "A live-item listing's detail page shows the livestream link correctly", href: "/live/live-tester-sandbox-1" },
                 {
@@ -1773,28 +1802,6 @@ const rawTesterChecklistItems = [
                 },
             ],
         },
-        {
-            pageKey: "messaging",
-            pageLabel: "Messaging a Seller",
-            href: "/user/messages",
-            cases: [
-                { key: "start-conversation", label: "Starting a conversation with a seller works" },
-                { key: "receive-reply", label: "Receiving and reading a seller's reply works" },
-                {
-                    key: "message-realtime-update",
-                    label: "A new message appears in the RECIPIENT's thread without a manual page refresh (realtime ping-channel)",
-                    description: "Fixed 2026-08-28. BEFORE: only the SENDER saw their own message, because the send handler calls refetch() directly — the recipient saw nothing until they reloaded. Two stacked faults: the hooks subscribed without ever signing in to the realtime database, AND the `conversationIds` claim the security rule requires had no issuer anywhere (the token route only sent `chatIds`, from an unrelated collection). Both errors were swallowed, one into a literal `// ignore`. AFTER: open the same conversation as buyer in one browser and seller in another, send from one, and the other updates on its own. Test it from BOTH directions — testing only the sender's own window is what let this pass before.",
-                    href: "/user/messages",
-                },
-                {
-                    key: "message-live-updates-survive-bulk-job",
-                    label: "Running a bulk admin action while a message thread is open does not kill that thread's live updates",
-                    description: "Fixed 2026-08-28. BEFORE: the realtime app is a single shared connection, and finishing a bulk job signed it out globally — so an open chat or message thread silently stopped updating, and vice versa (opening a chat killed an in-flight bulk job's progress). AFTER: open a message thread, run any bulk action from an admin listing until it completes, then send a message from the other account — the thread must still update live without a reload.",
-                    href: "/user/messages",
-                },
-                { key: "messages-list-thread", label: "The messages list and individual thread view both load correctly", href: "/user/messages" },
-            ],
-        },
         {
             pageKey: "user-dashboard-extras",
             pageLabel: "User Dashboard — Addresses, Catalogue, Settings, My Orders-by-Type",
@@ -2198,11 +2205,10 @@ const rawTesterChecklistItems = [
         },
         {
             pageKey: "seller-ops-comms",
-            pageLabel: "Seller Addresses, Messages, Fulfillment & Print",
+            pageLabel: "Seller Addresses, Fulfillment & Print",
             href: "/store/addresses",
             cases: [
                 { key: "seller-addresses-crud", label: "Seller can add and edit store addresses", href: "/store/addresses" },
-                { key: "seller-messages", label: "Seller messages list and thread view both work", href: "/store/messages" },
                 { key: "seller-fulfillment-queue", label: "Seller fulfillment queue shows accurate pending items", href: "/store/fulfillment" },
                 { key: "seller-print-center", label: "Seller print-center generates labels/invoices correctly", href: "/store/print-center" },
                 { key: "seller-inventory-print", label: "Seller inventory print view works", href: "/store/print-center" },
@@ -2658,7 +2664,7 @@ const rawTesterChecklistItems = [
                 {
                     key: "classified-bar-no-cart",
                     label: "A classified listing's sticky bar offers \"Make an Offer\" and does NOT offer Add to Cart or Buy Now — classifieds are arranged directly with the seller",
-                    description: "Tapping it should jump to the contact-seller panel. An Add to Cart button appearing here is a real bug.",
+                    description: "Tapping it should jump to the offer panel, and that panel must contain a real form (see classified-offer-is-the-purchase-path). An Add to Cart button appearing here is a real bug; so is the bar scrolling to an empty box.",
                     href: "/classified/classified-tester-sandbox-1",
                 },
                 {
@@ -2715,11 +2721,29 @@ const rawTesterChecklistItems = [
                     label: "IN LIGHT MODE: the small promotional badges on product cards — NEW, SALE, LIMITED, the bundle discount percentage, an auction's \"Ending soon\" / \"Reserve\" pill — are all readable against their colored background",
                     href: "/products",
                 },
+                {
+                    key: "soft-ban-lift-notification-has-a-body",
+                    label: "Lifting a user's soft ban sends them a notification WITH a readable message, not just a title",
+                    description: "Fixed 2026-08-31. BEFORE: the route wrote `body`, `entityId` and `entityType` behind an `as any` — none of which are fields on NotificationDocument (they are `message`, `relatedId`, `relatedType`) — so the bell showed a title and an EMPTY body, and the notification never reached email or WhatsApp. AFTER: as an admin, lift any soft ban on a test user from /admin/users, then open that user's bell. The row must show both the title AND the sentence naming which restriction was lifted, and it must be clickable.",
+                    href: "/admin/users",
+                },
+                {
+                    key: "review-feedback-notification-delivers",
+                    label: "Sending feedback on a review notifies the buyer with the message body, and the row is clickable",
+                    description: "Fixed 2026-08-31. BEFORE: three defects on one line, all hidden by an `as any` — the body was written under the wrong field name so it rendered empty; `type: \"store_feedback\"` is not a real notification type so no channel could ever be allow-listed for it; and it skipped `actionUrl` resolution so the row went nowhere when clicked. AFTER: as a seller, send feedback on a review from /store/reviews, then check that buyer's bell — message present, row clickable.",
+                    href: "/store/reviews",
+                },
+                {
+                    key: "analytics-tags-absent-until-configured",
+                    label: "With no analytics IDs set, the page source contains NO googletagmanager / connect.facebook.net script tag",
+                    description: "Added 2026-08-31. siteSettings.integrations has held GA / Pixel / GTM IDs for a long time with NOTHING reading them; they now drive real tags. This case checks the OFF state, which is the one that can silently regress into tracking every visitor. With Site Settings → Integrations empty, view-source on the homepage and search for \"googletagmanager\" — a `preconnect` link is expected and fine, a `<script>` is a bug. Then set a GA ID, reload, and confirm the script now appears: a tag that never appears is the opposite failure.",
+                    href: "/admin/site",
+                },
                 {
                     key: "notification-count-bubbles-readable",
-                    label: "The unread-count bubbles (the small number circles on the header bell icon, the Messages nav item, and the cart/bottom action bar) show a readable number in BOTH light and dark mode — not a colored blob with an invisible digit",
-                    description: "You need at least one unread notification or message for the bubble to appear. Check both themes.",
-                    href: "/user/messages",
+                    label: "The unread-count bubbles (the small number circles on the header bell icon and the cart/bottom action bar) show a readable number in BOTH light and dark mode — not a colored blob with an invisible digit",
+                    description: "You need at least one unread notification, or an item in the cart, for the bubble to appear. Check both themes. (This case used to also name the Messages nav item; buyer↔seller messaging was removed 2026-08-31.)",
+                    href: "/user/notifications",
                 },
                 {
                     key: "admin-status-chips-colored",
@@ -4039,6 +4063,228 @@ const rawTesterChecklistItems = [
             ],
         },
     ]),
+    ...group("cta-layout", "CTA & Action Rows", [
+        {
+            pageKey: "checkout-bottom-bar",
+            pageLabel: "Checkout — bottom action bar",
+            href: "/checkout",
+            cases: [
+                {
+                    key: "back-not-squeezed",
+                    label: "Back and Continue to payment are BOTH readable at 320px width",
+                    description: "Narrow the browser to 320px and reach the Extras step. BEFORE: Back rendered as a ~44px box clipped to 'Ba' while Continue to payment took ~80% of the row. AFTER: each button is as wide as its own label needs, Continue to payment is visibly the wider of the two, and neither shows a cut-off word or an ellipsis.",
+                },
+                {
+                    key: "no-truncation-anywhere",
+                    label: "No CTA label is ever cut off — long ones wrap to two lines",
+                    description: "Check the payment step, whose primary reads 'Pay Online (Razorpay)'. BEFORE: a label too long for its share was clipped with an ellipsis. AFTER: the button grows taller and shows the whole label on two lines. An ellipsis anywhere in the bar is a failure.",
+                },
+            ],
+        },
+        {
+            pageKey: "product-bottom-bar",
+            pageLabel: "Product detail — three-action bar",
+            href: "/products/product-beyblade-original-dranzer-s",
+            cases: [
+                {
+                    key: "three-actions-wrap-to-second-row",
+                    label: "Wishlist / Add to Cart / Buy Now use two rows, none squeezed",
+                    description: "On a phone-width viewport. Wishlist and Add to Cart share the upper row, Buy Now gets the full-width row beneath. BEFORE: Wishlist was pinned to its content width and the row read lopsided. AFTER: the two secondaries share the upper row proportionally. Tap Add to Cart and watch the label become 'Adding…' — the number of ROWS must not change while it does.",
+                },
+            ],
+        },
+        {
+            pageKey: "editor-action-bar",
+            pageLabel: "Editor bar — four actions",
+            href: "/store/products/new",
+            cases: [
+                {
+                    key: "four-buttons-wrap-not-overflow",
+                    label: "Discard / Preview / Save draft / Publish wrap instead of overflowing",
+                    description: "Open a product editor at 375px width with unsaved changes so Discard appears. BEFORE: all four buttons were flex-shrink:0 in a non-wrapping row, so the group ran off the right edge of the bar. AFTER: they wrap onto a second line and every one stays fully on screen. Nothing should scroll sideways.",
+                },
+            ],
+        },
+        {
+            pageKey: "dialog-footers",
+            pageLabel: "Dialog & drawer footers",
+            href: "/admin/products",
+            cases: [
+                {
+                    key: "modal-footer-stays-compact-on-desktop",
+                    label: "A dialog's buttons stay compact and right-aligned at 1280px",
+                    description: "Open any admin confirm dialog on a desktop viewport. The buttons must remain content-width and packed to the right — they must NOT stretch across the whole dialog like banners. This is the deliberate difference between a dialog footer and a mobile bar; a stretched pair here is a regression.",
+                },
+                {
+                    key: "filter-drawer-footer-stacks-when-narrow",
+                    label: "Filter drawer's Reset all / Apply stack rather than shrink when narrow",
+                    description: "Open the mobile filter drawer on a narrow phone. Both buttons stay fully readable; if there is not room for both side by side they stack one per line. Neither may be crushed below its label.",
+                },
+            ],
+        },
+    ]),
+    ...group("addresses", "Addresses", [
+        {
+            pageKey: "postal-lookup",
+            pageLabel: "Postal code lookup",
+            href: "/user/addresses/new",
+            cases: [
+                {
+                    key: "pin-fills-city-and-state",
+                    label: "Typing a complete PIN code fills City and State",
+                    description: "BEFORE: there was no lookup anywhere in the app — two dead modules carried the shape of one that had been removed, which is why it looked built. AFTER: leave City and State empty, choose India, and type 560001 into the PIN code box. Within about half a second City and State fill themselves in. Nothing else on the form changes.",
+                },
+                {
+                    key: "lookup-never-overwrites",
+                    label: "The lookup never overwrites a city you typed yourself",
+                    description: "Type your own City FIRST — something deliberately unusual, e.g. 'Whitefield' — then type a PIN code that resolves to a different city. Your text must survive untouched. Autofill only ever lands in an EMPTY field; a lookup that corrects a deliberate entry is a bug the user cannot even report, because they just watch their own typing vanish.",
+                },
+                {
+                    key: "lookup-miss-is-a-non-event",
+                    label: "An unrecognised PIN code leaves the form usable",
+                    description: "Type a valid-format but unknown PIN code, e.g. 999999. Nothing must break: no error banner, no red field, no disabled Save. City and State simply stay empty and editable, and the address still saves. Coverage for India is thinner than India Post's, so a miss is the COMMON case and has to be a non-event.",
+                },
+            ],
+        },
+        {
+            pageKey: "postal-validation",
+            pageLabel: "Postal code validation",
+            href: "/user/addresses/new",
+            cases: [
+                {
+                    key: "letters-rejected-on-the-field",
+                    label: "A non-numeric PIN code is rejected ON THE FIELD, not by the server",
+                    description: "Enter 'abcdef' as the PIN code for an Indian address and press Save. BEFORE: the client rule was min-length-1, so this passed every check you could see and came back a server 400 with nothing marked — and one admin route checked LENGTH ONLY, so 'abcdef' was a valid PIN code as far as it was concerned. AFTER: the error appears under the PIN code field before any request is sent.",
+                },
+                {
+                    key: "country-decides-the-rule",
+                    label: "Switching country switches the postal rule and its label",
+                    description: "Choose Canada. BEFORE: the rule was India-only six-digits, so a real Canadian postcode like K1A 0B1 could not be saved from any surface. AFTER: the field reads 'Postal code' rather than 'PIN code', K1A 0B1 is accepted, and 560001 is now the one rejected. Switch back to India and the reverse holds.",
+                },
+                {
+                    key: "unknown-country-never-blocks",
+                    label: "A country with no known format accepts anything plausible",
+                    description: "Choose United Arab Emirates, which has no postal format. Any 3-12 character code must save. A postal rule exists to catch a typo, never to block a real address we have no pattern for.",
+                },
+            ],
+        },
+        {
+            pageKey: "state-picker",
+            pageLabel: "State picker",
+            href: "/user/addresses/new",
+            cases: [
+                {
+                    key: "state-is-a-picker-for-india",
+                    label: "State is a searchable picker for India, free text for countries without one",
+                    description: "BEFORE: this form and the seller drawer both wrote FREE TEXT into the same field the admin editor filled from a 36-option list, so the column held 'Karnataka', 'karnataka' and 'KA' depending on which screen created the row. AFTER: with India chosen, State is a searchable picker of the 36 states and union territories. Choose United Arab Emirates and it becomes a plain text box, because we do not enumerate its regions.",
+                },
+                {
+                    key: "changing-country-clears-state",
+                    label: "Changing country clears the state you had chosen",
+                    description: "Pick India, then Karnataka, then switch the country to Canada. State must be empty — 'Karnataka' is not a Canadian province, and an address whose state does not belong to its country is a row nothing can group or ship.",
+                },
+            ],
+        },
+        {
+            pageKey: "address-filters",
+            pageLabel: "Address filters",
+            href: "/user/addresses",
+            cases: [
+                {
+                    key: "filters-actually-filter",
+                    label: "Every filter in the drawer changes the list",
+                    description: "BEFORE: all three facets — Address Type, Verified, Active — read fields the address document has never had, so each compared against an empty string. They rendered, they counted toward the filter badge, and not one could ever match a row. AFTER: only Default and Standing are offered, and each visibly changes which addresses are listed.",
+                },
+            ],
+        },
+        {
+            pageKey: "unban-request",
+            pageLabel: "Unban request",
+            href: "/user/addresses",
+            cases: [
+                {
+                    key: "empty-note-says-why",
+                    label: "Submitting an empty unban request explains what is missing",
+                    description: "On a banned address, open Request Unban and press Submit with the box empty. BEFORE: the button was disabled and the handler was a bare return — nothing was said, and that note is the ENTIRE case a reviewer reads. AFTER: the button is enabled and pressing it puts an error on the field naming the 20-character minimum.",
+                },
+            ],
+        },
+    ]),
+    ...group("search-and-nav", "Search & navigation", [
+        {
+            pageKey: "header-search",
+            pageLabel: "Header search",
+            href: "/",
+            cases: [
+                {
+                    key: "search-finds-maintenance-toggle",
+                    label: "Searching 'maintenance' reaches the maintenance TOGGLE, not just Site Settings",
+                    description: "As an admin, open the header search and type 'maintenance'. BEFORE: nothing at all — the search matched nav labels only, and no nav item is called Maintenance. AFTER: a quick link appears, and clicking it opens Site Settings ON the Branding tab with the Maintenance mode toggle scrolled into view. Landing on tab 1 of nineteen and having to hunt is a FAIL.",
+                },
+                {
+                    key: "search-finds-by-what-it-does",
+                    label: "Words that appear nowhere in a label still find their screen",
+                    description: "Type 'refund'. BEFORE: no results — the screen is called Payouts. AFTER: Payouts appears. Repeat with 'postcode' (reaches Addresses) and 'cod' (reaches the Cash on delivery toggle). None of those words is in the label of what they find; that is the point.",
+                },
+                {
+                    key: "search-ranks-exact-first",
+                    label: "An exact match sorts above a mention",
+                    description: "Type 'orders'. The entry actually CALLED Orders must be first — above the guide whose description merely mentions orders. BEFORE there was no ranking at all, so alphabetical order decided and the exact match could land ninth.",
+                },
+                {
+                    key: "search-never-shows-what-you-cannot-reach",
+                    label: "A buyer's search surfaces nothing admin-shaped",
+                    description: "Sign in as an ordinary buyer and search 'users', 'payouts' and 'maintenance'. Not one admin entry may appear. The labels alone are a site map of the admin panel, so an entry you cannot act on is one you must not be shown.",
+                },
+            ],
+        },
+        {
+            pageKey: "sidebar-search",
+            pageLabel: "Sidebar search",
+            href: "/admin",
+            cases: [
+                {
+                    key: "sidebar-search-matches-description",
+                    label: "The sidebar filter matches what a screen is FOR",
+                    description: "In the admin sidebar's search box type 'fraud'. BEFORE: `item.label.includes(q)` — so only a screen with 'fraud' in its name matched. AFTER: Scam Registry, Address Clusters and Payment Clusters all appear, because their descriptions and keywords say so. Groups keep their normal order; only their contents narrow.",
+                },
+            ],
+        },
+        {
+            pageKey: "employee-permissions",
+            pageLabel: "Employee sidebar",
+            href: "/admin/team",
+            cases: [
+                {
+                    key: "employee-sees-only-their-permissions",
+                    label: "An employee's sidebar shows only what their permissions allow",
+                    description: "🛑 THE BIG ONE. Invite an employee with the 'Blog poster' preset and sign in as them. BEFORE: they saw all 91 admin entries — `filterNavItems` short-circuits on a missing `id`, and no nav item had one, so every requiredPermission was decorative. AFTER: about five entries, and groups with nothing left in them (Finance, Procurement, Catalog, Testing, Site, Events, Trust & Safety, System, Maintenance) disappear entirely rather than showing an empty heading. Check a second preset too — 'Trust & Safety' should see roughly 24.",
+                },
+                {
+                    key: "employee-sidebar-never-empty",
+                    label: "No permission preset produces a completely empty sidebar",
+                    description: "Work through the presets in the Team editor. Every one must leave at least one entry visible. An employee whose sidebar is blank cannot tell a permissions problem from a broken account, and will file it as the latter.",
+                },
+            ],
+        },
+        {
+            pageKey: "settings-deep-links",
+            pageLabel: "Settings deep links",
+            href: "/admin/site",
+            cases: [
+                {
+                    key: "tab-query-param-opens-that-tab",
+                    label: "?tab= opens the named tab",
+                    description: "Visit /admin/site?tab=fees directly. The Fees tab must be the open one. BEFORE the page ignored the URL entirely (`defaultValue=\"branding\"`), so every deep link landed on Branding.",
+                },
+                {
+                    key: "unknown-tab-falls-back-quietly",
+                    label: "An unknown ?tab= falls back to the default without an error",
+                    description: "Visit /admin/site?tab=nonsense. The page opens on Branding and shows no error. A rejected value must not look like a broken page — it looks like a stale bookmark, which is what it is.",
+                },
+            ],
+        },
+    ]),
 ];
 const defaultPhases = assignDefaultPhases(rawTesterChecklistItems);
 export const testerChecklistSeedData = rawTesterChecklistItems.map((item, index) => ({

package/dist/features/whatsapp-bot/components/SellerWhatsAppSettingsView.js

@@ -22,9 +22,23 @@ import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary";
 // ---------------------------------------------------------------------------
 // Sub-components
 // ---------------------------------------------------------------------------
+/**
+ * What the server sends in place of a stored access token. It is a SENTINEL,
+ * not a value — the real token never leaves the server.
+ */
+const MASKED_TOKEN = "••••••";
 function MaskedTokenInput({ label, value, onChange, placeholder, helperText, }) {
     const [revealed, setRevealed] = React.useState(false);
-    return (_jsxs(Div, { className: "relative", children: [_jsx(Input, { label: label, value: value, onChange: (e) => onChange(e.target.value), type: revealed ? "text" : "password", placeholder: placeholder, helperText: helperText }), _jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: () => setRevealed((r) => !r), className: "absolute right-3 top-8 text-[length:var(--appkit-text-xs)]", children: revealed ? "Hide" : "Reveal" })] }));
+    /*
+     * There is nothing to reveal while the field still holds the sentinel: the
+     * button used to un-mask six bullet characters, which reads as "the token is
+     * literally ••••••". Offer it only once the seller has typed something, which
+     * is the only case where the field contains a real value.
+     */
+    const isSentinel = value === MASKED_TOKEN;
+    return (_jsxs(Div, { className: "relative", children: [_jsx(Input, { label: label, value: value, onChange: (e) => onChange(e.target.value), type: revealed && !isSentinel ? "text" : "password", placeholder: placeholder, helperText: isSentinel
+                    ? "A token is saved. Type a new one to replace it — the stored value is never sent back."
+                    : helperText }), !isSentinel && (_jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: () => setRevealed((r) => !r), className: "absolute right-3 top-8 text-[length:var(--appkit-text-xs)]", children: revealed ? "Hide" : "Reveal" }))] }));
 }
 const STEPS = [
     {
@@ -101,12 +115,23 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
         setAccessToken(cfg.accessToken ?? "");
         setSyncEnabled(cfg.catalogSyncEnabled ?? false);
     }, [cfg]);
-    // Save mutation
+    /*
+     * The CONNECTION form. Credentials only.
+     *
+     * 🛑 It used to also send `catalogSyncEnabled` — the one key it sent
+     * unconditionally — while the toggle for it lives in Section 3, outside this
+     * form and below its Save button. A seller flipped the sync toggle, saw it
+     * move, pressed the Sync button beside it, and the setting was never
+     * persisted: the only control that saved it was "Save & Connect", two cards
+     * up and labelled for credentials.
+     *
+     * The toggle now owns its own write (`syncToggleMutation`), so the control
+     * and the thing that persists it are in the same place.
+     */
     const saveMutation = useApiMutation({
+        errorMessage: "Failed to save settings.",
         mutationFn: async () => {
-            const payload = {
-                catalogSyncEnabled: syncEnabled,
-            };
+            const payload = {};
             if (phoneNumber)
                 payload.phoneNumber = phoneNumber;
             if (wabaId)
@@ -114,7 +139,7 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
             if (catalogId)
                 payload.catalogId = catalogId;
             // Only send accessToken if user has typed a new value (not the masked placeholder)
-            if (accessToken && accessToken !== "••••••")
+            if (accessToken && accessToken !== MASKED_TOKEN)
                 payload.accessToken = accessToken;
             return apiClient.put(WHATSAPP_SELLER_ENDPOINTS.SETTINGS, payload);
         },
@@ -122,21 +147,32 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
             showToast("WhatsApp settings saved", "success");
             void queryClient.invalidateQueries({ queryKey: ["store", "whatsapp-settings"] });
         },
-        onError: (err) => {
-            const msg = err instanceof Error ? err.message : "Failed to save settings";
+    });
+    /** Persists the catalog-sync toggle on flip — see the note above. */
+    const syncToggleMutation = useApiMutation({
+        errorMessage: "Could not change the catalog-sync setting.",
+        mutationFn: async (next) => apiClient.put(WHATSAPP_SELLER_ENDPOINTS.SETTINGS, { catalogSyncEnabled: next }),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({ queryKey: ["store", "whatsapp-settings"] });
+        },
+        onError: () => {
+            // Put the switch back where the server still has it.
+            setSyncEnabled((prev) => !prev);
         },
     });
+    const handleSyncToggle = (next) => {
+        setSyncEnabled(next);
+        syncToggleMutation.mutate(next);
+    };
     // Catalog sync mutation (push: site → WhatsApp)
     const syncMutation = useApiMutation({
+        errorMessage: "Catalog sync failed.",
         mutationFn: async () => apiClient.post(WHATSAPP_SELLER_ENDPOINTS.CATALOG_SYNC, {}),
         onSuccess: (res) => {
             const r = res ?? {};
             showToast(`Synced ${r.successCount ?? 0} product${(r.successCount ?? 0) !== 1 ? "s" : ""} to WhatsApp catalog`, "success");
             void queryClient.invalidateQueries({ queryKey: ["store", "whatsapp-settings"] });
         },
-        onError: (err) => {
-            const msg = err instanceof Error ? err.message : "Sync failed";
-        },
     });
     // Catalog import (pull: WhatsApp → site). Runs as the `whatsappCatalogImport`
     // async job — the route only enqueues, so the result arrives over the
@@ -191,7 +227,7 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
                         }) })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", color: "primary", children: "Connection" }), isLoading ? null : cfg?.connected ? (_jsx(Badge, { variant: "success", children: "Connected" })) : (_jsx(Badge, { variant: "default", children: "Not configured" }))] }), _jsxs(Form, { schema: whatsappSettingsSchema, onSubmit: (e) => {
                             e.preventDefault();
                             saveMutation.mutate();
-                        }, spacing: "md", children: [_jsx(FormErrorSummary, {}), _jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: setSyncEnabled, disabled: !cfg?.connected })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
+                        }, spacing: "md", children: [_jsx(FormErrorSummary, {}), _jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: handleSyncToggle, disabled: !cfg?.connected || syncToggleMutation.isPending })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
                             buyerName: "Ravi K.",
                             firstItemName: "Charizard PSA 9",
                             additionalItemCount: 2,

package/dist/http/api-handler.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../errors/normalize";
+import { isAccountDisabled } from "../features/auth/role-predicates";
 import { createApiHandlerFactory } from "../next";
 import { applyRateLimit } from "../security";
 import { AuthenticationError, AuthorizationError, ERROR_MESSAGES, handleApiError, } from "../errors";
@@ -63,7 +64,7 @@ async function requireAuthFromRequest(request) {
     if (!user) {
         throw new AuthenticationError(ERROR_MESSAGES.USER.NOT_AUTHENTICATED);
     }
-    if (user.disabled) {
+    if (isAccountDisabled(user)) {
         throw new AuthenticationError(ERROR_MESSAGES.AUTH.ACCOUNT_DISABLED);
     }
     return user;