@mohasinac/appkit 4.31.0 → 4.32.0

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -396,6 +396,12 @@ const rawTesterChecklistItems = [
             href: "/products",
             cases: [
                 { key: "standard-detail", label: "Standard product detail page loads correctly", href: "/products/product-tester-standard-1" },
+                {
+                    key: "tester-fixtures-hidden-from-the-public",
+                    label: "SIGNED OUT, no product on /products has an id containing \"tester\" — the sandbox is invisible to the public",
+                    description: "Fixed 2026-09-01. BEFORE: the public products endpoint had no viewer concept, so an ANONYMOUS caller got 25 tester fixtures in its first 40 rows — stickers-tester-sandbox-1, prizedraw-tester-sandbox-closed, live-tester-sandbox-1 — and they filled the public marketplace. AFTER: open /products in a private window and scan the grid; nothing should be named \"Tester …\". Then sign in AS A TESTER and reload — the sandbox items must come back. Both halves matter: hiding them from everyone would break the tester programme, and a fixture that never reappears is the opposite bug.",
+                    href: "/products",
+                },
                 {
                     key: "seed-images-are-labelled-tiles",
                     label: "Every seeded product image is a readable tile showing the item's own name — NOT a broken-image icon and NOT an empty grey box",
@@ -2053,6 +2059,67 @@ const rawTesterChecklistItems = [
                 { key: "shipping-configs-crud", label: "Creating, editing, and listing shipping configs works", href: "/store/shipping-configs" },
                 { key: "payout-methods-crud", label: "Adding, editing, and listing payout methods works", href: "/store/payout-methods" },
                 { key: "payout-settings-page", label: "Payout settings page saves correctly", href: "/store/payout-settings" },
+                {
+                    key: "consolidated-tabs-old-urls",
+                    label: "Each absorbed URL still lands on the right TAB, not just the right page",
+                    description: "W8 C2 folded six sibling pages into tabs. BEFORE: /store/payout-methods, /store/payout-settings, /store/shipping-configs, /store/print-center, /store/slug, /admin/permissions and /admin/settings/navigation were each their own page with their own sidebar entry. AFTER: each redirects to its host with ?tab= set, and the sidebar entry is gone. Visit all seven old URLs. Each must land on the host page with the CORRECT tab already selected — a landing on the host's FIRST tab is the failure, and it looks like success unless you check which tab is active.",
+                    href: "/store/payout-methods",
+                },
+                {
+                    key: "consolidated-tabs-url-writeback",
+                    label: "Clicking a tab updates ?tab= in the address bar",
+                    description: "BEFORE: the settings page read ?tab= once on load and never wrote it back, so copying the URL after clicking a tab shared the DEFAULT tab. AFTER: every tabbed page writes the tab into the URL on click. On /store/payouts click through all three tabs, watch ?tab= change, then copy the address and open it in a new tab — it must reopen on the same panel. Back must leave the page rather than walking back through the tabs.",
+                    href: "/store/payouts",
+                },
+                {
+                    key: "print-center-selection-deeplink",
+                    label: "Print labels for a selection still carries the selection through the redirect",
+                    description: "/store/print-center is now a redirect, and it is deep-linked from the orders and products lists as ?type=order&ids=…&autoprint=1. Select two orders on /store/orders, use the print action, and confirm the Print Centre tab opens with those two orders loaded. Arriving at an EMPTY Print Centre is the failure — it looks like a normal empty state, which is why this case names the before.",
+                    href: "/store/orders",
+                },
+                {
+                    key: "consolidated-tabs-command-palette",
+                    label: "The absorbed surfaces are still findable by name in search",
+                    description: "Their sidebar entries were deleted, and the action index is derived from the sidebar — so without a deliberate entry they would vanish from search on the day they became easier to reach. Search for \"upi\", \"threshold\", \"barcode\", \"slug\" and \"permissions catalogue\". Each must return a result that opens the right TAB.",
+                    href: "/store/payouts",
+                },
+            ],
+        },
+        {
+            pageKey: "sectionised-forms",
+            pageLabel: "Forms — sections, error summary and the mobile bar",
+            href: "/admin/orders",
+            cases: [
+                {
+                    key: "form-sections-save-unchanged",
+                    label: "Every migrated form still saves exactly the fields it saved before",
+                    description: "W8 C3 moved 16 hand-rolled forms onto <SectionForm>. The risk is a field that renders but no longer reaches the payload. On each of these, change EVERY field, save, reload, and confirm each value came back: the admin order editor (status, tracking number, carrier, notes), the admin user editor (role, email verified, display name, phone, tester flags, admin notes, bio, location, website, four social links), WhatsApp settings, the seller order panel, and the ad settings panel. A field that silently reverts is the failure, and nothing errors when it happens.",
+                    href: "/admin/orders",
+                },
+                {
+                    key: "form-error-summary-jumps",
+                    label: "A validation error names its section and jumps to it",
+                    description: "BEFORE: an invalid field produced a banner listing the problem with no way to reach it, and on the site-settings page the summary was mounted outside every form context and so displayed NOTHING at all. AFTER: submit a form with a bad value (a negative refund on an order, a non-https third-party ad URL, an AdSense id that is not ca-pub-…) and the summary must list it, tag it with its section, collapse open that section when clicked, and show a count badge on the section header.",
+                    href: "/admin/ads",
+                },
+                {
+                    key: "form-mobile-action-bar",
+                    label: "Save and Cancel appear in the pinned mobile bar, once",
+                    description: "On a phone-width viewport, a page-level form publishes its actions into the bottom chrome tier. Open /admin/products/new and confirm exactly ONE Save row is visible — not one in the page and one pinned. Inside a drawer or modal (the admin order editor, the review reply modal) the pinned bar must NOT appear: an overlay owns its own footer, and a viewport-fixed bar renders behind the backdrop.",
+                    href: "/admin/products/new",
+                },
+                {
+                    key: "form-conditional-fields-drop-values",
+                    label: "A field hidden by a condition does not submit a stale value",
+                    description: "BEFORE: hiding a control left its last value in the payload. AFTER: on the admin user editor, switch \"Is Tester\" ON, tick \"Can test admin areas\", switch \"Is Tester\" back OFF, save, reload — the admin-test flag must be false. Same shape on a shipment item: enter a price, tick \"for self use\", save; the price must not be stored.",
+                    href: "/admin/users",
+                },
+                {
+                    key: "site-settings-save-still-writes-everything",
+                    label: "Site settings still saves every tab's fields in one Save",
+                    description: "Its 20 tabs write ONE document through one payload, and its schema is deliberately passthrough because that payload carries keys the TypeScript interface does not declare. A closed schema here would silently strip them. Change one field on each of three different tabs, press \"Save all changes\" once, reload, and confirm all three persisted — and that fields on tabs you did NOT touch are unchanged.",
+                    href: "/admin/site",
+                },
             ],
         },
         {

package/dist/features/whatsapp-bot/components/SellerWhatsAppSettingsView.js

@@ -12,12 +12,15 @@ const __O = {
 };
 const CLS_SECTION_CARD = "border border-[var(--appkit-color-border)] rounded-xl p-[var(--appkit-space-5)]";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { Alert, Badge, Button, Div, Form, FormActions, Heading, Input, Row, Section, Span, Stack, Text, Toggle, useToast } from "../../../ui";
+import { Alert, Badge, Button, Div, Heading, Input, Row, Section, Span, Stack, Text, Toggle, useToast } from "../../../ui";
 import { apiClient } from "../../../http";
 import { WHATSAPP_SELLER_ENDPOINTS } from "../../../constants/api-endpoints";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry";
 import { buildPurchaseAnnouncementMessage } from "../helpers/whatsapp";
-import { whatsappSettingsSchema } from "../../admin/schemas/admin-user-form";
+import { whatsappConnectionSchema, } from "../../admin/schemas/admin-user-form";
+import { SectionForm, useSectionFormNav, buildSectionsFromSchema, visibleValues, } from "../../shell";
+import { useFormShellState, FormShellContext } from "../../../ui/forms";
+import { applyZodIssues } from "../../../ui/forms/apply-zod-issues";
 import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary";
 // ---------------------------------------------------------------------------
 // Sub-components
@@ -101,20 +104,40 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
     });
     const cfg = data ?? null;
     // Connection form state
-    const [phoneNumber, setPhoneNumber] = React.useState("");
-    const [wabaId, setWabaId] = React.useState("");
-    const [catalogId, setCatalogId] = React.useState("");
-    const [accessToken, setAccessToken] = React.useState("");
+    const [draft, setDraft] = React.useState({
+        phoneNumber: "",
+        wabaId: "",
+        catalogId: "",
+        accessToken: "",
+    });
     const [syncEnabled, setSyncEnabled] = React.useState(false);
     React.useEffect(() => {
         if (!cfg)
             return;
-        setPhoneNumber(cfg.phoneNumber ?? "");
-        setWabaId(cfg.wabaId ?? "");
-        setCatalogId(cfg.catalogId ?? "");
-        setAccessToken(cfg.accessToken ?? "");
+        setDraft({
+            phoneNumber: cfg.phoneNumber ?? "",
+            wabaId: cfg.wabaId ?? "",
+            catalogId: cfg.catalogId ?? "",
+            accessToken: cfg.accessToken ?? "",
+        });
         setSyncEnabled(cfg.catalogSyncEnabled ?? false);
     }, [cfg]);
+    /*
+     * The access token needs a renderer: it is a `text` field to the schema, and
+     * the control is a masked input with a reveal that must stay suppressed while
+     * the field still holds the server's sentinel.
+     */
+    const sections = React.useMemo(() => buildSectionsFromSchema(whatsappConnectionSchema, {
+        renderers: {
+            accessToken: ({ values, onChange }) => (_jsx(MaskedTokenInput, { label: "System User Access Token", value: values.accessToken ?? "", onChange: (v) => onChange({ accessToken: v }), placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" })),
+        },
+    }), []);
+    const nav = useSectionFormNav(sections, draft, { scope: "store:whatsapp" });
+    const form = useFormShellState(whatsappConnectionSchema, {
+        sections: nav.sectionMeta,
+        onGoToSection: nav.goToSection,
+        fieldToSectionIndex: nav.fieldToSectionIndex,
+    });
     /*
      * The CONNECTION form. Credentials only.
      *
@@ -131,16 +154,17 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
     const saveMutation = useApiMutation({
         errorMessage: "Failed to save settings.",
         mutationFn: async () => {
+            const v = visibleValues(whatsappConnectionSchema, draft);
             const payload = {};
-            if (phoneNumber)
-                payload.phoneNumber = phoneNumber;
-            if (wabaId)
-                payload.wabaId = wabaId;
-            if (catalogId)
-                payload.catalogId = catalogId;
+            if (v.phoneNumber)
+                payload.phoneNumber = v.phoneNumber;
+            if (v.wabaId)
+                payload.wabaId = v.wabaId;
+            if (v.catalogId)
+                payload.catalogId = v.catalogId;
             // Only send accessToken if user has typed a new value (not the masked placeholder)
-            if (accessToken && accessToken !== MASKED_TOKEN)
-                payload.accessToken = accessToken;
+            if (v.accessToken && v.accessToken !== MASKED_TOKEN)
+                payload.accessToken = v.accessToken;
             return apiClient.put(WHATSAPP_SELLER_ENDPOINTS.SETTINGS, payload);
         },
         onSuccess: () => {
@@ -224,10 +248,17 @@ export function SellerWhatsAppSettingsView({ hasCapability }) {
                                     ? cfg?.connected === true
                                     : Boolean(cfg?.[step.checkKey]);
                             return (_jsxs(Row, { gap: "sm", align: "start", children: [_jsx(Row, { textWeight: "bold", textSize: "xs", className: `flex-shrink-0 w-6 h-6 mt-0.5 ${done ? "bg-[var(--appkit-color-success)] text-white" : "bg-[var(--appkit-color-surface-elevated)] text-[var(--appkit-color-text-muted)] dark:text-[var(--appkit-color-text-faint)]"}`, align: "center", justify: "center", rounded: "full", children: done ? "✓" : step.n }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", color: "primary", children: step.title }), _jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: step.body })] })] }, step.n));
-                        }) })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", color: "primary", children: "Connection" }), isLoading ? null : cfg?.connected ? (_jsx(Badge, { variant: "success", children: "Connected" })) : (_jsx(Badge, { variant: "default", children: "Not configured" }))] }), _jsxs(Form, { schema: whatsappSettingsSchema, onSubmit: (e) => {
-                            e.preventDefault();
-                            saveMutation.mutate();
-                        }, spacing: "md", children: [_jsx(FormErrorSummary, {}), _jsx(Input, { label: "WhatsApp Business Phone Number", value: phoneNumber, onChange: (e) => setPhoneNumber(e.target.value), placeholder: "919876543210", helperText: "Digits only, include country code (e.g. 91 for India)" }), _jsx(Input, { label: "WABA ID (WhatsApp Business Account ID)", value: wabaId, onChange: (e) => setWabaId(e.target.value), placeholder: "123456789012345", helperText: "From Meta Business Manager \u2192 WhatsApp Accounts" }), _jsx(Input, { label: "Catalog ID", value: catalogId, onChange: (e) => setCatalogId(e.target.value), placeholder: "987654321098765", helperText: "From Meta Commerce Manager \u2192 Catalogs" }), _jsx(MaskedTokenInput, { label: "System User Access Token", value: accessToken, onChange: setAccessToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived token with WhatsApp Business permissions" }), _jsx(FormActions, { align: "right", children: _jsx(Button, { type: "submit", isLoading: saveMutation.isPending, disabled: saveMutation.isPending, children: saveMutation.isPending ? "Saving…" : ACTIONS.STORE["whatsapp-connect"].label }) })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: handleSyncToggle, disabled: !cfg?.connected || syncToggleMutation.isPending })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
+                        }) })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", color: "primary", children: "Connection" }), isLoading ? null : cfg?.connected ? (_jsx(Badge, { variant: "success", children: "Connected" })) : (_jsx(Badge, { variant: "default", children: "Not configured" }))] }), _jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
+                                    // SectionForm scrolls to the first bad section and then submits
+                                    // regardless, so the guard lives here.
+                                    form.clearErrors();
+                                    const parsed = whatsappConnectionSchema.safeParse(visibleValues(whatsappConnectionSchema, draft));
+                                    if (!parsed.success) {
+                                        applyZodIssues(parsed.error.issues, form.setFieldError);
+                                        return;
+                                    }
+                                    saveMutation.mutate();
+                                }, onValidationChange: () => form.validate(draft), schema: whatsappConnectionSchema, openIds: nav.openIds, onOpenChange: nav.setOpenIds, submitLabel: ACTIONS.STORE["whatsapp-connect"].label, isLoading: saveMutation.isPending })] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-4", color: "primary", size: "sm", weight: "semibold", children: "Catalog Sync" }), _jsxs(Row, { justify: "between", align: "center", className: "mb-4", children: [_jsxs(Div, { children: [_jsx(Text, { size: "sm", color: "muted", children: "Enable catalog sync" }), _jsx(Text, { size: "xs", color: "muted", children: "When enabled, your published standard products can be synced to WhatsApp." })] }), _jsx(Toggle, { checked: syncEnabled, onChange: handleSyncToggle, disabled: !cfg?.connected || syncToggleMutation.isPending })] }), cfg?.lastCatalogSyncAt && (_jsxs(Row, { color: "muted", textSize: "xs", gap: "sm", align: "center", className: "mb-3", children: [_jsxs(Text, { children: ["Last sync: ", new Date(cfg.lastCatalogSyncAt).toLocaleString("en-IN")] }), cfg.lastSyncCount !== undefined && _jsxs(Text, { children: ["\u00B7 ", cfg.lastSyncCount, " products"] }), cfg.lastSyncStatus && (_jsx(Badge, { variant: STATUS_VARIANT[cfg.lastSyncStatus] ?? "default", children: cfg.lastSyncStatus }))] })), _jsx(Text, { className: "mb-3", color: "faint", size: "xs", children: "Only published standard products are synced. Auctions and pre-orders are excluded. Batches of up to 50 products per call." }), _jsxs(Row, { gap: "3", children: [_jsx(Button, { onClick: () => syncMutation.mutate(), isLoading: syncMutation.isPending, disabled: !cfg?.connected || !syncEnabled || syncMutation.isPending, variant: "secondary", children: syncMutation.isPending ? "Syncing…" : ACTIONS.STORE["whatsapp-catalog-sync"].label }), _jsx(Button, { onClick: () => void startImport(), isLoading: importing, disabled: !cfg?.connected || !syncEnabled || importing, variant: "secondary", children: importing ? "Importing…" : ACTIONS.STORE["whatsapp-catalog-import"].label })] }), _jsxs(Text, { className: "mt-3", color: "faint", size: "xs", children: [_jsx(Span, { weight: "bold", children: "Push" }), " sends your published standard products to WhatsApp.", " ", _jsx(Span, { weight: "bold", children: "Import" }), " creates draft products from your WhatsApp catalog. Products are matched by slug in the description field."] })] }), _jsxs(Section, { className: CLS_SECTION_CARD, children: [_jsx(Heading, { level: 2, className: "mb-2", color: "primary", size: "sm", weight: "semibold", children: "Purchase Announcement Preview" }), _jsx(Text, { className: "mb-3", color: "muted", size: "xs", children: "This message is sent automatically to your phone and the platform admin when a new order is placed." }), _jsx(Div, { textSize: "sm", className: "font-mono", color: "primary", surface: "muted", padding: "inline", rounded: "lg", children: buildPurchaseAnnouncementMessage({
                             buyerName: "Ravi K.",
                             firstItemName: "Charizard PSA 9",
                             additionalItemCount: 2,

package/dist/index.d.ts

@@ -3220,5 +3220,9 @@ export { SITE_SETTINGS_ENTRIES, deriveSettingsEntries, } from "./features/search
 export type { SettingsIndexSource } from "./features/search/action-index/settings-entries";
 export { SITE_SETTINGS_TABS, SITE_SETTINGS_TAB_IDS, isSiteSettingsTabId, } from "./features/admin/constants/site-settings-tabs";
 export type { SiteSettingsTab, SiteSettingsTabId } from "./features/admin/constants/site-settings-tabs";
+export { PAYOUTS_TABS, isPayoutsTabId, SHIPPING_TABS, isShippingTabId, FULFILLMENT_TABS, isFulfillmentTabId, STOREFRONT_TABS, isStorefrontTabId, } from "./features/seller/constants/store-tabs";
+export type { StoreDashboardTab, PayoutsTabId, ShippingTabId, FulfillmentTabId, StorefrontTabId, } from "./features/seller/constants/store-tabs";
+export { ROLES_TABS, isRolesTabId, ADMIN_SETTINGS_TABS, isAdminSettingsTabId, } from "./features/admin/constants/admin-page-tabs";
+export type { AdminPageTab, RolesTabId, AdminSettingsTabId, } from "./features/admin/constants/admin-page-tabs";
 export { validateActionIndexEntry, normaliseRoute, } from "./features/search/action-index/validate-entry";
 export type { ActionIndexValidationContext, ActionIndexValidationIssue, } from "./features/search/action-index/validate-entry";

package/dist/index.js

@@ -5626,4 +5626,6 @@ export { deriveNavEntries, deriveQuickActionEntries, buildActionIndexBase, } fro
 export { matchesNavQuery } from "./_internal/shared/features/layout/matchesNavQuery";
 export { SITE_SETTINGS_ENTRIES, deriveSettingsEntries, } from "./features/search/action-index/settings-entries";
 export { SITE_SETTINGS_TABS, SITE_SETTINGS_TAB_IDS, isSiteSettingsTabId, } from "./features/admin/constants/site-settings-tabs";
+export { PAYOUTS_TABS, isPayoutsTabId, SHIPPING_TABS, isShippingTabId, FULFILLMENT_TABS, isFulfillmentTabId, STOREFRONT_TABS, isStorefrontTabId, } from "./features/seller/constants/store-tabs";
+export { ROLES_TABS, isRolesTabId, ADMIN_SETTINGS_TABS, isAdminSettingsTabId, } from "./features/admin/constants/admin-page-tabs";
 export { validateActionIndexEntry, normaliseRoute, } from "./features/search/action-index/validate-entry";

package/dist/next/index.d.ts

@@ -32,3 +32,11 @@ export { UnauthorizedView } from "./components/UnauthorizedView";
 export type { UnauthorizedViewProps } from "./components/UnauthorizedView";
 export { ErrorBoundary } from "./ErrorBoundary";
 export type { ErrorBoundaryProps } from "./ErrorBoundary";
+export { navItemId } from "../_internal/shared/features/layout/types";
+export { matchesNavQuery } from "../_internal/shared/features/layout/matchesNavQuery";
+export { buildActionIndexBase, deriveNavEntries, deriveQuickActionEntries, } from "../features/search/action-index/derive";
+export { deriveSettingsEntries } from "../features/search/action-index/settings-entries";
+export { deriveConsolidatedTabEntries, CONSOLIDATED_TAB_SURFACES, } from "../features/search/action-index/tab-entries";
+export type { ConsolidatedTabSurface, ConsolidatedTabHrefs, } from "../features/search/action-index/tab-entries";
+export { mergeActionIndex, projectActionIndexForViewer, } from "../features/search/action-index/types";
+export type { ActionIndexEntry, ActionIndexControl, ActionIndexOverride, } from "../features/search/action-index/types";

package/dist/next/index.js

@@ -27,3 +27,40 @@ export { ErrorView } from "./components/ErrorView";
 export { NotFoundView } from "./components/NotFoundView";
 export { UnauthorizedView } from "./components/UnauthorizedView";
 export { ErrorBoundary } from "./ErrorBoundary";
+/*
+ * Pure, isomorphic nav helpers — deliberately re-exported HERE as well as from
+ * the main and client entries.
+ *
+ * 🛑 `src/constants/navigation.tsx` CALLS `navItemId()` at module scope and is
+ * imported by BOTH server code (the locale and store layouts, the action index)
+ * and client code (every sidebar). That leaves it nowhere to import from:
+ *
+ *   - `@mohasinac/appkit/client` is `"use client"`, so on the server the binding
+ *     is a client-reference proxy and calling it throws (Root Cause #76). It did
+ *     — "Attempted to call navItemId() from the server" failed the Vercel build.
+ *   - the bare `@mohasinac/appkit` entry then trips
+ *     `audit-client-server-only-leak` on all 57 client components that reach
+ *     navigation.tsx transitively (Root Cause #6).
+ *
+ * The two audits pull in opposite directions, and both are right. `./next` is
+ * the third door: not `"use client"`, and not a path to firebase-admin — so it
+ * satisfies both. This is the same reasoning that keeps `/ui` and `/tokens`
+ * separate entries.
+ */
+export { navItemId } from "../_internal/shared/features/layout/types";
+export { matchesNavQuery } from "../_internal/shared/features/layout/matchesNavQuery";
+/*
+ * The action-index derivation — same reasoning as the nav helpers above.
+ *
+ * `src/constants/action-index.ts` calls `buildActionIndexBase()` at module
+ * scope and is imported by `GET /api/action-index` (a server route) as well as
+ * by `LayoutShellClient` (a client component). Neither the `"use client"` entry
+ * nor the bare one works for both; `./next` does.
+ *
+ * Found by `audit-client-entry-in-server`'s R2 the first time it ran — the same
+ * defect as navItemId, one file over, and the next build failure in line.
+ */
+export { buildActionIndexBase, deriveNavEntries, deriveQuickActionEntries, } from "../features/search/action-index/derive";
+export { deriveSettingsEntries } from "../features/search/action-index/settings-entries";
+export { deriveConsolidatedTabEntries, CONSOLIDATED_TAB_SURFACES, } from "../features/search/action-index/tab-entries";
+export { mergeActionIndex, projectActionIndexForViewer, } from "../features/search/action-index/types";

package/dist/react/hooks/useTabParam.d.ts

@@ -0,0 +1,19 @@
+export interface UseTabParamOptions {
+    /**
+     * A locale-aware router, when the caller has one. Without it the plain
+     * `next/navigation` router drops the locale prefix on replace.
+     */
+    router?: {
+        replace: (url: string) => void;
+    };
+    pathname?: string;
+}
+/**
+ * The active tab, kept in `?tab=`.
+ *
+ * `isValid` is the page's own type guard — `isSiteSettingsTabId`,
+ * `isPayoutsTabId`, and so on — so an unknown value in the URL is IGNORED
+ * rather than written into state. That is what makes a stale bookmark open the
+ * default tab instead of rendering an empty panel.
+ */
+export declare function useTabParam<T extends string>(isValid: (value: string | null | undefined) => value is T, fallback: T, options?: UseTabParamOptions): [T, (next: string) => void];

package/dist/react/hooks/useTabParam.js

@@ -0,0 +1,65 @@
+"use client";
+/*
+ * WHY: `Tabs` has no URL sync of its own, so every tabbed page has had to
+ *      hand-roll one. `AdminSiteSettingsView` read `?tab=` once, in a
+ *      `useState` initialiser guarded on `typeof window` — and never wrote it
+ *      back, so the URL went stale the moment anyone clicked a tab. A deep
+ *      link into a tab worked; sharing the page you were looking at did not.
+ *
+ *      W8's tab consolidations add five more tabbed pages, each of which needs
+ *      the absorbed page's `?tab=` deep link to keep working, which is well
+ *      past the Rule of Three.
+ *
+ * WHAT: Read `?tab=` (validated against the page's own union), and write it
+ *       back on every change.
+ *
+ * ## Why `router.replace` and not `push`
+ *
+ * A tab is a view of one page, not a new destination. Pushing would make Back
+ * walk the user through every tab they glanced at before leaving the page,
+ * which is the behaviour `useUrlTable` already rejected for filters.
+ *
+ * ## Why not `useUrlTable().set(TABLE_KEYS.TAB, …)`
+ *
+ * That would work, and it also resets `page` to 1 — correct for a filter
+ * change, meaningless here, and it puts a `page=1` in the URL of a settings
+ * page that has no pagination.
+ *
+ * EXPORTS: useTabParam
+ *
+ * @tag domain:shared
+ * @tag layer:hook
+ * @tag pattern:none
+ * @tag access:client
+ * @tag consumers:AdminSiteSettingsView,store payouts/shipping/fulfillment/storefront,admin roles/settings
+ * @tag sideEffects:router
+ */
+import { useRouter, usePathname, useSearchParams } from "next/navigation";
+import { useCallback } from "react";
+import { TABLE_KEYS } from "../../constants/table-keys";
+/**
+ * The active tab, kept in `?tab=`.
+ *
+ * `isValid` is the page's own type guard — `isSiteSettingsTabId`,
+ * `isPayoutsTabId`, and so on — so an unknown value in the URL is IGNORED
+ * rather than written into state. That is what makes a stale bookmark open the
+ * default tab instead of rendering an empty panel.
+ */
+export function useTabParam(isValid, fallback, options) {
+    const nativeRouter = useRouter();
+    const nativePathname = usePathname();
+    const searchParams = useSearchParams();
+    const router = options?.router ?? nativeRouter;
+    const pathname = options?.pathname ?? nativePathname;
+    const requested = searchParams.get(TABLE_KEYS.TAB);
+    const active = isValid(requested) ? requested : fallback;
+    const setTab = useCallback((next) => {
+        if (!isValid(next))
+            return;
+        const params = new URLSearchParams(searchParams.toString());
+        params.set(TABLE_KEYS.TAB, next);
+        const query = params.toString();
+        router.replace(query ? `${pathname}?${query}` : pathname);
+    }, [isValid, pathname, router, searchParams]);
+    return [active, setTab];
+}

package/dist/schemas/registry.d.ts

@@ -4874,26 +4874,50 @@ export declare const SCHEMAS: {
             carrier?: string | undefined;
         }>;
         readonly adminUser: import("zod").ZodObject<{
+            role: import("zod").ZodOptional<import("zod").ZodEnum<["user", "seller", "admin", "moderator"]>>;
+            emailVerified: import("zod").ZodOptional<import("zod").ZodBoolean>;
             displayName: import("zod").ZodOptional<import("zod").ZodString>;
             phoneNumber: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
             isTester: import("zod").ZodOptional<import("zod").ZodBoolean>;
             canTestAdmin: import("zod").ZodOptional<import("zod").ZodBoolean>;
             adminNotes: import("zod").ZodOptional<import("zod").ZodString>;
-            publicProfile: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodType<import("./types").FirestoreValue, import("zod").ZodTypeDef, import("./types").FirestoreValue>>>;
+            bio: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
+            location: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
+            website: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
+            twitter: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
+            instagram: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
+            facebook: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
+            linkedin: import("zod").ZodUnion<[import("zod").ZodOptional<import("zod").ZodString>, import("zod").ZodLiteral<"">]>;
         }, "strip", import("zod").ZodTypeAny, {
+            role?: "user" | "seller" | "admin" | "moderator" | undefined;
             displayName?: string | undefined;
+            location?: string | undefined;
             adminNotes?: string | undefined;
+            bio?: string | undefined;
             phoneNumber?: string | undefined;
+            emailVerified?: boolean | undefined;
+            website?: string | undefined;
             isTester?: boolean | undefined;
             canTestAdmin?: boolean | undefined;
-            publicProfile?: Record<string, import("./types").FirestoreValue> | undefined;
+            instagram?: string | undefined;
+            facebook?: string | undefined;
+            twitter?: string | undefined;
+            linkedin?: string | undefined;
         }, {
+            role?: "user" | "seller" | "admin" | "moderator" | undefined;
             displayName?: string | undefined;
+            location?: string | undefined;
             adminNotes?: string | undefined;
+            bio?: string | undefined;
             phoneNumber?: string | undefined;
+            emailVerified?: boolean | undefined;
+            website?: string | undefined;
             isTester?: boolean | undefined;
             canTestAdmin?: boolean | undefined;
-            publicProfile?: Record<string, import("./types").FirestoreValue> | undefined;
+            instagram?: string | undefined;
+            facebook?: string | undefined;
+            twitter?: string | undefined;
+            linkedin?: string | undefined;
         }>;
         readonly employeeInvite: import("zod").ZodObject<{
             email: import("zod").ZodString;