@mohasinac/appkit 4.60.1 → 4.62.0

package/dist/errors/firestore-codes.js

@@ -0,0 +1,52 @@
+/**
+ * Firestore / gRPC error-code predicates, in one place.
+ *
+ * ## Why this file exists
+ *
+ * `isAlreadyExists` had been written THREE times — in the gateway-events,
+ * payment-cases and protection-claims repositories, two of them byte-identical
+ * — and each copy duck-typed the caught error the same way:
+ *
+ *     const code = (err as { code?: unknown }).code;
+ *
+ * That is past the Rule of Three, and `audit-unknown-leakage` was reporting all
+ * six of those field reads: casting to `{ code?: unknown }` narrows the OBJECT
+ * and leaves the FIELD unknown, so every comparison below it is unchecked.
+ * Naming the shape once gives the comparisons a real type and leaves one
+ * implementation to fix when the SDK changes what it throws.
+ *
+ * ## 🛑 Why three checks and not one
+ *
+ * The Admin SDK has surfaced this condition as a numeric gRPC code, as a string
+ * code, and as a bare message, depending on version and transport. All three
+ * are tested, and the message test is in ADDITION to the codes rather than
+ * instead of them — a stringly-typed guard alone is what breaks silently on an
+ * SDK bump, and the failure mode is a create that reports success while having
+ * collided.
+ */
+/** gRPC status 6. The numeric form, which is what the Admin SDK usually sets. */
+export const GRPC_ALREADY_EXISTS = 6;
+/** Narrow an unknown thrown value to the fields these predicates read. */
+function asFirestoreError(err) {
+    if (typeof err !== "object" || err === null)
+        return null;
+    return err;
+}
+/**
+ * Did Firestore refuse this write because the document already exists?
+ *
+ * The one question every `createWithId`-style insert needs answered, and the
+ * reason it matters is that "already there" is usually SUCCESS for an
+ * idempotent writer — a claim, a case or an inbox row that a retry re-sends.
+ * Treating it as a failure turns a safe retry into a 500.
+ */
+export function isAlreadyExistsError(err) {
+    const e = asFirestoreError(err);
+    if (!e)
+        return false;
+    if (e.code === GRPC_ALREADY_EXISTS)
+        return true;
+    if (e.code === "already-exists" || e.code === "ALREADY_EXISTS")
+        return true;
+    return typeof e.message === "string" && e.message.includes("ALREADY_EXISTS");
+}

package/dist/errors/index.d.ts

@@ -10,7 +10,6 @@ export { NotFoundError } from "./not-found-error";
 export { ConflictError } from "./conflict-error";
 export { DatabaseError } from "./database-error";
 export { PaymentProviderUnreachableError } from "./payment-provider-unreachable";
-export { handleApiError, logError, isAppError } from "./error-handler";
 export { mapToHttpError, HTTP_ERROR_CODES, type MappedError, type HttpErrorCode, } from "./error-mapping";
 export { ERROR_DISPLAY_MAP, getErrorDisplay, toUserMessage, GENERIC_USER_MESSAGE, type ErrorDisplayEntry, } from "./error-display-map";
 export { safeRead, installDegradedReadReporter, type DegradedReadReport, } from "./safe-read";

package/dist/errors/index.js

@@ -13,8 +13,18 @@ export { NotFoundError } from "./not-found-error.js";
 export { ConflictError } from "./conflict-error.js";
 export { DatabaseError } from "./database-error.js";
 export { PaymentProviderUnreachableError } from "./payment-provider-unreachable.js";
-// error-handler uses `next/server` — only import in server/API-route contexts
-export { handleApiError, logError, isAppError } from "./error-handler.js";
+/*
+ * 🛑 `error-handler` is deliberately NOT re-exported here. Import it from
+ * "./error-handler" directly.
+ *
+ * It does `import { NextResponse } from "next/server.js"`, and 83 files
+ * import THIS barrel — including repositories reachable from the Firebase
+ * Functions entry. So the barrel dragged Next's server runtime into the tsup
+ * bundle, which died on two unresolved `react-server-dom-webpack/*` requires
+ * and two `@vercel/og` .wasm files, naming none of the files responsible.
+ * The old line carried a comment saying "only import in server/API-route
+ * contexts" — a convention nothing could enforce. Root Cause #18.
+ */
 // Code→HTTP mapper (server) — and the i18n / inline-field map (client-safe)
 export { mapToHttpError, HTTP_ERROR_CODES, } from "./error-mapping.js";
 export { ERROR_DISPLAY_MAP, getErrorDisplay, toUserMessage, GENERIC_USER_MESSAGE, } from "./error-display-map.js";

package/dist/features/account/components/UserOffersPanel.js

@@ -1,11 +1,13 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useCallback, useEffect, useState, useTransition } from "react";
-import { Alert, Badge, Button, Div, Heading, LoginRequiredModal, Row, Spinner, Stack, Text } from "../../../ui/index.js";
+import { Alert, Badge, Button, Div, Heading, LoginRequiredModal, Row, Spinner, Stack, Text, TextLink } from "../../../ui/index.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { isAuthError } from "../../../utils/auth-error.js";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 const CLS_COUNTER_AMOUNT = "text-[length:var(--appkit-text-sm)] font-semibold text-info dark:text-info";
 function formatRupees(amount) {
     if (amount === undefined || amount === null)
@@ -60,7 +62,7 @@ function BuyerOfferCard({ offer, onAcceptCounter, onWithdraw, onCheckout, onUpda
             }
         });
     }
-    return (_jsxs(Stack, { surface: "card", padding: "sm", gap: "3", children: [_jsxs(Row, { align: "start", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Div, { className: "min-w-0", children: [_jsx(Text, { className: "truncate", color: "primary", size: "sm", weight: "semibold", children: offer.productTitle ?? "Unknown Product" }), _jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: relativeTime(offer.createdAt) })] }), _jsx(Badge, { variant: statusVariant(offer.status), size: "xs", className: "shrink-0 capitalize", children: offer.status })] }), _jsxs(Row, { wrap: true, gap: "md", children: [_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Listed" }), _jsx(Text, { size: "sm", weight: "medium", color: "muted", children: formatRupees(offer.listedPrice) })] }), _jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Your Offer" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: formatRupees(offer.offerAmount) })] }), offer.counterAmount != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Seller Counter" }), _jsx(Text, { className: CLS_COUNTER_AMOUNT, children: formatRupees(offer.counterAmount) })] })), offer.lockedPrice != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Agreed Price" }), _jsx(Text, { className: "text-success", size: "sm", weight: "semibold", children: formatRupees(offer.lockedPrice) })] }))] }), offer.sellerNote && (_jsxs(Text, { className: "italic", color: "muted", size: "xs", children: ["Seller note: \"", offer.sellerNote, "\""] })), offer.status === "countered" && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "text-info", size: "xs", weight: "medium", children: ["Seller countered at ", formatRupees(offer.counterAmount), ". Accept or withdraw your offer."] }), _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onAcceptCounter(offer.id), { status: "accepted", lockedPrice: offer.counterAmount }), disabled: isPending, children: isPending ? "Accepting…" : `Accept ${formatRupees(offer.counterAmount)}` }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20", children: "Withdraw" })] })] })), offer.status === "accepted" && onCheckout && (_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onCheckout(offer.id), { status: "paid" }), disabled: isPending, children: isPending ? "Processing…" : "Checkout at Agreed Price" })), offer.status === "pending" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20 text-[length:var(--appkit-text-xs)]", children: "Withdraw Offer" })), confirming === "withdraw" && (_jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: "ghost", onClick: () => act(() => onWithdraw(offer.id), { status: "withdrawn" }), disabled: isPending, className: "text-error border border-error/20", children: isPending ? "Withdrawing…" : "Confirm Withdraw" }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming(null), disabled: isPending, children: "Cancel" })] })), error && _jsx(Alert, { variant: "error", children: _jsx(Text, { size: "xs", children: error }) })] }));
+    return (_jsxs(Stack, { surface: "card", padding: "sm", gap: "3", children: [_jsxs(Row, { align: "start", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Div, { className: "min-w-0", children: [_jsx(TextLink, { href: String(ROUTES.PUBLIC.PRODUCT_DETAIL(offer.productSlug ?? offer.productId)), size: "sm", weight: "semibold", truncate: true, children: offer.productTitle ?? "Unknown Product" }), _jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: relativeTime(offer.createdAt) })] }), _jsx(Badge, { variant: statusVariant(offer.status), size: "xs", className: "shrink-0 capitalize", children: offer.status })] }), _jsxs(Row, { wrap: true, gap: "md", children: [_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Listed" }), _jsx(Text, { size: "sm", weight: "medium", color: "muted", children: formatRupees(offer.listedPrice) })] }), _jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Your Offer" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: formatRupees(offer.offerAmount) })] }), offer.counterAmount != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Seller Counter" }), _jsx(Text, { className: CLS_COUNTER_AMOUNT, children: formatRupees(offer.counterAmount) })] })), offer.lockedPrice != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Agreed Price" }), _jsx(Text, { className: "text-success", size: "sm", weight: "semibold", children: formatRupees(offer.lockedPrice) })] }))] }), offer.sellerNote && (_jsxs(Text, { className: "italic", color: "muted", size: "xs", children: ["Seller note: \"", offer.sellerNote, "\""] })), offer.status === "countered" && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "text-info", size: "xs", weight: "medium", children: ["Seller countered at ", formatRupees(offer.counterAmount), ". Accept or withdraw your offer."] }), _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onAcceptCounter(offer.id), { status: "accepted", lockedPrice: offer.counterAmount }), disabled: isPending, children: isPending ? "Accepting…" : `Accept ${formatRupees(offer.counterAmount)}` }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20", children: "Withdraw" })] })] })), offer.status === "accepted" && onCheckout && (_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onCheckout(offer.id), { status: "paid" }), disabled: isPending, children: isPending ? "Processing…" : "Checkout at Agreed Price" })), offer.status === "pending" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20 text-[length:var(--appkit-text-xs)]", children: "Withdraw Offer" })), confirming === "withdraw" && (_jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: "ghost", onClick: () => act(() => onWithdraw(offer.id), { status: "withdrawn" }), disabled: isPending, className: "text-error border border-error/20", children: isPending ? "Withdrawing…" : "Confirm Withdraw" }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming(null), disabled: isPending, children: "Cancel" })] })), error && _jsx(Alert, { variant: "error", children: _jsx(Text, { size: "xs", children: error }) })] }));
 }
 export function UserOffersPanel({ fetchEndpoint = ACCOUNT_ENDPOINTS.OFFERS, onAcceptCounter, onWithdraw, onCheckout, className = "", }) {
     const [offers, setOffers] = useState([]);
@@ -92,7 +94,7 @@ export function UserOffersPanel({ fetchEndpoint = ACCOUNT_ENDPOINTS.OFFERS, onAc
         }
         catch (err) {
             void normalizeError(err);
-            setFetchError(err instanceof Error ? err.message : "Failed to load offers.");
+            setFetchError(toUserMessage(err?.code, undefined, { fallback: "Failed to load offers." }));
         }
         finally {
             setLoading(false);

package/dist/features/admin/components/AdminActionIndexView.js

@@ -27,10 +27,12 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import React from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useApiMutation } from "@mohasinac/appkit/client";
-import { Alert, Badge, Row, Span, Stack, Text, Toggle, useToast } from "../../../ui/index.js";
+import { Alert, Badge, Row, Span, Stack, Text, TextLink, Toggle, useToast } from "../../../ui/index.js";
 import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { DataListingView } from "./DataListingView.js";
+import { QuickEditMenu } from "./QuickEditMenu.js";
+import { actionIndexOverrideSchema, splitKeywords, joinKeywords, ACTION_INDEX_OVERRIDE_FIELDS, } from "../schemas/action-index-form.js";
 const ENDPOINT = ADMIN_ENDPOINTS.ACTION_INDEX;
 export function AdminActionIndexView({ labels = {} }) {
     const queryClient = useQueryClient();
@@ -41,7 +43,12 @@ export function AdminActionIndexView({ labels = {} }) {
         staleTime: 60000,
     });
     const payload = query.data?.data;
-    const overrides = payload?.control?.entries ?? {};
+    /*
+     * Memoised because the `?? {}` fallback is a fresh object every render,
+     * which makes the `rows` memo below rebuild on every render — it reads
+     * `overrides` for each entry's effective `enabled`.
+     */
+    const overrides = React.useMemo(() => payload?.control?.entries ?? {}, [payload?.control?.entries]);
     const toggleMutation = useApiMutation({
         errorMessage: "Could not update that entry.",
         mutationFn: async (vars) => apiClient.patch(ENDPOINT, {
@@ -53,6 +60,44 @@ export function AdminActionIndexView({ labels = {} }) {
             void queryClient.invalidateQueries({ queryKey: ["admin", "action-index"] });
         },
     });
+    /*
+     * Spread the EXISTING override first, exactly as the toggle does. The
+     * endpoint's `setOverride` replaces the whole override object, so sending
+     * only the edited fields would silently clear this entry's `enabled` —
+     * re-showing something an admin had deliberately hidden.
+     */
+    const overrideMutation = useApiMutation({
+        errorMessage: "Could not save that entry.",
+        mutationFn: async (vars) => {
+            const parsed = actionIndexOverrideSchema.parse(vars.values);
+            return apiClient.patch(ENDPOINT, {
+                entryId: vars.entryId,
+                override: {
+                    ...overrides[vars.entryId],
+                    label: parsed.label,
+                    description: parsed.description,
+                    keywords: splitKeywords(parsed.keywords),
+                    weight: parsed.weight,
+                },
+            });
+        },
+        onSuccess: () => {
+            showToast("Entry saved.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "action-index"] });
+        },
+    });
+    /** Named so the row-action array stays a flat list of declarations. */
+    const saveOverride = React.useCallback(async (entryId, values) => {
+        await overrideMutation.mutateAsync({ entryId, values });
+    }, [overrideMutation]);
+    const clearMutation = useApiMutation({
+        errorMessage: "Could not reset that entry.",
+        mutationFn: async (entryId) => apiClient.patch(ENDPOINT, { entryId, clear: true }),
+        onSuccess: () => {
+            showToast("Entry reset to its code default.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "action-index"] });
+        },
+    });
     /*
      * Ordered by weight, then label — the same ranking `matchesNavQuery` gives
      * the search, so the admin reading this list sees entries in the order a
@@ -69,6 +114,10 @@ export function AdminActionIndexView({ labels = {} }) {
         href: `${entry.href}${entry.deepLink ?? ""}`,
         permission: entry.requiredPermission ?? "—",
         enabled: overrides[entry.id]?.enabled !== false,
+        // Seeds the edit drawer. `entry.*` is already override-merged by
+        // `mergeActionIndex`, so these are the effective values an admin sees.
+        keywords: joinKeywords(entry.keywords),
+        weight: entry.weight ?? 0,
     })), [payload?.entries, overrides]);
     const sync = payload?.sync;
     return (_jsxs(Stack, { gap: "md", children: [sync && sync.orphanedOverrides.length > 0 && (_jsxs(Alert, { variant: "warning", title: "Overrides with no entry", children: [sync.orphanedOverrides.length, " saved override", sync.orphanedOverrides.length === 1 ? "" : "s", " point at entries the code no longer has (", sync.orphanedOverrides.slice(0, 4).join(", "), sync.orphanedOverrides.length > 4 ? "…" : "", "). They are ignored \u2014 clear them when convenient."] })), _jsx(DataListingView, { config: {
@@ -109,9 +158,19 @@ export function AdminActionIndexView({ labels = {} }) {
                         },
                         { key: "portal", header: "Portal" },
                         {
+                            /*
+                             * A LINK, not mono text.
+                             *
+                             * This row IS a destination — "where is it" is half of what
+                             * this screen exists to answer, and the answer was printed as
+                             * inert text beside a toggle. The link is also what makes the
+                             * row reachable at all: every other column is metadata about
+                             * the entry, so without it there is no way to go look at the
+                             * thing being enabled or disabled.
+                             */
                             key: "href",
                             header: "Goes to",
-                            render: (row) => (_jsx(Span, { size: "xs", family: "mono", color: "muted", children: row.href })),
+                            render: (row) => (_jsx(TextLink, { href: row.href, size: "xs", onClick: (e) => e.stopPropagation(), children: _jsx(Span, { size: "xs", family: "mono", children: row.href }) })),
                         },
                         {
                             key: "permission",
@@ -121,8 +180,44 @@ export function AdminActionIndexView({ labels = {} }) {
                         {
                             key: "enabled",
                             header: "Shown",
-                            render: (row) => (_jsx(Row, { align: "center", gap: "sm", children: _jsx(Toggle, { checked: row.enabled, size: "sm", "aria-label": `Show ${row.primary}`, onChange: (next) => toggleMutation.mutate({ entryId: row.id, enabled: next }) }) })),
+                            render: (row) => (_jsx(Row, { align: "center", gap: "sm", children: _jsx(Toggle, { checked: row.enabled, size: "sm", ariaLabel: `Show ${row.primary} in navigation and search`, onChange: (next) => toggleMutation.mutate({ entryId: row.id, enabled: next }) }) })),
                         },
                     ],
-                } }), _jsx(Text, { size: "xs", color: "muted", children: "Hiding an entry removes it from the sidebar, the header search and the command palette at once. Labels, descriptions and keywords can be edited here; a route and its required permission belong to the code." })] }));
+                    /*
+                     * 🛑 This exists because the footer below already PROMISED it:
+                     * "Labels, descriptions and keywords can be edited here." They
+                     * could not. `PATCH /api/admin/action-index` has always accepted
+                     * `label` / `description` / `keywords` / `weight` in an override
+                     * (see `ActionIndexOverride`), and the only control on this screen
+                     * was the Shown toggle — so the sentence described a capability the
+                     * server had and the UI had never grown. Root Cause #51's shape: a
+                     * label describing something other than what the surface does.
+                     *
+                     * `href`, `kind` and every permission field stay out, per the
+                     * component docstring: repointing a built-in route is routing, and
+                     * relaxing a permission is access control.
+                     */
+                    renderRowActions: (row) => (_jsx(QuickEditMenu, { actions: [
+                            {
+                                label: "Edit entry",
+                                formTitle: `Edit "${row.primary}"`,
+                                schema: actionIndexOverrideSchema,
+                                fields: ACTION_INDEX_OVERRIDE_FIELDS,
+                                defaultValues: {
+                                    label: row.primary,
+                                    description: row.secondary,
+                                    keywords: row.keywords,
+                                    weight: row.weight,
+                                },
+                                onSubmit: (values) => saveOverride(row.id, values),
+                                submitLabel: "Save entry",
+                            },
+                            {
+                                label: "Reset to code default",
+                                separator: true,
+                                destructive: true,
+                                onClick: () => clearMutation.mutate(row.id),
+                            },
+                        ] })),
+                } }), _jsx(Text, { size: "xs", color: "muted", children: "Hiding an entry removes it from the sidebar, the header search and the command palette at once. Use the row menu to edit an entry\u2019s label, description, keywords and search weight, or to reset it to its code default; a route and its required permission belong to the code." })] }));
 }

package/dist/features/admin/components/AdminAddressClustersView.js

@@ -2,7 +2,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useQuery } from "@tanstack/react-query";
 import { useQueryClient } from "@tanstack/react-query";
-import { Badge, Button, Div, Heading, Row, Span, Stack, Text, useToast } from "../../../ui/index.js";
+import { Badge, Button, Div, Heading, Row, Span, Stack, Text, TextLink, useToast } from "../../../ui/index.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { apiClient } from "../../../http/index.js";
 import { useApiMutation } from "@mohasinac/appkit/client";
@@ -31,6 +32,24 @@ export function AdminAddressClustersView(_props) {
             void queryClient.invalidateQueries({ queryKey: ["admin", "address-clusters"] });
         },
     });
+    /*
+     * 🛑 "Flag Suspicious" was ONE-WAY: there was no unflag, so a wrong call —
+     * or a cluster that turned out to be a family sharing an address — left a
+     * permanent mark with no way back from this screen.
+     *
+     * `clear_ban` has existed on the route the whole time and calls
+     * `clearBanById`; only the control was missing.
+     */
+    const clearFlagMutation = useApiMutation({
+        errorMessage: "Failed to clear that flag.",
+        mutationFn: async (id) => {
+            await apiClient.patch(ADMIN_ENDPOINTS.ADDRESS_BY_ID(id), { action: "clear_ban" });
+        },
+        onSuccess: () => {
+            showToast("Flag cleared.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "address-clusters"] });
+        },
+    });
     const clusters = data?.clusters ?? [];
-    return (_jsxs(Stack, { gap: "lg", padding: "page", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", color: "primary", children: "Address Clusters" }), _jsx(Text, { size: "sm", color: "muted", className: "mt-1", children: "Users sharing the same physical address. Flagging is informational only \u2014 users are not blocked." })] }), isLoading && (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), error && (_jsx(Div, { surface: "danger-surface", color: "error", padding: "inline", rounded: "xl", textSize: "sm", children: "Failed to load clusters." })), !isLoading && clusters.length === 0 && (_jsx(Div, { surface: "muted", padding: "y-4xl", rounded: "xl", className: "text-center", children: _jsx(Text, { color: "muted", size: "sm", children: "No shared addresses found." }) })), clusters.map((cluster) => (_jsxs(Stack, { surface: "card", padding: "md", gap: "md", rounded: "xl", border: "default", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Text, { size: "xs", color: "muted", weight: "medium", children: "Hash" }), _jsx(Span, { size: "xs", color: "muted", className: "font-mono truncate max-w-xs", children: cluster.addressHash })] }), _jsxs(Badge, { variant: "secondary", size: "sm", children: [cluster.addresses.length, " accounts"] })] }), _jsx(Stack, { gap: "xs", children: cluster.addresses.map((addr) => (_jsxs(Row, { justify: "between", align: "center", gap: "sm", surface: "muted", padding: "inlineSm", rounded: "lg", children: [_jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsxs(Text, { size: "sm", weight: "medium", color: "primary", className: "truncate", children: [addr.ownerType === "user" ? "User" : "Store", ": ", addr.ownerId] }), addr.city && (_jsx(Text, { size: "xs", color: "muted", children: [addr.city, addr.state, addr.postalCode].filter(Boolean).join(", ") }))] }), _jsxs(Row, { gap: "xs", align: "center", children: [addr.banStatus && (_jsx(Badge, { variant: BAN_BADGE[addr.banStatus] ?? "secondary", size: "sm", children: addr.banStatus.replace(/_/g, " ") })), addr.banStatus !== "suspicious" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => flagMutation.mutate(addr.id), disabled: flagMutation.isPending, children: "Flag Suspicious" }))] })] }, addr.id))) })] }, cluster.addressHash)))] }));
+    return (_jsxs(Stack, { gap: "lg", padding: "page", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", color: "primary", children: "Address Clusters" }), _jsx(Text, { size: "sm", color: "muted", className: "mt-1", children: "Users sharing the same physical address. Flagging is informational only \u2014 users are not blocked." })] }), isLoading && (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), error && (_jsx(Div, { surface: "danger-surface", color: "error", padding: "inline", rounded: "xl", textSize: "sm", children: "Failed to load clusters." })), !isLoading && clusters.length === 0 && (_jsx(Div, { surface: "muted", padding: "y-4xl", rounded: "xl", className: "text-center", children: _jsx(Text, { color: "muted", size: "sm", children: "No shared addresses found." }) })), clusters.map((cluster) => (_jsxs(Stack, { surface: "card", padding: "md", gap: "md", rounded: "xl", border: "default", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Text, { size: "xs", color: "muted", weight: "medium", children: "Hash" }), _jsx(Span, { size: "xs", color: "muted", className: "font-mono truncate max-w-xs", children: cluster.addressHash })] }), _jsxs(Badge, { variant: "secondary", size: "sm", children: [cluster.addresses.length, " accounts"] })] }), _jsx(Stack, { gap: "xs", children: cluster.addresses.map((addr) => (_jsxs(Row, { justify: "between", align: "center", gap: "sm", surface: "muted", padding: "inlineSm", rounded: "lg", children: [_jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsxs(TextLink, { href: addr.ownerType === "user" ? String(ROUTES.ADMIN.USER_DETAIL(addr.ownerId)) : String(ROUTES.ADMIN.STORE_DETAIL(addr.ownerId)), size: "sm", weight: "medium", truncate: true, children: [addr.ownerType === "user" ? "User" : "Store", ": ", addr.ownerId] }), addr.city && (_jsx(Text, { size: "xs", color: "muted", children: [addr.city, addr.state, addr.postalCode].filter(Boolean).join(", ") }))] }), _jsxs(Row, { gap: "xs", align: "center", children: [addr.banStatus && (_jsx(Badge, { variant: BAN_BADGE[addr.banStatus] ?? "secondary", size: "sm", children: addr.banStatus.replace(/_/g, " ") })), addr.banStatus === "suspicious" ? (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => clearFlagMutation.mutate(addr.id), disabled: clearFlagMutation.isPending, children: "Clear flag" })) : (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => flagMutation.mutate(addr.id), disabled: flagMutation.isPending, children: "Flag Suspicious" }))] })] }, addr.id))) })] }, cluster.addressHash)))] }));
 }

package/dist/features/admin/components/AdminBlogEditorView.js

@@ -201,13 +201,13 @@ export function AdminBlogEditorView({ postId, onSaved, onDeleted, embedded, ...r
             required: true,
             quick: true,
             fields: ["title", "slug", "excerpt", "content"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Content" }), _jsx(Input, { label: "Title", value: values.title, onChange: (e) => {
+            render: ({ values, onChange, errors }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Content" }), _jsx(Input, { label: "Title", error: errors.title, value: values.title, onChange: (e) => {
                             const v = e.target.value;
                             onChange({ title: v, ...(!slugManual && { slug: toSlug(v) }) });
-                        }, placeholder: "e.g. How to Grade Pok\u00E9mon Cards" }), _jsx(Input, { label: "Slug", value: values.slug, onChange: (e) => {
+                        }, placeholder: "e.g. How to Grade Pok\u00E9mon Cards" }), _jsx(Input, { label: "Slug", error: errors.slug, value: values.slug, onChange: (e) => {
                             setSlugManual(true);
                             onChange({ slug: e.target.value });
-                        }, placeholder: "blog-how-to-grade-pokemon-cards", helperText: "Auto-generated from title. Must start with 'blog-'." }), _jsx(Input, { label: "Excerpt", value: values.excerpt, onChange: (e) => onChange({ excerpt: e.target.value }), placeholder: "Short summary shown in listings and cards" }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Content" }), _jsx(RichTextEditor, { ariaLabel: "Content", value: values.content, onChange: (v) => onChange({ content: v }), placeholder: "Write your article here...", minHeightClassName: "min-h-[320px]" })] })] })),
+                        }, placeholder: "blog-how-to-grade-pokemon-cards", helperText: "Auto-generated from title. Must start with 'blog-'." }), _jsx(Input, { label: "Excerpt", error: errors.excerpt, value: values.excerpt, onChange: (e) => onChange({ excerpt: e.target.value }), placeholder: "Short summary shown in listings and cards" }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Content" }), _jsx(RichTextEditor, { ariaLabel: "Content", value: values.content, onChange: (v) => onChange({ content: v }), placeholder: "Write your article here...", minHeightClassName: "min-h-[320px]" })] })] })),
         },
         {
             id: "media",
@@ -216,20 +216,20 @@ export function AdminBlogEditorView({ postId, onSaved, onDeleted, embedded, ...r
             // its children, which would abort an in-flight upload.
             keepMounted: true,
             fields: ["coverImage", "youtubeId"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Media" }), _jsx(ImageUpload, { label: "Cover Image", currentImage: values.coverImage, onUpload: (file) => upload(file, "blog", true, {
+            render: ({ values, onChange, errors }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Media" }), _jsx(ImageUpload, { label: "Cover Image", currentImage: values.coverImage, onUpload: (file) => upload(file, "blog", true, {
                             type: "blog-cover",
                             title: values.title || values.slug,
                             category: values.category,
-                        }), onChange: (url) => onChange({ coverImage: url }) }), _jsx(Input, { label: "YouTube Video ID (optional)", value: values.youtubeId, onChange: (e) => onChange({ youtubeId: e.target.value }), placeholder: "e.g. dQw4w9WgXcQ", helperText: "The 11-character video ID from the YouTube URL." })] })),
+                        }), onChange: (url) => onChange({ coverImage: url }) }), _jsx(Input, { label: "YouTube Video ID (optional)", error: errors.youtubeId, value: values.youtubeId, onChange: (e) => onChange({ youtubeId: e.target.value }), placeholder: "e.g. dQw4w9WgXcQ", helperText: "The 11-character video ID from the YouTube URL." })] })),
         },
         {
             id: "seo",
             label: "SEO & Tags",
             quick: true,
             fields: ["category", "tags", "metaTitle", "metaDescription"],
-            render: ({ values, onChange }) => {
+            render: ({ values, onChange, errors }) => {
                 const readTime = Math.max(1, Math.round(values.content.replace(/<[^>]*>/g, "").split(/\s+/).filter(Boolean).length / 200));
-                return (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "SEO & Tags" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Category", options: CATEGORY_OPTIONS, value: values.category, onValueChange: (v) => onChange({ category: v }) }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-1.5", size: "sm", weight: "medium", children: "Estimated Read Time" }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["~", readTime, " min (auto-calculated from content)"] })] })] }), _jsx(TagInput, { label: "Tags", value: values.tags, onChange: (t) => onChange({ tags: t }), placeholder: "e.g. pokemon, grading, tcg" }), _jsx(Input, { label: "Meta Title (optional)", value: values.metaTitle, onChange: (e) => onChange({ metaTitle: e.target.value }), placeholder: "Defaults to post title" }), _jsx(Input, { label: "Meta Description (optional)", value: values.metaDescription, onChange: (e) => onChange({ metaDescription: e.target.value }), placeholder: "SEO description \u2014 max 160 chars", maxLength: 160 })] }));
+                return (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "SEO & Tags" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Category", error: errors.category, options: CATEGORY_OPTIONS, value: values.category, onValueChange: (v) => onChange({ category: v }) }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-1.5", size: "sm", weight: "medium", children: "Estimated Read Time" }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["~", readTime, " min (auto-calculated from content)"] })] })] }), _jsx(TagInput, { label: "Tags", error: errors.tags, value: values.tags, onChange: (t) => onChange({ tags: t }), placeholder: "e.g. pokemon, grading, tcg" }), _jsx(Input, { label: "Meta Title (optional)", error: errors.metaTitle, value: values.metaTitle, onChange: (e) => onChange({ metaTitle: e.target.value }), placeholder: "Defaults to post title" }), _jsx(Input, { label: "Meta Description (optional)", error: errors.metaDescription, value: values.metaDescription, onChange: (e) => onChange({ metaDescription: e.target.value }), placeholder: "SEO description \u2014 max 160 chars", maxLength: 160 })] }));
             },
         },
         {
@@ -237,7 +237,7 @@ export function AdminBlogEditorView({ postId, onSaved, onDeleted, embedded, ...r
             label: "Publish",
             quick: true,
             fields: ["status", "publishedAt", "authorName", "isFeatured"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Publish Settings" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Status", options: STATUS_OPTIONS, value: values.status, onValueChange: (v) => onChange({ status: v }) }), _jsx(Input, { label: "Publish date (optional)", value: values.publishedAt, onChange: (e) => onChange({ publishedAt: e.target.value }), type: "date", helperText: "Auto-set to now when publishing." })] }), _jsx(Input, { label: "Author Name", value: values.authorName, onChange: (e) => onChange({ authorName: e.target.value }), placeholder: "Author display name" }), _jsx(Toggle, { label: "Featured post", checked: values.isFeatured, onChange: (checked) => onChange({ isFeatured: checked }) }), isEdit && (_jsx(Div, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", children: _jsx(Button, { type: "button", variant: "danger", size: "sm", onClick: () => setShowDeleteConfirm(true), isLoading: deleteMutation.isPending, children: "Delete post" }) }))] })),
+            render: ({ values, onChange, errors }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Publish Settings" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Status", error: errors.status, options: STATUS_OPTIONS, value: values.status, onValueChange: (v) => onChange({ status: v }) }), _jsx(Input, { label: "Publish date (optional)", error: errors.publishedAt, value: values.publishedAt, onChange: (e) => onChange({ publishedAt: e.target.value }), type: "date", helperText: "Auto-set to now when publishing." })] }), _jsx(Input, { label: "Author Name", error: errors.authorName, value: values.authorName, onChange: (e) => onChange({ authorName: e.target.value }), placeholder: "Author display name" }), _jsx(Toggle, { label: "Featured post", checked: values.isFeatured, onChange: (checked) => onChange({ isFeatured: checked }) }), isEdit && (_jsx(Div, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", children: _jsx(Button, { type: "button", variant: "danger", size: "sm", onClick: () => setShowDeleteConfirm(true), isLoading: deleteMutation.isPending, children: "Delete post" }) }))] })),
         },
     ];
     const deleteModal = (_jsx(ConfirmDeleteModal, { isOpen: showDeleteConfirm, onConfirm: () => {

package/dist/features/admin/components/AdminCarouselEditorView.js

@@ -224,7 +224,7 @@ export function AdminCarouselEditorView({ slideId, onSaved, onDeleted, onCancel,
             label: "Slide info",
             required: true,
             fields: ["title", "active", "order", "settings"],
-            render: () => (_jsxs(Stack, { gap: "md", children: [_jsx(FieldInput, { name: "title", label: "Title", value: title, onChange: (v) => setTitle(v), required: true, placeholder: "e.g. Hot Wheels RLC Exclusives" }), _jsx(Toggle, { label: "Active (visible on homepage)", checked: active, onChange: setActive }), _jsx(Input, { label: "Display order", type: "number", value: order, onChange: (e) => setOrder(e.target.value), min: 0, placeholder: "1" }), _jsx(Select, { label: "Slide height", value: height, onChange: (e) => setHeight(e.target.value), options: HEIGHT_OPTIONS }), _jsx(Input, { label: "Autoplay delay (ms)", type: "number", value: autoplayDelayMs, onChange: (e) => setAutoplayDelayMs(e.target.value), min: 1000, max: 15000, placeholder: "4000", helperText: "How long this slide shows before auto-advancing. Default: 4000 ms." })] })),
+            render: () => (_jsxs(Stack, { gap: "md", children: [_jsx(FieldInput, { name: "title", label: "Title", value: title, onChange: (v) => setTitle(v), required: true, placeholder: "e.g. Hot Wheels RLC Exclusives" }), _jsx(Toggle, { label: "Active (visible on homepage)", checked: active, onChange: setActive }), _jsx(Input, { label: "Display order", error: form.shellCtx.errors.order, type: "number", value: order, onChange: (e) => setOrder(e.target.value), min: 0, placeholder: "1" }), _jsx(Select, { label: "Slide height", value: height, onChange: (e) => setHeight(e.target.value), options: HEIGHT_OPTIONS }), _jsx(Input, { label: "Autoplay delay (ms)", type: "number", value: autoplayDelayMs, onChange: (e) => setAutoplayDelayMs(e.target.value), min: 1000, max: 15000, placeholder: "4000", helperText: "How long this slide shows before auto-advancing. Default: 4000 ms." })] })),
         },
         {
             id: "background",

package/dist/features/admin/components/AdminCarouselView.js

@@ -2,8 +2,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useApiMutation } from "@mohasinac/appkit/client";
 import React, { useState, useCallback } from "react";
+import { useRouter } from "next/navigation.js";
 import { useQueryClient } from "@tanstack/react-query";
-import { Badge, BulkActionBar, Button, ConfirmDeleteModal, Div, ListingFilterDrawer, ListingLayout, ListingToolbar, Pagination, Row, Span, Stack, Text, StickyToolbar } from "../../../ui/index.js";
+import { Badge, BulkActionBar, Button, ConfirmDeleteModal, Div, ListingFilterDrawer, ListingLayout, ListingToolbar, Pagination, Row, Span, Stack, Text, TextLink, StickyToolbar, Toggle, useToast } from "../../../ui/index.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { useBottomActions } from "../../layout/index.js";
 import { MediaImage } from "../../media/MediaImage.js";
 import { ADMIN_ENDPOINTS, HOMEPAGE_ENDPOINTS } from "../../../constants/api-endpoints.js";
@@ -14,6 +16,8 @@ import { useAdminListing } from "../hooks/useAdminListing.js";
 import { DataTable } from "./DataTable.js";
 import { RowActionMenu } from "../../../ui/components/RowActionMenu.js";
 import { apiClient } from "../../../http/index.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 const PAGE_SIZE = 50;
 const FILTER_KEYS = ["active"];
 const DEFAULT_SORT = "order";
@@ -33,6 +37,8 @@ export function AdminCarouselView({ children, onBulkDelete, ...props }) {
     const [deleteTargetId, setDeleteTargetId] = useState(null);
     const [localRows, setLocalRows] = useState([]);
     const queryClient = useQueryClient();
+    const router = useRouter();
+    const { showToast } = useToast();
     const { view, setView, table, searchInput, setSearchInput, commitSearch, filterOpen, setFilterOpen, openFilters, applyFilters, clearFilters, pendingFilters, setPendingFilters, activeFilterCount, hasActiveState, resetAll, rows: fetchedRows, isLoading, errorMessage, currentPage, totalPages, selection, } = useAdminListing({
         filterKeys: FILTER_KEYS,
         defaultSort: DEFAULT_SORT,
@@ -111,8 +117,58 @@ export function AdminCarouselView({ children, onBulkDelete, ...props }) {
         setDraggingId(null);
         reorderMutation.mutate(next.map((r) => r.id));
     };
+    const setActiveMutation = useApiMutation({
+        errorMessage: "Could not change that slide's status.",
+        mutationFn: ({ id, active }) => 
+        // PUT, not PATCH: this route has no PATCH, and every field on
+        // `updateSlideSchema` is optional, so a lone `{ active }` is a valid
+        // partial update.
+        apiClient.put(ADMIN_ENDPOINTS.CAROUSEL_BY_ID(id), { active }),
+        onSuccess: () => {
+            queryClient.invalidateQueries({ queryKey: ["admin", "carousel", "listing"] });
+            // The public hero carousel reads under its own key.
+            queryClient.invalidateQueries({ queryKey: ["carousel"] });
+        },
+    });
+    /*
+     * 🛑 The bulk delete used to be gated entirely on an `onBulkDelete` PROP —
+     * and the page renders `<AdminCarouselView />` with no props at all. So
+     * `bulkActions` was always `[]`, the BulkActionBar never rendered, and
+     * DataTable was handed no selection props either, which meant no checkbox
+     * column existed to select with in the first place.
+     * `ACTIONS.ADMIN["delete-carousel"]` and its confirmation dialog were
+     * unreachable from this page.
+     *
+     * The prop is kept so an embedder can still override the behaviour, but it
+     * no longer decides whether the action EXISTS — this view owns a delete
+     * mutation already and can perfectly well call it N times.
+     */
+    const handleBulkDelete = useCallback(async () => {
+        const ids = selection.selectedIds;
+        try {
+            if (onBulkDelete) {
+                await onBulkDelete(ids);
+            }
+            else {
+                await Promise.all(ids.map((id) => apiClient.delete(ADMIN_ENDPOINTS.CAROUSEL_BY_ID(id))));
+                await queryClient.invalidateQueries({ queryKey: ["admin", "carousel", "listing"] });
+            }
+            selection.clearSelection();
+            showToast(`${ids.length} slide${ids.length === 1 ? "" : "s"} deleted.`, "success");
+        }
+        catch (err) {
+            const normalized = normalizeError(err);
+            /*
+             * The selection is deliberately NOT cleared on failure. `Promise.all`
+             * rejects on the first error, so some of these ids may be gone and
+             * some may not — clearing would hide which rows are still there and
+             * leave the admin no way to retry the remainder.
+             */
+            showToast(toUserMessage(normalized.code, undefined, { fallback: "Could not delete the selected slides." }), "error");
+        }
+    }, [onBulkDelete, selection, queryClient, showToast]);
     const bulkActions = [
-        ...(onBulkDelete ? [buildBulkAction(ACTIONS.ADMIN["delete-carousel"], async () => { await onBulkDelete(selection.selectedIds); selection.clearSelection(); })] : []),
+        buildBulkAction(ACTIONS.ADMIN["delete-carousel"], handleBulkDelete),
     ];
     useBottomActions(selection.selectedCount > 0 ? { bulk: { selectedCount: selection.selectedCount, onClearSelection: selection.clearSelection, actions: bulkActions } } : {});
     if (hasChildren) {
@@ -138,6 +194,24 @@ export function AdminCarouselView({ children, onBulkDelete, ...props }) {
             header: "Details",
             render: (row) => row.secondary,
         },
+        {
+            /*
+             * 🛑 Both preventDefault AND stopPropagation.
+             *
+             * `rowHrefTemplate` makes the whole row an anchor, so stopping
+             * propagation alone leaves the anchor's DEFAULT action intact — the
+             * toggle would flip and then navigate to the edit page, which reads as
+             * "clicking the switch opens the editor". A normal column cell is also
+             * outside the two `<Td>`s DataTable stops propagation on; only the
+             * selection and row-action cells get that for free.
+             */
+            key: "active",
+            header: "Active",
+            className: "w-24",
+            render: (row) => (_jsx(Row, { align: "center", gap: "sm", role: "presentation", onClick: (e) => { e.preventDefault(); e.stopPropagation(); }, onKeyDown: (e) => e.stopPropagation(), children: _jsx(Toggle, { size: "sm", checked: row.status === "Active", ariaLabel: row.status === "Active"
+                        ? `${ACTIONS.ADMIN["deactivate-carousel"].ariaLabel}: ${row.primary}`
+                        : `${ACTIONS.ADMIN["activate-carousel"].ariaLabel}: ${row.primary}`, onChange: (next) => setActiveMutation.mutate({ id: row.id, active: next }) }) })),
+        },
         {
             key: "status",
             header: "Status",
@@ -152,7 +226,10 @@ export function AdminCarouselView({ children, onBulkDelete, ...props }) {
             key: "actions",
             header: "",
             render: (row) => (_jsx(RowActionMenu, { actions: [
-                    { label: ACTIONS.ADMIN["edit-carousel"].label, onClick: () => { window.location.href = `/admin/carousel/${row.id}/edit`; } },
+                    // router.push, not window.location.href — a full page load to
+                    // reach a page the row already links to is strictly worse, and
+                    // this is the same navigation DataTable's row anchor performs.
+                    { label: ACTIONS.ADMIN["edit-carousel"].label, onClick: () => router.push(String(ROUTES.ADMIN.CAROUSEL_EDIT(row.id))) },
                     {
                         label: ACTIONS.ADMIN["delete-carousel"].label,
                         destructive: true,
@@ -163,5 +240,20 @@ export function AdminCarouselView({ children, onBulkDelete, ...props }) {
     ];
     return (_jsxs(Div, { className: "min-h-screen", children: [_jsx(ListingToolbar, { filterCount: activeFilterCount, onFiltersClick: openFilters, searchValue: searchInput, 
                 // Search intentionally absent: this endpoint does not read `q`, so the box accepted typing and changed nothing. Restore it when the collection gains searchTxt — audit-listing-search-capability tracks it.
-                onSearchChange: setSearchInput, onSearchCommit: commitSearch, showTableView: true, view: view, onViewChange: (v) => setView(v), onResetAll: resetAll, hasActiveState: hasActiveState }), totalPages > 1 && (_jsx(StickyToolbar, { offset: "header+pagination", tone: "translucent", border: true, padding: "toolbar", children: _jsx(Row, { justify: "center", children: _jsx(Pagination, { currentPage: currentPage, totalPages: totalPages, onPageChange: (p) => table.setPage(p) }) }) })), selection.selectedCount > 0 && bulkActions.length > 0 && (_jsx(BulkActionBar, { selectedCount: selection.selectedCount, actions: bulkActions, onClearSelection: selection.clearSelection })), _jsxs(Div, { paddingX: "x-sm-md", padding: "y-md", children: [errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), _jsx(DataTable, { rows: displayRows, columns: columns, isLoading: isLoading, emptyLabel: "No carousel slides \u2014 use 'New slide' to add one", rowHrefTemplate: "/admin/carousel/{id}/edit" })] }), _jsx(ListingFilterDrawer, { open: filterOpen, onClose: () => setFilterOpen(false), onApply: applyFilters, onClear: clearFilters, activeCount: activeFilterCount, children: _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { className: "tracking-widest", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Status" }), _jsx(Row, { wrap: true, gap: "sm", children: [{ label: "All", value: "" }, { label: "Active", value: "true" }, { label: "Inactive", value: "false" }].map((opt) => (_jsx(Button, { variant: "ghost", type: "button", onClick: () => setPendingFilters((p) => ({ ...p, active: opt.value })), className: `rounded-full px-[var(--appkit-space-3)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium border transition-colors min-h-0 h-auto ${(pendingFilters.active || "") === opt.value ? "bg-primary text-white border-primary" : "border-[var(--appkit-color-border)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover"}`, children: opt.label }, opt.label))) })] }) }), deleteTargetId && (_jsx(ConfirmDeleteModal, { isOpen: true, title: "Delete Carousel Slide", message: "Delete this carousel slide? This cannot be undone.", onConfirm: () => { deleteMutation.mutate(deleteTargetId); setDeleteTargetId(null); }, onClose: () => setDeleteTargetId(null), isDeleting: deleteMutation.isPending }))] }));
+                onSearchChange: setSearchInput, onSearchCommit: commitSearch, showTableView: true, view: view, onViewChange: (v) => setView(v), onResetAll: resetAll, hasActiveState: hasActiveState, 
+                /*
+                 * 🛑 The empty state named a button that did not exist: "No carousel
+                 * slides — use 'New slide' to add one", with no New slide control
+                 * anywhere on the page. `/admin/carousel/new` has always been a real
+                 * route and nothing linked to it.
+                 */
+                extra: _jsx(Button, { gap: "sm", size: "sm", asChild: true, children: _jsx(TextLink, { variant: "inherit", href: String(ROUTES.ADMIN.CAROUSEL_NEW), children: "New slide" }) }) }), totalPages > 1 && (_jsx(StickyToolbar, { offset: "header+pagination", tone: "translucent", border: true, padding: "toolbar", children: _jsx(Row, { justify: "center", children: _jsx(Pagination, { currentPage: currentPage, totalPages: totalPages, onPageChange: (p) => table.setPage(p) }) }) })), selection.selectedCount > 0 && bulkActions.length > 0 && (_jsx(BulkActionBar, { selectedCount: selection.selectedCount, actions: bulkActions, onClearSelection: selection.clearSelection })), _jsxs(Div, { paddingX: "x-sm-md", padding: "y-md", children: [errorMessage && (_jsx(Div, { textSize: "sm", className: "mb-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "xl", children: errorMessage })), _jsx(DataTable, { rows: displayRows, columns: columns, isLoading: isLoading, emptyLabel: "No carousel slides yet", emptyAction: _jsx(Button, { gap: "sm", size: "sm", asChild: true, children: _jsx(TextLink, { variant: "inherit", href: String(ROUTES.ADMIN.CAROUSEL_NEW), children: "New slide" }) }), rowHrefTemplate: "/admin/carousel/{id}/edit", 
+                        /*
+                         * Selection was destructured and a bulk-action array built from it,
+                         * and these three props were never passed — so no checkbox column
+                         * rendered and nothing could be selected to act on.
+                         */
+                        selectedIds: selection.selectedIdSet, onToggleSelect: (id) => selection.toggle(id), onToggleSelectAll: () => selection.toggleAll() })] }), _jsx(ListingFilterDrawer, { open: filterOpen, onClose: () => setFilterOpen(false), onApply: applyFilters, onClear: clearFilters, activeCount: activeFilterCount, children: _jsxs(Stack, { gap: "sm", children: [_jsx(Text, { className: "tracking-widest", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Status" }), _jsx(Row, { wrap: true, gap: "sm", children: [{ label: "All", value: "" }, { label: "Active", value: "true" }, { label: "Inactive", value: "false" }].map((opt) => (_jsx(Button, { variant: "ghost", type: "button", onClick: () => setPendingFilters((p) => ({ ...p, active: opt.value })), className: `rounded-full px-[var(--appkit-space-3)] py-[var(--appkit-space-1)] text-[length:var(--appkit-text-xs)] font-medium border transition-colors min-h-0 h-auto ${(pendingFilters.active || "") === opt.value ? "bg-primary text-white border-primary" : "border-[var(--appkit-color-border)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover"}`, children: opt.label }, opt.label))) })] }) }), deleteTargetId && (_jsx(ConfirmDeleteModal, { isOpen: true, 
+                /* Rule #7: confirmation copy lives on the ActionDef, not here. */
+                title: ACTIONS.ADMIN["delete-carousel"].confirmation?.title, message: ACTIONS.ADMIN["delete-carousel"].confirmation?.body, confirmText: ACTIONS.ADMIN["delete-carousel"].confirmation?.confirmLabel, onConfirm: () => { deleteMutation.mutate(deleteTargetId); setDeleteTargetId(null); }, onClose: () => setDeleteTargetId(null), isDeleting: deleteMutation.isPending }))] }));
 }

package/dist/features/admin/components/AdminCouponEditorView.js

@@ -56,6 +56,9 @@ export function AdminCouponEditorView({ couponId, onSaved, onDeleted, embedded,
         minPurchase: "",
         buyQuantity: "1",
         getQuantity: "1",
+        // Blank, not a number — the ceiling is optional and a default here would
+        // silently cap a new BOGO coupon the admin never meant to cap.
+        maxItemPrice: "",
         totalLimit: "",
         perUserLimit: "",
         currentUsage: 0,
@@ -101,6 +104,7 @@ export function AdminCouponEditorView({ couponId, onSaved, onDeleted, embedded,
             minPurchase: c.discount?.minPurchase !== undefined ? String(c.discount.minPurchase) : "",
             buyQuantity: c.bxgy?.buyQuantity !== undefined ? String(c.bxgy.buyQuantity) : "1",
             getQuantity: c.bxgy?.getQuantity !== undefined ? String(c.bxgy.getQuantity) : "1",
+            maxItemPrice: c.bxgy?.maxItemPrice !== undefined ? String(c.bxgy.maxItemPrice) : "",
             totalLimit: c.usage?.totalLimit !== undefined ? String(c.usage.totalLimit) : "",
             perUserLimit: c.usage?.perUserLimit !== undefined ? String(c.usage.perUserLimit) : "",
             currentUsage: c.usage?.currentUsage ?? 0,
@@ -147,6 +151,10 @@ export function AdminCouponEditorView({ couponId, onSaved, onDeleted, embedded,
                     bxgy: {
                         buyQuantity: num(draft.buyQuantity) ?? 1,
                         getQuantity: num(draft.getQuantity) ?? 1,
+                        // `num("")` is undefined, and an undefined ceiling is "no limit" —
+                        // which is what a blank box should mean. Do not `?? 0` it: zero
+                        // would disqualify every unit and silently zero the coupon.
+                        maxItemPrice: num(draft.maxItemPrice),
                     },
                 }),
                 usage: {