@mohasinac/appkit 4.53.1 → 4.54.0

package/dist/constants/api-endpoints.d.ts

@@ -57,6 +57,11 @@ export declare const ACCOUNT_ENDPOINTS: {
     readonly HISTORY_ITEM: (productId: string) => string;
     readonly HISTORY_MERGE: "/api/user/history/merge";
     readonly REVIEWS: "/api/user/reviews";
+    /**
+     * "Have I bought this, and did I review it?" for one product — backs the
+     * purchase strip on a product page. Per-viewer, never cached.
+     */
+    readonly PURCHASE_CONTEXT: (productId: string) => string;
     readonly BIDS: "/api/user/bids";
     readonly BID_BY_ID: (id: string) => string;
     readonly EXPORT: "/api/user/export";
@@ -301,6 +306,13 @@ export declare const TOOL_ENDPOINTS: {
      * is the multi-get `searchPriceIndex` otherwise pays for every lookup.
      */
     readonly PRICE_INDEX_BANDS: (ids: readonly string[]) => string;
+    /**
+     * The competitor-crawl market band for the same leaves — SIGNED-IN ONLY, and
+     * therefore a separate request from `PRICE_INDEX_BANDS` rather than more
+     * fields on it. That route is public and edge-cached; this one must not be,
+     * or one signed-in lookup populates an entry every guest reads.
+     */
+    readonly PRICE_INDEX_MARKET: (ids: readonly string[]) => string;
 };
 /**
  * The sticker-sheet kiss-cut tracer. Admin-only, every route behind
@@ -445,6 +457,8 @@ export declare const PROMOTION_ENDPOINTS: {
 export declare const REVIEW_ENDPOINTS: {
     readonly LIST: "/api/reviews";
     readonly FEATURED: "/api/reviews?featured=true";
+    /** GET / PATCH / DELETE one review. The PATCH is the buyer's own edit. */
+    readonly BY_ID: (id: string) => string;
 };
 export declare const SEARCH_ENDPOINTS: {
     readonly SUGGESTIONS: "/api/search/suggestions";
@@ -555,11 +569,6 @@ export declare const SCAMMER_ENDPOINTS: {
 export declare const BEFORE_AFTER_ENDPOINTS: {
     readonly LIST: "/api/before-after";
 };
-export declare const WHATSAPP_SELLER_ENDPOINTS: {
-    readonly SETTINGS: "/api/store/whatsapp-settings";
-    readonly CATALOG_SYNC: "/api/store/whatsapp-settings/catalog-sync";
-    readonly CATALOG_IMPORT: "/api/store/whatsapp-settings/catalog-import";
-};
 export declare const API_ENDPOINTS: {
     readonly CONFIG: {};
     readonly LOGS: {
@@ -612,6 +621,11 @@ export declare const API_ENDPOINTS: {
         readonly HISTORY_ITEM: (productId: string) => string;
         readonly HISTORY_MERGE: "/api/user/history/merge";
         readonly REVIEWS: "/api/user/reviews";
+        /**
+         * "Have I bought this, and did I review it?" for one product — backs the
+         * purchase strip on a product page. Per-viewer, never cached.
+         */
+        readonly PURCHASE_CONTEXT: (productId: string) => string;
         readonly BIDS: "/api/user/bids";
         readonly BID_BY_ID: (id: string) => string;
         readonly EXPORT: "/api/user/export";
@@ -951,6 +965,8 @@ export declare const API_ENDPOINTS: {
     readonly REVIEWS: {
         readonly LIST: "/api/reviews";
         readonly FEATURED: "/api/reviews?featured=true";
+        /** GET / PATCH / DELETE one review. The PATCH is the buyer's own edit. */
+        readonly BY_ID: (id: string) => string;
     };
     readonly SEARCH: {
         readonly SUGGESTIONS: "/api/search/suggestions";
@@ -1048,11 +1064,6 @@ export declare const API_ENDPOINTS: {
         readonly PRODUCTS: (sellerId: string) => string;
         readonly REVIEWS: (userId: string) => string;
     };
-    readonly WHATSAPP_SELLER: {
-        readonly SETTINGS: "/api/store/whatsapp-settings";
-        readonly CATALOG_SYNC: "/api/store/whatsapp-settings/catalog-sync";
-        readonly CATALOG_IMPORT: "/api/store/whatsapp-settings/catalog-import";
-    };
     readonly SUPPORT: {
         readonly TICKETS: "/api/support/tickets";
         readonly TICKET_BY_ID: (id: string) => string;
@@ -1139,6 +1150,11 @@ export declare const API_ROUTES: {
         readonly HISTORY_ITEM: (productId: string) => string;
         readonly HISTORY_MERGE: "/api/user/history/merge";
         readonly REVIEWS: "/api/user/reviews";
+        /**
+         * "Have I bought this, and did I review it?" for one product — backs the
+         * purchase strip on a product page. Per-viewer, never cached.
+         */
+        readonly PURCHASE_CONTEXT: (productId: string) => string;
         readonly BIDS: "/api/user/bids";
         readonly BID_BY_ID: (id: string) => string;
         readonly EXPORT: "/api/user/export";
@@ -1478,6 +1494,8 @@ export declare const API_ROUTES: {
     readonly REVIEWS: {
         readonly LIST: "/api/reviews";
         readonly FEATURED: "/api/reviews?featured=true";
+        /** GET / PATCH / DELETE one review. The PATCH is the buyer's own edit. */
+        readonly BY_ID: (id: string) => string;
     };
     readonly SEARCH: {
         readonly SUGGESTIONS: "/api/search/suggestions";
@@ -1575,11 +1593,6 @@ export declare const API_ROUTES: {
         readonly PRODUCTS: (sellerId: string) => string;
         readonly REVIEWS: (userId: string) => string;
     };
-    readonly WHATSAPP_SELLER: {
-        readonly SETTINGS: "/api/store/whatsapp-settings";
-        readonly CATALOG_SYNC: "/api/store/whatsapp-settings/catalog-sync";
-        readonly CATALOG_IMPORT: "/api/store/whatsapp-settings/catalog-import";
-    };
     readonly SUPPORT: {
         readonly TICKETS: "/api/support/tickets";
         readonly TICKET_BY_ID: (id: string) => string;

package/dist/constants/api-endpoints.js

@@ -79,6 +79,11 @@ export const ACCOUNT_ENDPOINTS = {
     HISTORY_ITEM: (productId) => `/api/user/history/${encodeURIComponent(productId)}`,
     HISTORY_MERGE: "/api/user/history/merge",
     REVIEWS: "/api/user/reviews",
+    /**
+     * "Have I bought this, and did I review it?" for one product — backs the
+     * purchase strip on a product page. Per-viewer, never cached.
+     */
+    PURCHASE_CONTEXT: (productId) => `/api/user/purchases/${encodeURIComponent(productId)}`,
     BIDS: "/api/user/bids",
     BID_BY_ID: (id) => `/api/user/bids/${id}`,
     EXPORT: "/api/user/export",
@@ -348,6 +353,13 @@ export const TOOL_ENDPOINTS = {
      * is the multi-get `searchPriceIndex` otherwise pays for every lookup.
      */
     PRICE_INDEX_BANDS: (ids) => `/api/tools/price-index/bands?ids=${ids.map(encodeURIComponent).join(",")}`,
+    /**
+     * The competitor-crawl market band for the same leaves — SIGNED-IN ONLY, and
+     * therefore a separate request from `PRICE_INDEX_BANDS` rather than more
+     * fields on it. That route is public and edge-cached; this one must not be,
+     * or one signed-in lookup populates an entry every guest reads.
+     */
+    PRICE_INDEX_MARKET: (ids) => `/api/tools/price-index/market?ids=${ids.map(encodeURIComponent).join(",")}`,
 };
 /**
  * The sticker-sheet kiss-cut tracer. Admin-only, every route behind
@@ -585,6 +597,8 @@ export const PROMOTION_ENDPOINTS = {
 export const REVIEW_ENDPOINTS = {
     LIST: "/api/reviews",
     FEATURED: "/api/reviews?featured=true",
+    /** GET / PATCH / DELETE one review. The PATCH is the buyer's own edit. */
+    BY_ID: (id) => `/api/reviews/${encodeURIComponent(id)}`,
 };
 // ---------------------------------------------------------------------------
 // Search
@@ -732,13 +746,6 @@ export const BEFORE_AFTER_ENDPOINTS = {
     LIST: "/api/before-after",
 };
 // ---------------------------------------------------------------------------
-// WhatsApp Business (store-level settings + catalog sync)
-// ---------------------------------------------------------------------------
-export const WHATSAPP_SELLER_ENDPOINTS = {
-    SETTINGS: "/api/store/whatsapp-settings",
-    CATALOG_SYNC: "/api/store/whatsapp-settings/catalog-sync",
-    CATALOG_IMPORT: "/api/store/whatsapp-settings/catalog-import",
-};
 // ---------------------------------------------------------------------------
 // Aggregate namespace export
 // ---------------------------------------------------------------------------
@@ -784,7 +791,6 @@ export const API_ENDPOINTS = {
     SUBLISTING_CATEGORIES: SUBLISTING_CATEGORY_ENDPOINTS,
     WISHLIST: WISHLIST_ENDPOINTS,
     PROFILE_STATS: PROFILE_STATS_ENDPOINTS,
-    WHATSAPP_SELLER: WHATSAPP_SELLER_ENDPOINTS,
     SUPPORT: SUPPORT_ENDPOINTS,
     SCAMMERS: SCAMMER_ENDPOINTS,
     REPORTS: REPORT_ENDPOINTS,

package/dist/constants/field-names.d.ts

@@ -892,6 +892,7 @@ export declare const SITE_SETTINGS_FIELDS: {
     };
     readonly PAYMENT: "payment";
     readonly PAYMENT_FIELDS: {
+        readonly RAZORPAY_ENABLED: "payment.razorpayEnabled";
         readonly PHONEPE_ENABLED: "payment.phonepeEnabled";
         readonly UPI_MANUAL_ENABLED: "payment.upiManualEnabled";
         readonly COD_ENABLED: "payment.codEnabled";

package/dist/constants/field-names.js

@@ -1077,6 +1077,7 @@ export const SITE_SETTINGS_FIELDS = {
     },
     PAYMENT: "payment",
     PAYMENT_FIELDS: {
+        RAZORPAY_ENABLED: "payment.razorpayEnabled",
         PHONEPE_ENABLED: "payment.phonepeEnabled",
         UPI_MANUAL_ENABLED: "payment.upiManualEnabled",
         COD_ENABLED: "payment.codEnabled",

package/dist/constants/notification-types.d.ts

@@ -12,7 +12,7 @@
  *    **18 of the 27 real types** and was offered two that never appear.
  *  · `AdminSiteSettingsView`'s per-channel allow-list, so an admin literally
  *    **could not allow-list `offer_received` or `payment_review`** for email
- *    or WhatsApp — the toggle did not exist.
+ *    — the toggle did not exist.
  *
  * Everything here now derives from `NOTIFICATION_TYPE_VALUES`, so a new
  * notification type is one edit and cannot be missing from either surface.

package/dist/constants/notification-types.js

@@ -12,7 +12,7 @@
  *    **18 of the 27 real types** and was offered two that never appear.
  *  · `AdminSiteSettingsView`'s per-channel allow-list, so an admin literally
  *    **could not allow-list `offer_received` or `payment_review`** for email
- *    or WhatsApp — the toggle did not exist.
+ *    — the toggle did not exist.
  *
  * Everything here now derives from `NOTIFICATION_TYPE_VALUES`, so a new
  * notification type is one edit and cannot be missing from either surface.

package/dist/core/integration-keys.d.ts

@@ -6,12 +6,12 @@ export interface ResolvedKeys {
     phonepeEnvironment: string;
     phonepeWebhookUsername: string;
     phonepeWebhookPassword: string;
+    /** Publishable key (`rzp_test_…` / `rzp_live_…`) — the one value here that is safe to hand the browser. */
+    razorpayKeyId: string;
+    razorpayKeySecret: string;
+    /** Webhook signing secret. Optional in practice: without it `verifyWebhook()` fails closed and the buyer-present /verify path still works. */
+    razorpayWebhookSecret: string;
     resendApiKey: string;
-    whatsappApiKey: string;
-    whatsappPhoneNumberId: string;
-    whatsappCloudApiToken: string;
-    /** Comma-separated digits-only numbers, e.g. "919876543210,918765432109" */
-    whatsappAdminNotifyNumbers: string;
 }
 /** Drops the in-process cache. Call this after admin saves new credentials. */
 export declare function invalidateIntegrationKeysCache(): void;

package/dist/core/integration-keys.js

@@ -28,14 +28,28 @@ const EMPTY_KEYS = {
     phonepeEnvironment: "",
     phonepeWebhookUsername: "",
     phonepeWebhookPassword: "",
+    razorpayKeyId: "",
+    razorpayKeySecret: "",
+    razorpayWebhookSecret: "",
     resendApiKey: "",
-    whatsappApiKey: "",
-    whatsappPhoneNumberId: "",
-    whatsappCloudApiToken: "",
-    whatsappAdminNotifyNumbers: "",
 };
 let _cache = null;
 const CACHE_TTL_MS = 60000; // 1 minute
+/**
+ * Treats a seeded `*_PLACEHOLDER` value as ABSENT so the env fallback wins.
+ *
+ * Most seeded credentials are the literal string `"…_PLACEHOLDER"`, which is
+ * truthy — so a plain `db.x || process.env.X` resolves to the placeholder and
+ * the real env var is never read. For a gateway that is worse than an empty
+ * value: the placeholder reaches Razorpay's API and produces an authentication
+ * failure mid-checkout rather than cleanly falling back. `resolveEmailProvider`
+ * is the reference for this test; see CLAUDE.md's siteSettings row.
+ */
+function usable(value) {
+    if (!value || value.includes("PLACEHOLDER"))
+        return "";
+    return value;
+}
 /** Drops the in-process cache. Call this after admin saves new credentials. */
 export function invalidateIntegrationKeysCache() {
     _cache = null;
@@ -55,6 +69,9 @@ export async function resolveKeys() {
         void normalizeError(_err); // Firestore unavailable — fall through to env-based defaults for backward compatibility
     }
     const value = {
+        razorpayKeyId: usable(db.razorpayKeyId) || process.env.RAZORPAY_KEY_ID || "",
+        razorpayKeySecret: usable(db.razorpayKeySecret) || process.env.RAZORPAY_KEY_SECRET || "",
+        razorpayWebhookSecret: usable(db.razorpayWebhookSecret) || process.env.RAZORPAY_WEBHOOK_SECRET || "",
         phonepeClientId: db.phonepeClientId || process.env.PHONEPE_CLIENT_ID || "",
         phonepeClientSecret: db.phonepeClientSecret || process.env.PHONEPE_CLIENT_SECRET || "",
         phonepeClientVersion: db.phonepeClientVersion || process.env.PHONEPE_CLIENT_VERSION || "1",
@@ -62,12 +79,6 @@ export async function resolveKeys() {
         phonepeWebhookUsername: db.phonepeWebhookUsername || process.env.PHONEPE_WEBHOOK_USERNAME || "",
         phonepeWebhookPassword: db.phonepeWebhookPassword || process.env.PHONEPE_WEBHOOK_PASSWORD || "",
         resendApiKey: db.resendApiKey || process.env.RESEND_API_KEY || "",
-        whatsappApiKey: db.whatsappApiKey || process.env.WHATSAPP_API_KEY || "",
-        whatsappPhoneNumberId: db.whatsappPhoneNumberId || process.env.WHATSAPP_PHONE_NUMBER_ID || "",
-        whatsappCloudApiToken: db.whatsappCloudApiToken || process.env.WHATSAPP_CLOUD_API_TOKEN || "",
-        whatsappAdminNotifyNumbers: db.whatsappAdminNotifyNumbers ||
-            process.env.WHATSAPP_ADMIN_NOTIFY_NUMBERS ||
-            "",
     };
     _cache = { value, expiresAt: Date.now() + CACHE_TTL_MS };
     return value;

package/dist/features/about/components/FeesView.js

@@ -65,12 +65,6 @@ export async function FeesView({} = {}) {
             who: t("paidByBuyer"),
             note: t("codHandlingFeeNote"),
         },
-        {
-            category: t("whatsappNotifyFeeTitle"),
-            rate: t("whatsappNotifyFeeRate"),
-            who: t("paidByBuyer"),
-            note: t("whatsappNotifyFeeNote"),
-        },
         {
             category: t("giftWrapFeeTitle"),
             rate: t("giftWrapFeeRate"),

package/dist/features/about/components/GuidesHubView.js

@@ -49,8 +49,21 @@ export async function GuidesHubView({} = {}) {
             blurb: t("groupSellingBlurb"),
             items: [
                 { href: String(ROUTES.PUBLIC.SELLER_GUIDE), label: t("sellerGuide"), text: t("sellerGuideText") },
-                { href: String(ROUTES.PUBLIC.SELLER_GUIDE_BUNDLES), label: t("bundleGuide"), text: t("bundleGuideText") },
-                { href: String(ROUTES.PUBLIC.SELLER_GUIDE_PRIZE_DRAWS), label: t("prizeDrawGuide"), text: t("prizeDrawGuideText") },
+                /*
+                 * 🛑 HIDDEN BLOCK — the bundle and prize-draw guides, withdrawn
+                 * 2026-10-20 alongside the footer entries for those listing types
+                 * (`HIDDEN_FOOTER_LINK_HREFS`, src/constants/navigation.tsx). A hub
+                 * card is a promise that the thing it describes is open for business;
+                 * teaching a seller to run a prize draw they cannot currently publish
+                 * is worse than saying nothing.
+                 *
+                 * The pages, the routes and the `guidesHub.bundleGuide*` /
+                 * `guidesHub.prizeDrawGuide*` message keys are all left in place, so
+                 * restoring this is uncommenting two lines.
+                 *
+                 * { href: String(ROUTES.PUBLIC.SELLER_GUIDE_BUNDLES), label: t("bundleGuide"), text: t("bundleGuideText") },
+                 * { href: String(ROUTES.PUBLIC.SELLER_GUIDE_PRIZE_DRAWS), label: t("prizeDrawGuide"), text: t("prizeDrawGuideText") },
+                 */
             ],
         },
     ];

package/dist/features/account/components/NotificationPreferencesPanel.js

@@ -30,7 +30,7 @@ export function NotificationPreferencesPanel({ fetchUrl = ACCOUNT_ENDPOINTS.NOTI
     const { showToast } = useToast();
     const { data: settings } = useSiteSettings();
     const adminChannels = settings?.notificationChannels;
-    const [channels, setChannels] = useState({ email: true, whatsapp: true, sms: true });
+    const [channels, setChannels] = useState({ email: true, sms: true });
     const [types, setTypes] = useState({
         orderUpdates: true, bids: true, promotions: true,
         system: true, reviews: true, messages: true, offers: true,
@@ -92,8 +92,7 @@ export function NotificationPreferencesPanel({ fetchUrl = ACCOUNT_ENDPOINTS.NOTI
     }
     // Which channels are admin-enabled (only show those toggles to the user)
     const emailAdminEnabled = adminChannels?.email?.enabled ?? false;
-    const whatsappAdminEnabled = adminChannels?.whatsapp?.enabled ?? false;
     const smsAdminEnabled = adminChannels?.sms?.enabled ?? false;
-    const anyChannelEnabled = emailAdminEnabled || whatsappAdminEnabled || smsAdminEnabled;
-    return (_jsxs(Stack, { gap: "lg", children: [_jsx(SectionCard, { title: "In-app notifications", children: _jsxs(Row, { align: "center", justify: "between", gap: "md", padding: "y-sm", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[var(--appkit-color-text)]", size: "sm", weight: "medium", children: "In-app notifications" }), _jsx(Text, { variant: "secondary", className: "mt-0.5", size: "xs", children: "Always on \u2014 displayed in the notification bell and inbox" })] }), _jsx(Row, { className: "h-5 w-9 bg-[var(--appkit-color-primary)] px-[0.125rem]", align: "center", justify: "end", rounded: "full", "aria-label": "Always on", children: _jsx(Span, { className: "h-4 w-4", rounded: "full", surface: "default", shadow: "default" }) })] }) }), anyChannelEnabled && (_jsxs(SectionCard, { title: "Notification channels", children: [emailAdminEnabled && (_jsx(ToggleRow, { label: "Email", description: "Receive notifications by email", checked: channels.email !== false, onChange: (v) => setChannel("email", v) })), whatsappAdminEnabled && (_jsx(ToggleRow, { label: "WhatsApp", description: "Receive notifications on WhatsApp", checked: channels.whatsapp !== false, onChange: (v) => setChannel("whatsapp", v) })), smsAdminEnabled && (_jsx(ToggleRow, { label: "SMS", description: "Receive SMS text notifications", checked: channels.sms !== false, onChange: (v) => setChannel("sms", v) }))] })), _jsx(SectionCard, { title: "Notification types", children: TYPE_ROWS.map((row) => (_jsx(ToggleRow, { label: row.label, description: row.description, checked: types[row.key] !== false, onChange: (v) => setType(row.key, v) }, row.key))) }), _jsxs(Row, { justify: "end", gap: "sm", children: [saved && (_jsx(Text, { className: "text-[var(--appkit-color-success)] self-center", size: "sm", children: "Preferences saved \u2713" })), _jsx(Button, { onClick: handleSave, isLoading: saving, size: "sm", children: "Save preferences" })] })] }));
+    const anyChannelEnabled = emailAdminEnabled || smsAdminEnabled;
+    return (_jsxs(Stack, { gap: "lg", children: [_jsx(SectionCard, { title: "In-app notifications", children: _jsxs(Row, { align: "center", justify: "between", gap: "md", padding: "y-sm", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[var(--appkit-color-text)]", size: "sm", weight: "medium", children: "In-app notifications" }), _jsx(Text, { variant: "secondary", className: "mt-0.5", size: "xs", children: "Always on \u2014 displayed in the notification bell and inbox" })] }), _jsx(Row, { className: "h-5 w-9 bg-[var(--appkit-color-primary)] px-[0.125rem]", align: "center", justify: "end", rounded: "full", "aria-label": "Always on", children: _jsx(Span, { className: "h-4 w-4", rounded: "full", surface: "default", shadow: "default" }) })] }) }), anyChannelEnabled && (_jsxs(SectionCard, { title: "Notification channels", children: [emailAdminEnabled && (_jsx(ToggleRow, { label: "Email", description: "Receive notifications by email", checked: channels.email !== false, onChange: (v) => setChannel("email", v) })), smsAdminEnabled && (_jsx(ToggleRow, { label: "SMS", description: "Receive SMS text notifications", checked: channels.sms !== false, onChange: (v) => setChannel("sms", v) }))] })), _jsx(SectionCard, { title: "Notification types", children: TYPE_ROWS.map((row) => (_jsx(ToggleRow, { label: row.label, description: row.description, checked: types[row.key] !== false, onChange: (v) => setType(row.key, v) }, row.key))) }), _jsxs(Row, { justify: "end", gap: "sm", children: [saved && (_jsx(Text, { className: "text-[var(--appkit-color-success)] self-center", size: "sm", children: "Preferences saved \u2713" })), _jsx(Button, { onClick: handleSave, isLoading: saving, size: "sm", children: "Save preferences" })] })] }));
 }

package/dist/features/account/components/UserOrdersView.js

@@ -11,7 +11,23 @@ import { OrderCard } from "../../orders/components/OrdersList.js";
 import { useOrderScope } from "../../orders/components/OrderScopeTabs.js";
 import { useSearchParams } from "next/navigation.js";
 const CANCELLABLE_STATUSES = new Set(["pending", "confirmed", "processing"]);
-const TRACKABLE_STATUSES = new Set(["shipped"]);
+/*
+ * 🛑 Every PRE-DELIVERY status, not just "shipped".
+ *
+ * It was `["shipped"]` alone, so a buyer whose order was pending, confirmed
+ * or processing had no "where is it" link at all — which is precisely when
+ * they most want one. The timeline on the track page reads correctly for all
+ * of these: it shows the stages reached and the stages still ahead.
+ *
+ * Delivered, cancelled, refunded and returned are excluded because tracking a
+ * finished order is the order detail page's job, not a courier's.
+ */
+const TRACKABLE_STATUSES = new Set([
+    "pending",
+    "confirmed",
+    "processing",
+    "shipped",
+]);
 const SORT_OPTIONS = [
     { value: sortBy("createdAt", "DESC"), label: "Newest first" },
     { value: sortBy("createdAt", "ASC"), label: "Oldest first" },
@@ -77,12 +93,15 @@ export function UserOrdersView({ onOrderClick }) {
         portal: "user",
         title: "My Orders",
         search: {
-            placeholder: "Search by order id…",
-            // `/api/user/orders` filters in memory on `o.id` and nothing else — not
-            // the product titles the rows display, which is what a buyer would try
-            // first. Saying "order id" is the honest promise until the route can
-            // match more.
-            fields: ["id"],
+            placeholder: "Search by item or order id…",
+            /*
+             * The route now matches product titles as well as the order id, so the
+             * placeholder can promise it. It said "order id" because that was all
+             * the route could do, with a comment calling that "the honest promise
+             * until the route can match more" — this is the promise catching up,
+             * not a widened claim.
+             */
+            fields: ["id", "productTitle"],
         },
         emptyLabel: emptyMessage,
         filterKeys: ["status", "orderType"],

package/dist/features/account/types/index.d.ts

@@ -75,8 +75,6 @@ export interface UserAddress {
 export interface NotificationChannelPrefs {
     /** Disable all email notifications for this user (default: true = enabled). */
     email?: boolean;
-    /** Disable all WhatsApp notifications for this user. */
-    whatsapp?: boolean;
     /** Disable all SMS notifications for this user. */
     sms?: boolean;
 }

package/dist/features/addresses/utils/postal-autofill.d.ts

@@ -0,0 +1,39 @@
+interface CityState {
+    city: string;
+    state: string;
+}
+/**
+ * What the last autofill wrote, so a later one can tell its own output apart
+ * from a human's typing. A field is absent when the helper declined to write
+ * it — which makes it the human's, and untouchable.
+ */
+export type PostalAutofillMemo = Partial<CityState>;
+/**
+ * Merge `resolved` into `prev`, returning the new values and an updated memo.
+ *
+ * ── 🛑 THE BUG THIS EXISTS TO FIX ─────────────────────────────────────────
+ *
+ * Both address forms used `prev.city.trim() ? prev.city : city` — fill only
+ * an EMPTY field. That intent is right and is preserved here: correcting an
+ * address someone deliberately typed is a bug they cannot report, because
+ * they watch their own input vanish with no idea what did it.
+ *
+ * But "empty" cannot tell WHO filled the field. After the first lookup the
+ * city is non-empty — written by the autofill itself — so every subsequent
+ * lookup is refused. Enter 413001, get Solapur/Maharashtra; correct the PIN
+ * to 500005 (Hyderabad) and the form still shows Solapur. The PIN and the
+ * city now disagree, the form validates, and the parcel ships to the wrong
+ * city — worse than never autofilling at all.
+ *
+ * ── The rule ──────────────────────────────────────────────────────────────
+ *
+ * A field is ours to overwrite when it is EMPTY, or when it still holds
+ * exactly what we last wrote into it. The moment a human edits it, it stops
+ * matching the memo and becomes untouchable again — the original guarantee,
+ * now actually enforceable rather than approximated by "is it blank".
+ */
+export declare function applyPostalAutofill<T extends CityState>(prev: T, resolved: Partial<CityState>, memo: PostalAutofillMemo): {
+    next: T;
+    memo: PostalAutofillMemo;
+};
+export {};

package/dist/features/addresses/utils/postal-autofill.js

@@ -0,0 +1,54 @@
+/*
+ * WHY: A postal lookup must fill the city/state it knows WITHOUT overwriting
+ *      what the person typed — and the obvious test for that ("is the field
+ *      empty?") silently breaks every lookup after the first.
+ * WHAT: `applyPostalAutofill` — merge a resolved city/state into form values,
+ *       overwriting only values this helper itself wrote earlier.
+ *
+ * EXPORTS: applyPostalAutofill, type PostalAutofillMemo
+ *
+ * @tag domain:addresses
+ * @tag layer:utils
+ * @tag pattern:pure
+ * @tag sideEffects:none
+ */
+/**
+ * Merge `resolved` into `prev`, returning the new values and an updated memo.
+ *
+ * ── 🛑 THE BUG THIS EXISTS TO FIX ─────────────────────────────────────────
+ *
+ * Both address forms used `prev.city.trim() ? prev.city : city` — fill only
+ * an EMPTY field. That intent is right and is preserved here: correcting an
+ * address someone deliberately typed is a bug they cannot report, because
+ * they watch their own input vanish with no idea what did it.
+ *
+ * But "empty" cannot tell WHO filled the field. After the first lookup the
+ * city is non-empty — written by the autofill itself — so every subsequent
+ * lookup is refused. Enter 413001, get Solapur/Maharashtra; correct the PIN
+ * to 500005 (Hyderabad) and the form still shows Solapur. The PIN and the
+ * city now disagree, the form validates, and the parcel ships to the wrong
+ * city — worse than never autofilling at all.
+ *
+ * ── The rule ──────────────────────────────────────────────────────────────
+ *
+ * A field is ours to overwrite when it is EMPTY, or when it still holds
+ * exactly what we last wrote into it. The moment a human edits it, it stops
+ * matching the memo and becomes untouchable again — the original guarantee,
+ * now actually enforceable rather than approximated by "is it blank".
+ */
+export function applyPostalAutofill(prev, resolved, memo) {
+    const nextMemo = {};
+    const merge = (field) => {
+        const current = prev[field];
+        const incoming = resolved[field];
+        const ours = current.trim() === "" || current === memo[field];
+        if (!ours || !incoming)
+            return current; // human's value, or nothing to say
+        nextMemo[field] = incoming;
+        return incoming;
+    };
+    return {
+        next: { ...prev, city: merge("city"), state: merge("state") },
+        memo: nextMemo,
+    };
+}

package/dist/features/admin/actions/notification-actions.d.ts

@@ -11,12 +11,8 @@ export declare function getUnreadNotificationCount(userId: string): Promise<numb
 export interface SendNotificationInput extends NotificationCreateInput {
     /** User's email — used by the email channel when enabled. */
     userEmail?: string;
-    /** User's phone with country code, digits only — used by WhatsApp channel. */
-    userPhone?: string;
     /** Pre-rendered email HTML — falls back to a plain-text <p> when absent. */
     emailHtml?: string;
-    /** Buyer paid the ₹10 WhatsApp order-updates addon — enables WhatsApp channel for this notification even when the user has no standing WhatsApp subscription. */
-    orderWhatsappAddonPaid?: boolean;
     /**
      * Which portal the recipient reads this in — decides where `actionUrl`
      * points when the caller does not supply one.
@@ -52,17 +48,15 @@ export interface SendNotificationInput extends NotificationCreateInput {
 export interface SendNotificationResult {
     notification: NotificationDocument;
     email: "sent" | "skipped" | "failed";
-    /** WhatsApp dispatch is now async (enqueued as a `whatsappNotify` job) — "queued" replaces "sent" as the immediate outcome; the real delivery result lands on `notification.whatsappStatus`. */
-    whatsapp: "queued" | "skipped" | "failed";
 }
 /**
  * Create an in-app notification and fan out to enabled external channels.
  *
- * In-app is always written.  Email / WhatsApp are sent only when:
+ * In-app is always written. Email is sent only when:
  *   1. The channel is enabled in siteSettings.notificationChannels
  *   2. Notification priority meets the channel's minPriority threshold
  *   3. The optional `types` filter includes this notification type (or is absent)
- *   4. The contact field (userEmail / userPhone) is supplied by the caller
+ *   4. The contact field (userEmail) is supplied by the caller
  *   5. The required credentials are set in siteSettings.credentials
  */
 export declare function sendNotification(input: SendNotificationInput): Promise<SendNotificationResult>;