@mohasinac/appkit 4.61.0 → 4.62.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.61.0",
-  "head": "7fd2f6fe0a6d6314241671329d51d11d008fca95",
+  "version": "4.62.0",
+  "head": "2ffd384e9122be6b68eba81be0eb152e5d1f6a3e",
   "branch": "main",
   "dirty": false,
-  "builtAt": "2026-10-22T08:29:07.009Z"
+  "builtAt": "2026-10-22T11:28:37.098Z"
 }

package/dist/_internal/client/features/lottery/LotteryAdminEditView.js

@@ -96,6 +96,15 @@ export function LotteryAdminEditView({ eventId, initialData, onSubmit, }) {
  * `audit-code-quality`'s DEEP_NESTING rule exists to stop.
  */
 function SlotTable({ slots, showPrice, onSlotsChange, }) {
+    /*
+     * Read the form context directly. `SlotTable` is its own component, so the
+     * `shellCtx` the parent destructures is out of scope here — but the parent
+     * mounts `FormShellContext.Provider` above this, so the errors are
+     * reachable. `useContext` rather than `useFormShell()`: this table is
+     * also usable outside a form and must not require a provider.
+     */
+    const formCtx = React.useContext(FormShellContext);
+    const slotError = (idx, field) => formCtx?.errors[`slots.${idx}.${field}`];
     /**
      * Next number is max+1, not length+1.
      *
@@ -146,19 +155,26 @@ function SlotTable({ slots, showPrice, onSlotsChange, }) {
         {
             key: "name",
             header: "Prize name",
-            render: (s) => (_jsx(Input, { type: "text", className: "w-full", placeholder: `Prize for slot ${s.slotNumber}`, value: s.name, onChange: (e) => updateSlot(s._idx, "name", e.target.value), "aria-label": `Slot ${s.slotNumber} prize name` })),
+            /*
+             * These inputs live in DataTable COLUMN renderers, which get no
+             * `errors` argument — a section render would. They read the context
+             * this component itself mounts, with the dotted INDEXED key
+             * `applyZodIssues` produces (`slots.2.price`), so a rejected slot marks
+             * its own row rather than the first one.
+             */
+            render: (s) => (_jsx(Input, { type: "text", className: "w-full", placeholder: `Prize for slot ${s.slotNumber}`, value: s.name, error: slotError(s._idx, "name"), onChange: (e) => updateSlot(s._idx, "name", e.target.value), "aria-label": `Slot ${s.slotNumber} prize name` })),
         },
         {
             key: "image",
             header: "Image",
-            render: (s) => (_jsx(Input, { type: "text", className: "w-full", placeholder: "/media/\u2026 or https://\u2026", value: s.image ?? "", onChange: (e) => updateSlot(s._idx, "image", e.target.value), "aria-label": `Slot ${s.slotNumber} prize image URL` })),
+            render: (s) => (_jsx(Input, { type: "text", className: "w-full", placeholder: "/media/\u2026 or https://\u2026", value: s.image ?? "", error: slotError(s._idx, "image"), onChange: (e) => updateSlot(s._idx, "image", e.target.value), "aria-label": `Slot ${s.slotNumber} prize image URL` })),
         },
         ...(showPrice
             ? [
                 {
                     key: "price",
                     header: "Price (₹)",
-                    render: (s) => (_jsx(Input, { type: "number", className: "w-24", placeholder: "0", value: s.price, onChange: (e) => updateSlot(s._idx, "price", e.target.value), "aria-label": `Slot ${s.slotNumber} price` })),
+                    render: (s) => (_jsx(Input, { type: "number", className: "w-24", placeholder: "0", value: s.price, error: slotError(s._idx, "price"), onChange: (e) => updateSlot(s._idx, "price", e.target.value), "aria-label": `Slot ${s.slotNumber} price` })),
                 },
             ]
             : []),

package/dist/_internal/client/features/maintenance/views/AnalysisRunnerView.js

@@ -23,7 +23,7 @@ export function AnalysisRunnerView() {
             });
             const body = (await res.json());
             if (!res.ok || !body.ok) {
-                setError(("error" in body && body.error) || `HTTP ${res.status}`);
+                setError(toUserMessage("code" in body ? String(body.code) : undefined, undefined, { fallback: `The analysis run failed (HTTP ${res.status}).` }));
                 setRunning(false);
                 return;
             }

package/dist/_internal/client/features/maintenance/views/CloudLogsListView.js

@@ -32,7 +32,7 @@ export function CloudLogsListView({ title, subtitle, initialEntries, initialNext
             const res = await fetch(url.toString());
             const body = (await res.json());
             if (!res.ok || !body.ok) {
-                setError(("error" in body && body.error) || `HTTP ${res.status}`);
+                setError(toUserMessage("code" in body ? String(body.code) : undefined, undefined, { fallback: `Could not load logs (HTTP ${res.status}).` }));
                 return;
             }
             setEntries((prev) => [...prev, ...body.data.entries]);

package/dist/_internal/server/jobs/core/paymentReconcile.js

@@ -138,81 +138,7 @@ export async function reconcileStuckGatewayEvents(ctx) {
     }
     return { redispatched, escalated, reads: stuck.length };
 }
-/**
- * "The gateway captured a different amount from the one the order records."
- *
- * Extracted from the sweep below, where it sat inside
- * fn → `for record` → `for order` → `if` and the whole case literal was a
- * brace too deep. Pure construction — no branching, and `recorded` is passed
- * in rather than re-derived, so the one money rule still lives at the call
- * site (Root Cause #75).
- */
-async function openAmountMismatchCase(record, orderId, recorded, now) {
-    await paymentCasesRepository().openOrObserve({
-        kind: "amount_mismatch",
-        subjectId: `${record.id}:${orderId}`,
-        severity: "error",
-        title: `Captured ${record.amount} but recorded ${recorded} — ${orderId}`,
-        detail: [
-            `The gateway captured a different amount from the one the order records.`,
-            `Either the buyer was over-charged or the order under-states what was paid.`,
-            "",
-            `Gateway: ${record.gateway}`,
-            `Payment: ${record.id}`,
-            `Order: ${orderId}`,
-            `Captured: ${record.amount} ${record.currency}`,
-            `Order total: ${recorded}`,
-            `Difference: ${(record.amount - recorded).toFixed(2)}`,
-        ].join("\n"),
-        entityType: "order",
-        entityId: orderId,
-        amountAtRisk: Math.abs(record.amount - recorded),
-        orderIds: [orderId],
-        gatewayPaymentId: record.id,
-        now,
-    });
-}
-/**
- * "Our refund total disagrees with the gateway's."
- *
- * Same extraction as `openAmountMismatchCase`. `ours` and `base` are both
- * computed by the caller from the shared helpers, so this never re-derives a
- * refund figure of its own.
- *
- * 🛑 The severity split is the whole point and must not be flattened: the
- * gateway having refunded MORE than we recorded is money that left without a
- * record (`error`); our side showing more is a refund reserved and never
- * completed (`warning`).
- */
-async function openRefundMismatchCase(record, orderId, ours, base, now) {
-    await paymentCasesRepository().openOrObserve({
-        kind: "refund_mismatch",
-        subjectId: `${record.id}:refunds`,
-        severity: record.amountRefunded > ours ? "error" : "warning",
-        title: `Refund total disagrees with the gateway — ${orderId}`,
-        detail: [
-            record.amountRefunded > ours
-                ? `🛑 The gateway has refunded MORE than our records show. Money has left that we did not record.`
-                : `Our records show more refunded than the gateway did — a refund may have been reserved and never completed.`,
-            "",
-            `Gateway: ${record.gateway}`,
-            `Payment: ${record.id}`,
-            `Order: ${orderId}`,
-            `Gateway refunded: ${record.amountRefunded}`,
-            `Our committed refunds: ${ours}`,
-            `Refundable base: ${base}`,
-            record.refundStatus ? `Gateway refund status: ${record.refundStatus}` : null,
-        ]
-            .filter((l) => l !== null)
-            .join("\n"),
-        entityType: "order",
-        entityId: orderId,
-        amountAtRisk: Math.abs(record.amountRefunded - ours),
-        orderIds: [orderId],
-        gatewayPaymentId: record.id,
-        now,
-    });
-}
+/* ──────────────── R2: the gateway has it — do we? ───────────────────────── */
 async function reconcileGatewayPayments(ctx) {
     const payment = getProviders().payment;
     let examined = 0;
@@ -298,28 +224,9 @@ async function reconcileGatewayPayments(ctx) {
                 continue;
             }
             for (const order of orders) {
-                /*
-                 * Amount check. Compared against the order's own recorded total rather
-                 * than recomputed from its lines — recomputing would re-derive the
-                 * pricing pipeline here and disagree with it the day a rate changes,
-                 * which is a sixth copy of the money rule (Root Cause #75).
-                 */
-                const recorded = order.totalPrice ?? 0;
-                if (Math.abs(recorded - record.amount) > MONEY_EPSILON) {
-                    amountMismatch += 1;
-                    await openAmountMismatchCase(record, order.id, recorded, ctx.now);
-                }
-                /*
-                 * Refund check — the gateway's `amount_refunded` against our own
-                 * non-failed refund events. `committedRefundTotal` is the same helper
-                 * the refund cap uses, so "what we think we refunded" has ONE
-                 * definition rather than a second one written here.
-                 */
-                const ours = committedRefundTotal(order);
-                if (Math.abs(ours - record.amountRefunded) > MONEY_EPSILON) {
-                    refundMismatch += 1;
-                    await openRefundMismatchCase(record, order.id, ours, refundableBase(order), ctx.now);
-                }
+                const outcome = await reconcilePaymentAgainstOrder(record, order, ctx);
+                amountMismatch += outcome.amountMismatch;
+                refundMismatch += outcome.refundMismatch;
             }
         }
         catch (err) {
@@ -331,6 +238,89 @@ async function reconcileGatewayPayments(ctx) {
     }
     return { examined, missing, amountMismatch, refundMismatch, reads };
 }
+/**
+ * The two per-order checks R2 runs against one gateway record.
+ *
+ * Extracted so each `openOrObserve` call is a statement in a function body
+ * rather than five braces deep inside `for record -> try -> for order -> if`.
+ * Returns the counts rather than mutating the caller's accumulators, so the
+ * loop above reads as a sum rather than as two side effects.
+ */
+async function reconcilePaymentAgainstOrder(record, order, ctx) {
+    let amountMismatch = 0;
+    let refundMismatch = 0;
+    /*
+     * Amount check. Compared against the order's own recorded total rather
+     * than recomputed from its lines — recomputing would re-derive the
+     * pricing pipeline here and disagree with it the day a rate changes,
+     * which is a sixth copy of the money rule (Root Cause #75).
+     */
+    const recorded = order.totalPrice ?? 0;
+    if (Math.abs(recorded - record.amount) > MONEY_EPSILON) {
+        amountMismatch += 1;
+        await paymentCasesRepository().openOrObserve({
+            kind: "amount_mismatch",
+            subjectId: `${record.id}:${order.id}`,
+            severity: "error",
+            title: `Captured ${record.amount} but recorded ${recorded} — ${order.id}`,
+            detail: [
+                `The gateway captured a different amount from the one the order records.`,
+                `Either the buyer was over-charged or the order under-states what was paid.`,
+                "",
+                `Gateway: ${record.gateway}`,
+                `Payment: ${record.id}`,
+                `Order: ${order.id}`,
+                `Captured: ${record.amount} ${record.currency}`,
+                `Order total: ${recorded}`,
+                `Difference: ${(record.amount - recorded).toFixed(2)}`,
+            ].join("\n"),
+            entityType: "order",
+            entityId: order.id,
+            amountAtRisk: Math.abs(record.amount - recorded),
+            orderIds: [order.id],
+            gatewayPaymentId: record.id,
+            now: ctx.now,
+        });
+    }
+    /*
+     * Refund check — the gateway's `amount_refunded` against our own
+     * non-failed refund events. `committedRefundTotal` is the same helper
+     * the refund cap uses, so "what we think we refunded" has ONE
+     * definition rather than a second one written here.
+     */
+    const ours = committedRefundTotal(order);
+    if (Math.abs(ours - record.amountRefunded) > MONEY_EPSILON) {
+        refundMismatch += 1;
+        await paymentCasesRepository().openOrObserve({
+            kind: "refund_mismatch",
+            subjectId: `${record.id}:refunds`,
+            severity: record.amountRefunded > ours ? "error" : "warning",
+            title: `Refund total disagrees with the gateway — ${order.id}`,
+            detail: [
+                record.amountRefunded > ours
+                    ? `🛑 The gateway has refunded MORE than our records show. Money has left that we did not record.`
+                    : `Our records show more refunded than the gateway did — a refund may have been reserved and never completed.`,
+                "",
+                `Gateway: ${record.gateway}`,
+                `Payment: ${record.id}`,
+                `Order: ${order.id}`,
+                `Gateway refunded: ${record.amountRefunded}`,
+                `Our committed refunds: ${ours}`,
+                `Refundable base: ${refundableBase(order)}`,
+                record.refundStatus ? `Gateway refund status: ${record.refundStatus}` : null,
+            ]
+                .filter((l) => l !== null)
+                .join("\n"),
+            entityType: "order",
+            entityId: order.id,
+            amountAtRisk: Math.abs(record.amountRefunded - ours),
+            orderIds: [order.id],
+            gatewayPaymentId: record.id,
+            now: ctx.now,
+        });
+    }
+    return { amountMismatch, refundMismatch };
+}
 /* ──────────────── R3: refund claimed, never settled ─────────────────────── */
 /**
  * A `refundClaims` row still `claimed` an hour later is a crash between

package/dist/_internal/shared/actions/action-registry.js

@@ -1427,6 +1427,40 @@ export const ACTIONS = {
                 confirmKind: "danger",
             },
         },
+        /*
+         * 🛑 The confirmation names the consequence rather than the mechanism.
+         * "Revoke session" means nothing to a buyer; "that device is signed out"
+         * is the fact they need to weigh, and the warning about their own device
+         * is the one mistake this control makes easy to make.
+         */
+        "revoke-session": {
+            iconKey: "lock",
+            id: "user.revoke-session",
+            label: "Sign out device",
+            ariaLabel: "Sign out this device",
+            description: "End an active session so that device has to sign in again.",
+            kind: "danger",
+            confirmation: {
+                title: "Sign out this device?",
+                body: "Whoever is using it will be signed out and will need your password to get back in. If this is the device you are on right now, you will be signed out too.",
+                confirmLabel: "Sign out device",
+                confirmKind: "danger",
+            },
+        },
+        "delete-payment-method": {
+            iconKey: "delete",
+            id: "user.delete-payment-method",
+            label: "Remove card",
+            ariaLabel: "Remove this saved payment method",
+            description: "Remove a saved payment method from the account.",
+            kind: "danger",
+            confirmation: {
+                title: "Remove this payment method?",
+                body: "It will no longer appear at checkout. Any order already placed with it is unaffected.",
+                confirmLabel: "Remove",
+                confirmKind: "danger",
+            },
+        },
         "set-default-address": {
             iconKey: "confirm",
             id: "user.set-default-address",
@@ -2397,17 +2431,44 @@ export const ACTIONS = {
             kind: "ghost",
             permissions: ["admin"],
         },
+        "activate-carousel": {
+            iconKey: "resume",
+            id: "admin.activate-carousel",
+            label: "Activate",
+            ariaLabel: "Show this slide in the carousel",
+            description: "Set a carousel slide to active so the hero carousel renders it.",
+            kind: "primary",
+            permissions: ["admin"],
+        },
+        "deactivate-carousel": {
+            iconKey: "hide",
+            id: "admin.deactivate-carousel",
+            label: "Deactivate",
+            ariaLabel: "Hide this slide from the carousel",
+            description: "Set a carousel slide to inactive without deleting it.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         /*
-         * Homepage sections have no bucket of their own, so their edit leaf lives
-         * here beside the carousel pair for the same reason — both are homepage
-         * chrome an admin edits from a list rather than from a detail page.
+         * Homepage sections have no bucket of their own, so their leaves live here
+         * beside the carousel ones for the same reason — both are homepage chrome
+         * an admin edits from a list rather than from a detail page.
+         *
+         * 🛑 `delete-section` exists but is NOT reachable from the public homepage.
+         * Section `order` is POSITIONAL, so removing one leaves a gap in its
+         * neighbours' numbering — not something to offer from a public page, where
+         * the only confirmation a person gets is a dialog.
+         *
+         * That prohibition is enforced INDEPENDENTLY of this registry, which is
+         * why the leaf can exist: `RESOURCE_LEAVES.SECTION` in `OwnerQuickActions`
+         * omits `remove`, and `showDelete` gates on `leaves.remove` rather than on
+         * what a call site passes — so the pencil strip renders no bin regardless.
+         * This comment read "there is deliberately NO delete-section counterpart"
+         * until 2026-10-22, when the admin sections listing gained a real one.
          *
-         * 🛑 There is deliberately NO `delete-section` counterpart. Section `order`
-         * is POSITIONAL, so removing one silently renumbers its neighbours — not
-         * something to offer from the public homepage, where the only confirmation
-         * a person gets is a dialog. `OwnerQuickActions` enforces the absence by
-         * omitting `remove` from the SECTION mapping, so no call site can pass a
-         * delete handler and have it render.
+         * The listing is the right home for it: it owns these records, it shows
+         * the `order` column the gap appears in, and its Reorder panel has a
+         * Reindex 1..N button beside it to close one.
          */
         "edit-section": {
             iconKey: "edit",
@@ -2418,6 +2479,62 @@ export const ACTIONS = {
             kind: "ghost",
             permissions: ["admin"],
         },
+        "enable-section": {
+            iconKey: "resume",
+            id: "admin.enable-section",
+            label: "Enable",
+            ariaLabel: "Enable this homepage section",
+            description: "Render this section on its surface again.",
+            kind: "primary",
+            permissions: ["admin"],
+        },
+        "disable-section": {
+            iconKey: "hide",
+            id: "admin.disable-section",
+            label: "Disable",
+            ariaLabel: "Disable this homepage section",
+            description: "Stop rendering this section without deleting it or its saved config.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
+        "delete-section": {
+            iconKey: "delete",
+            id: "admin.delete-section",
+            label: "Delete Section",
+            ariaLabel: "Delete this homepage section",
+            description: "Permanently remove this homepage section and its saved config.",
+            kind: "danger",
+            permissions: ["admin"],
+            confirmation: {
+                title: "Delete this section?",
+                /*
+                 * The last sentence is load-bearing: it names the reversible
+                 * alternative at the moment of the irreversible choice, and that
+                 * alternative is one click away in the same row.
+                 */
+                body: "The section and its saved config are removed permanently. Display order is positional, so the sections after it keep their current numbers and a gap is left — Reorder sections → Reindex 1..N closes it. To hide the section from the homepage while keeping its config, disable it instead.",
+                confirmLabel: "Delete section",
+                confirmKind: "danger",
+            },
+        },
+        "show-nav-item": {
+            iconKey: "view",
+            id: "admin.show-nav-item",
+            label: "Show",
+            ariaLabel: "Show this navigation item",
+            description: "Make a navigation item visible in the sidebar and menus.",
+            kind: "primary",
+            permissions: ["admin"],
+        },
+        "hide-nav-item": {
+            iconKey: "hide",
+            id: "admin.hide-nav-item",
+            label: "Hide",
+            ariaLabel: "Hide this navigation item",
+            description: "Hide a navigation item without deleting it.",
+            kind: "secondary",
+            permissions: ["admin"],
+        },
         "delete-carousel": {
             iconKey: "delete",
             id: "admin.delete-carousel",
@@ -3085,6 +3202,29 @@ export const ACTIONS = {
                 confirmKind: "danger",
             },
         },
+        /*
+         * 🛑 Distinct from `clear-previews` and `discard-staged`, which are
+         * SESSION/STAGING operations over files no record points at yet. This one
+         * removes a FINALISED asset, so the confirmation has to say what nothing
+         * else in this bucket has to: the bytes are referenced by whatever already
+         * embedded them, and the proxy resolves `/media/<shortId>` through the
+         * `mediaAssets` row — so deleting is how a live page gets a broken image.
+         */
+        "delete-media": {
+            iconKey: "delete",
+            id: "media.delete-media",
+            label: "Delete file",
+            ariaLabel: "Delete this media file",
+            description: "Permanently delete a media file and the asset row that resolves it.",
+            kind: "danger",
+            permissions: ["admin"],
+            confirmation: {
+                title: "Delete this file?",
+                body: "The file is removed from storage and stops resolving. Any product, blog post or section still embedding it will show a broken image — this cannot be undone.",
+                confirmLabel: "Delete file",
+                confirmKind: "danger",
+            },
+        },
     },
     SUPPORT: {
         "create-ticket": {

package/dist/_internal/shared/media/limits.d.ts

@@ -27,6 +27,16 @@ export type MediaKind = "image" | "video" | "pdf";
 export declare const PRODUCT_MAX_IMAGES = 24;
 /** Videos per listing. Bounded by `ProductDocument.video` being singular. */
 export declare const PRODUCT_MAX_VIDEOS = 1;
+/**
+ * Photos a buyer may attach to one review.
+ *
+ * 🛑 Deliberately NOT `PRODUCT_MAX_IMAGES`, which is 24 and is a SELLER's
+ * ceiling for a whole listing. `audit-media-limit-literals` suggests that
+ * constant for any `images: z.array(…).max(n)`, and taking the suggestion
+ * here would have quadrupled what a review accepts — the right shape, the
+ * wrong number. A review is a few photos of one thing.
+ */
+export declare const REVIEW_MAX_IMAGES = 6;
 /**
  * Highest legal `index` in a product media filename.
  *

package/dist/_internal/shared/media/limits.js

@@ -41,6 +41,16 @@ export const MAX_VIDEO_BYTES = 50 * MEGABYTE;
 export const PRODUCT_MAX_IMAGES = 24;
 /** Videos per listing. Bounded by `ProductDocument.video` being singular. */
 export const PRODUCT_MAX_VIDEOS = 1;
+/**
+ * Photos a buyer may attach to one review.
+ *
+ * 🛑 Deliberately NOT `PRODUCT_MAX_IMAGES`, which is 24 and is a SELLER's
+ * ceiling for a whole listing. `audit-media-limit-literals` suggests that
+ * constant for any `images: z.array(…).max(n)`, and taking the suggestion
+ * here would have quadrupled what a review accepts — the right shape, the
+ * wrong number. A review is a few photos of one thing.
+ */
+export const REVIEW_MAX_IMAGES = 6;
 /**
  * Highest legal `index` in a product media filename.
  *

package/dist/_internal/shared/types/action-result.js

@@ -1,5 +1,6 @@
 import { normalizeError } from "../../../errors/normalize.js";
 import { mapToHttpError } from "../../../errors/error-mapping.js";
+import { toApiIssues } from "../../../errors/error-envelope.js";
 import { describeCauseChain } from "../../../errors/describe-cause.js";
 import { reportActionError } from "./action-error-reporter.js";
 /**
@@ -57,7 +58,20 @@ export async function wrapAction(fn) {
             ok: false,
             code: mapped.code,
             error: mapped.message,
-            ...(mapped.issues ? { issues: mapped.issues } : {}),
+            /*
+             * 🛑 `toApiIssues`, not the raw issues — this was the ONE producer in
+             * the codebase that skipped the scrubber, and it is the one with 221
+             * call sites.
+             *
+             * A raw `ZodIssue` carries `received`: the value the user actually
+             * submitted. On a failed signup, address save or payout-details save
+             * that is an email, a phone number or a bank account, echoed straight
+             * back into the client payload. `toApiIssues` narrows each issue to
+             * `{ message, path?, code? }`, which is exactly why it exists — every
+             * other producer (`routeHandler`, `createApiHandler`, the offer
+             * actions) already routes through it.
+             */
+            ...(mapped.issues ? { issues: toApiIssues(mapped.issues) } : {}),
         };
     }
 }

package/dist/client/api/surface-error.js

@@ -1,6 +1,6 @@
 import { isApiError } from "./ApiError.js";
 import { ApiClientError } from "../../http/ApiClient.js";
-import { applyZodIssues, hasAttachableIssue } from "../../ui/forms/apply-zod-issues.js";
+import { applyZodIssues, hasAttachableIssue, rootLevelMessages } from "../../ui/forms/apply-zod-issues.js";
 import { normalizeError } from "../../errors/normalize.js";
 import { getErrorDisplay, toUserMessage } from "../../errors/error-display-map.js";
 import { HTTP_ERROR_CODES } from "../../errors/error-mapping.js";
@@ -36,7 +36,21 @@ export function surfaceError(err, opts) {
     const issues = issuesOf(err);
     if (setFieldError && hasAttachableIssue(issues)) {
         applyZodIssues(issues, (name, message) => setFieldError(name, message ?? ""));
-        return; // inline errors only — no toast
+        /*
+         * 🛑 Root-level issues are NOT covered by the line above and must still be
+         * surfaced, or a cross-field rule fails silently.
+         *
+         * `applyZodIssues` skips any issue with an empty `path` — there is no
+         * field to put it on. For a mixed response (one field error plus one
+         * cross-field `.refine()`, the shape of "passwords must match" or "end
+         * date must be after start date") `hasAttachableIssue` is true, so we used
+         * to take this branch and `return` with the refine message discarded: the
+         * save was refused and nothing on screen said why.
+         */
+        for (const message of rootLevelMessages(issues)) {
+            showToast(message, "error");
+        }
+        return; // field errors inline; only the unattachable ones toast
     }
     if (hasStableErrorCode(err)) {
         const display = getErrorDisplay(err.code);

package/dist/client/api/useApiMutation.js

@@ -3,6 +3,7 @@ import * as React from "react";
 import { useMutation, } from "@tanstack/react-query";
 import { useToast } from "../../ui/components/Toast.js";
 import { surfaceError } from "./surface-error.js";
+import { toUserMessage } from "../../errors/error-display-map.js";
 export function useApiMutation(options) {
     const { showToast, updateToast } = useToast();
     const loadingIdRef = React.useRef(null);
@@ -40,7 +41,22 @@ export function useApiMutation(options) {
         onSettled: (data, err, variables, context, ctx) => {
             if (loadingIdRef.current) {
                 if (err) {
-                    updateToast(loadingIdRef.current, "error", err instanceof Error ? err.message : "Action failed");
+                    /*
+                     * 🛑 This was `err instanceof Error ? err.message : "Action failed"`
+                     * — verbatim the inverted ternary `audit-raw-error-text`'s own
+                     * header calls "the dominant shape", sitting two lines below the
+                     * correct `surfaceError` call in the same hook. The authored
+                     * sentence showed only when the value was NOT an Error, i.e. almost
+                     * never, so the normal case published the raw message.
+                     *
+                     * It was dormant only because `loadingMessage` currently has no
+                     * call sites; the first consumer to set one would have got two
+                     * toasts, one of them raw. `updateToast` is also absent from that
+                     * audit's SINKS list, so nothing would have caught it.
+                     */
+                    updateToast(loadingIdRef.current, "error", toUserMessage(err?.code, undefined, {
+                        fallback: "Action failed",
+                    }));
                 }
                 else if (!successMessage) {
                     updateToast(loadingIdRef.current, "success", "Done");

package/dist/client.d.ts

@@ -455,7 +455,7 @@ export type { OwnerQuickActionsProps, OwnerQuickActionsResource } from "./featur
 export type { StoreListingEntitlements } from "./features/seller/hooks/useStoreListingEntitlements";
 export type { ListingTypePlugin } from "./_internal/shared/listing-types/_registry";
 export type { ListingType } from "./features/products/types/index";
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, REVIEW_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits";
 export type { MediaKind, AllowedImageMime, AllowedVideoMime, AllowedDocMime, AllowedMime, } from "./_internal/shared/media/limits";
 export { ScamAwarenessModal } from "./features/scams/components/ScamAwarenessModal";
 export type { ScamAwarenessModalProps } from "./features/scams/components/ScamAwarenessModal";

package/dist/client.js

@@ -493,7 +493,7 @@ export { YourPurchaseStrip } from "./features/orders/components/YourPurchaseStri
 export { ReviewFormDrawer, reviewFormSchema } from "./features/reviews/components/ReviewFormDrawer.js";
 export { PurchaseReviewAffordance } from "./features/reviews/components/PurchaseReviewAffordance.js";
 // Media upload limits — shared by client uploaders + server sign/finalize routes.
-export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits.js";
+export { MEGABYTE, MAX_IMAGE_BYTES, MAX_PDF_BYTES, MAX_VIDEO_BYTES, MAX_LABEL, MAX_BYTES, ALLOWED_IMAGE_MIMES, IMAGE_ACCEPT_ATTR, ALLOWED_VIDEO_MIMES, ALLOWED_DOC_MIMES, ALLOWED_MIMES, ALLOWED_TYPES_LABEL, MIME_TO_EXT, PDF_MAGIC, VIDEO_CONVERSION_HINTS, classifyMime, isAllowedMime, maxBytesFor, getConversionHint, PRODUCT_MAX_IMAGES, REVIEW_MAX_IMAGES, PRODUCT_MAX_VIDEOS, PRODUCT_IMAGE_INDEX_MAX, } from "./_internal/shared/media/limits.js";
 export { ScamAwarenessModal } from "./features/scams/components/ScamAwarenessModal.js";
 export { SellerTrustBadge } from "./features/scams/components/SellerTrustBadge.js";
 // [CLIENT-ONLY] — Admin panel components for action/nav permission management.

package/dist/constants/api-endpoints.d.ts

@@ -535,6 +535,7 @@ export declare const SELLER_ENDPOINTS: {
     readonly BUNDLES: "/api/store/bundles";
     /** Tickets raised ABOUT this store (W11). */
     readonly SUPPORT: "/api/store/support";
+    readonly SUPPORT_TICKET_BY_ID: (id: string) => string;
     readonly BUNDLE_BY_ID: (id: string) => string;
     readonly ORDERS_ASSIGN: (orderId: string) => string;
     readonly PRODUCT_BY_ID: (id: string) => string;
@@ -1061,6 +1062,7 @@ export declare const API_ENDPOINTS: {
         readonly BUNDLES: "/api/store/bundles";
         /** Tickets raised ABOUT this store (W11). */
         readonly SUPPORT: "/api/store/support";
+        readonly SUPPORT_TICKET_BY_ID: (id: string) => string;
         readonly BUNDLE_BY_ID: (id: string) => string;
         readonly ORDERS_ASSIGN: (orderId: string) => string;
         readonly PRODUCT_BY_ID: (id: string) => string;
@@ -1608,6 +1610,7 @@ export declare const API_ROUTES: {
         readonly BUNDLES: "/api/store/bundles";
         /** Tickets raised ABOUT this store (W11). */
         readonly SUPPORT: "/api/store/support";
+        readonly SUPPORT_TICKET_BY_ID: (id: string) => string;
         readonly BUNDLE_BY_ID: (id: string) => string;
         readonly ORDERS_ASSIGN: (orderId: string) => string;
         readonly PRODUCT_BY_ID: (id: string) => string;