@mohasinac/appkit 4.61.0 → 4.62.0

package/dist/constants/api-endpoints.js

@@ -690,6 +690,7 @@ export const SELLER_ENDPOINTS = {
     BUNDLES: "/api/store/bundles",
     /** Tickets raised ABOUT this store (W11). */
     SUPPORT: "/api/store/support",
+    SUPPORT_TICKET_BY_ID: (id) => `/api/store/support/${id}`,
     BUNDLE_BY_ID: (id) => `/api/store/bundles/${id}`,
     ORDERS_ASSIGN: (orderId) => `/api/store/orders/${orderId}/assign`,
     PRODUCT_BY_ID: (id) => `/api/store/products/${id}`,

package/dist/constants/field-names.d.ts

@@ -982,6 +982,23 @@ export declare const COMMON_FIELDS: {
     readonly IS_ACTIVE: "isActive";
     readonly ORDER: "order";
 };
+/**
+ * The idempotency rows behind a refund.
+ *
+ * 🛑 `STATE` is the claim's own lifecycle ("claimed" → settled), NOT a
+ * postal state. `audit-route-nav-field-constants` matches a raw field
+ * string against every constant that happens to share its VALUE, so it
+ * suggested `ADDRESS_FIELDS.STATE` here — right string, wrong concept, and
+ * taking the suggestion would have made the query read as address filtering.
+ */
+export declare const REFUND_CLAIM_FIELDS: {
+    readonly STATE: "state";
+    readonly CLAIMED_AT: "claimedAt";
+};
+/** Observed market prices, keyed by the taxonomy node they were seen under. */
+export declare const PRICE_OBSERVATION_FIELDS: {
+    readonly CATEGORY_ID: "categoryId";
+};
 export declare const OAUTH_STATE_VALUES: {
     readonly PENDING: "pending";
     readonly USED: "used";

package/dist/constants/field-names.js

@@ -1175,6 +1175,29 @@ export const COMMON_FIELDS = {
     ORDER: "order",
 };
 // ============================================================================
+// REFUND CLAIMS
+// ============================================================================
+/**
+ * The idempotency rows behind a refund.
+ *
+ * 🛑 `STATE` is the claim's own lifecycle ("claimed" → settled), NOT a
+ * postal state. `audit-route-nav-field-constants` matches a raw field
+ * string against every constant that happens to share its VALUE, so it
+ * suggested `ADDRESS_FIELDS.STATE` here — right string, wrong concept, and
+ * taking the suggestion would have made the query read as address filtering.
+ */
+export const REFUND_CLAIM_FIELDS = {
+    STATE: "state",
+    CLAIMED_AT: "claimedAt",
+};
+// ============================================================================
+// PRICE OBSERVATIONS
+// ============================================================================
+/** Observed market prices, keyed by the taxonomy node they were seen under. */
+export const PRICE_OBSERVATION_FIELDS = {
+    CATEGORY_ID: "categoryId",
+};
+// ============================================================================
 // OAUTH STATE VALUES
 // ============================================================================
 export const OAUTH_STATE_VALUES = {

package/dist/core/server-action.js

@@ -1,6 +1,6 @@
 import { normalizeError } from "../errors/normalize.js";
 import { toApiIssues } from "../errors/error-envelope.js";
-import { HTTP_ERROR_CODES } from "../errors/error-mapping.js";
+import { HTTP_ERROR_CODES, mapToHttpError } from "../errors/error-mapping.js";
 /**
  * createServerAction — @mohasinac/appkit/core
  *
@@ -97,11 +97,27 @@ export function createServerAction(options) {
         }
         catch (err) {
             void normalizeError(err);
-            const message = err instanceof Error ? err.message : "An unexpected error occurred";
+            /*
+             * 🛑 This never got the Rule #9 fix its sibling `wrapAction` did.
+             *
+             * It took `err.message` verbatim — unscrubbed for 5xx, so a thrown
+             * Node/bundler error's internals reached the client — and emitted NO
+             * `code`, so `toUserMessage(result.code)` downstream could only ever
+             * resolve to the generic sentence.
+             *
+             * It has no in-repo callers, but it is exported from the public barrel,
+             * so it is a trap for the next consumer rather than a live bug. Route it
+             * through the same mapper `wrapAction` uses: `mapToHttpError` scrubs 5xx
+             * messages in production and carries the real one in `internalMessage`
+             * for recorders only.
+             */
+            const mapped = mapToHttpError(err, {
+                isProduction: process.env.NODE_ENV === "production",
+            });
             logger.error(`[createServerAction] handler error in "${actionName}"`, {
                 err,
             });
-            result = { ok: false, error: message };
+            result = { ok: false, code: mapped.code, error: mapped.message };
         }
         // -- 4. After hooks (per-action → global) ------------------------------
         try {

package/dist/errors/error-mapping.js

@@ -42,6 +42,31 @@ function isZodLikeError(err) {
         "issues" in err &&
         Array.isArray(err.issues));
 }
+/**
+ * The issues carried by a `ValidationError`, whichever of the two shapes the
+ * thrower used.
+ *
+ * 🛑 `new ValidationError(msg, parsed.error.issues)` silently lost everything.
+ * `ValidationError` forwards its second argument to `AppError.data`, and the
+ * old test was `isZodLikeError(err.data)` — which requires `"issues" in data`.
+ * An ARRAY has no `.issues` property (`"issues" in [] === false`), so passing
+ * `parsed.error.issues` (the obvious thing to pass, and what four routes do)
+ * produced a 400 with no field information at all. Only passing the whole
+ * `ZodError` worked.
+ *
+ * `media/finalize/route.ts` even carried a comment asserting the opposite —
+ * "carries `issues` through to the client, so the caller learns WHICH field it
+ * got wrong". It did not.
+ *
+ * Accept both, so the next caller cannot get it wrong either way.
+ */
+function issuesFromErrorData(data) {
+    if (Array.isArray(data))
+        return data.length > 0 ? data : undefined;
+    if (isZodLikeError(data))
+        return data.issues;
+    return undefined;
+}
 function isFirestoreLikeError(err) {
     if (typeof err !== "object" || err === null)
         return false;
@@ -110,7 +135,7 @@ function classifyError(err, opts) {
             status: 400,
             code: HTTP_ERROR_CODES.VALIDATION_FAILED,
             message: err.message,
-            issues: isZodLikeError(err.data) ? err.data.issues : undefined,
+            issues: issuesFromErrorData(err.data),
         };
     }
     if (err instanceof AuthenticationError) {

package/dist/features/account/components/UserOffersPanel.js

@@ -1,11 +1,13 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useCallback, useEffect, useState, useTransition } from "react";
-import { Alert, Badge, Button, Div, Heading, LoginRequiredModal, Row, Spinner, Stack, Text } from "../../../ui/index.js";
+import { Alert, Badge, Button, Div, Heading, LoginRequiredModal, Row, Spinner, Stack, Text, TextLink } from "../../../ui/index.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { isAuthError } from "../../../utils/auth-error.js";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
 import { ACCOUNT_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 const CLS_COUNTER_AMOUNT = "text-[length:var(--appkit-text-sm)] font-semibold text-info dark:text-info";
 function formatRupees(amount) {
     if (amount === undefined || amount === null)
@@ -60,7 +62,7 @@ function BuyerOfferCard({ offer, onAcceptCounter, onWithdraw, onCheckout, onUpda
             }
         });
     }
-    return (_jsxs(Stack, { surface: "card", padding: "sm", gap: "3", children: [_jsxs(Row, { align: "start", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Div, { className: "min-w-0", children: [_jsx(Text, { className: "truncate", color: "primary", size: "sm", weight: "semibold", children: offer.productTitle ?? "Unknown Product" }), _jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: relativeTime(offer.createdAt) })] }), _jsx(Badge, { variant: statusVariant(offer.status), size: "xs", className: "shrink-0 capitalize", children: offer.status })] }), _jsxs(Row, { wrap: true, gap: "md", children: [_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Listed" }), _jsx(Text, { size: "sm", weight: "medium", color: "muted", children: formatRupees(offer.listedPrice) })] }), _jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Your Offer" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: formatRupees(offer.offerAmount) })] }), offer.counterAmount != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Seller Counter" }), _jsx(Text, { className: CLS_COUNTER_AMOUNT, children: formatRupees(offer.counterAmount) })] })), offer.lockedPrice != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Agreed Price" }), _jsx(Text, { className: "text-success", size: "sm", weight: "semibold", children: formatRupees(offer.lockedPrice) })] }))] }), offer.sellerNote && (_jsxs(Text, { className: "italic", color: "muted", size: "xs", children: ["Seller note: \"", offer.sellerNote, "\""] })), offer.status === "countered" && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "text-info", size: "xs", weight: "medium", children: ["Seller countered at ", formatRupees(offer.counterAmount), ". Accept or withdraw your offer."] }), _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onAcceptCounter(offer.id), { status: "accepted", lockedPrice: offer.counterAmount }), disabled: isPending, children: isPending ? "Accepting…" : `Accept ${formatRupees(offer.counterAmount)}` }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20", children: "Withdraw" })] })] })), offer.status === "accepted" && onCheckout && (_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onCheckout(offer.id), { status: "paid" }), disabled: isPending, children: isPending ? "Processing…" : "Checkout at Agreed Price" })), offer.status === "pending" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20 text-[length:var(--appkit-text-xs)]", children: "Withdraw Offer" })), confirming === "withdraw" && (_jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: "ghost", onClick: () => act(() => onWithdraw(offer.id), { status: "withdrawn" }), disabled: isPending, className: "text-error border border-error/20", children: isPending ? "Withdrawing…" : "Confirm Withdraw" }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming(null), disabled: isPending, children: "Cancel" })] })), error && _jsx(Alert, { variant: "error", children: _jsx(Text, { size: "xs", children: error }) })] }));
+    return (_jsxs(Stack, { surface: "card", padding: "sm", gap: "3", children: [_jsxs(Row, { align: "start", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Div, { className: "min-w-0", children: [_jsx(TextLink, { href: String(ROUTES.PUBLIC.PRODUCT_DETAIL(offer.productSlug ?? offer.productId)), size: "sm", weight: "semibold", truncate: true, children: offer.productTitle ?? "Unknown Product" }), _jsx(Text, { className: "mt-0.5", color: "muted", size: "xs", children: relativeTime(offer.createdAt) })] }), _jsx(Badge, { variant: statusVariant(offer.status), size: "xs", className: "shrink-0 capitalize", children: offer.status })] }), _jsxs(Row, { wrap: true, gap: "md", children: [_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Listed" }), _jsx(Text, { size: "sm", weight: "medium", color: "muted", children: formatRupees(offer.listedPrice) })] }), _jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Your Offer" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: formatRupees(offer.offerAmount) })] }), offer.counterAmount != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Seller Counter" }), _jsx(Text, { className: CLS_COUNTER_AMOUNT, children: formatRupees(offer.counterAmount) })] })), offer.lockedPrice != null && (_jsxs(Div, { children: [_jsx(Text, { className: "tracking-wide", color: "faint", size: "xs", transform: "uppercase", children: "Agreed Price" }), _jsx(Text, { className: "text-success", size: "sm", weight: "semibold", children: formatRupees(offer.lockedPrice) })] }))] }), offer.sellerNote && (_jsxs(Text, { className: "italic", color: "muted", size: "xs", children: ["Seller note: \"", offer.sellerNote, "\""] })), offer.status === "countered" && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "text-info", size: "xs", weight: "medium", children: ["Seller countered at ", formatRupees(offer.counterAmount), ". Accept or withdraw your offer."] }), _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onAcceptCounter(offer.id), { status: "accepted", lockedPrice: offer.counterAmount }), disabled: isPending, children: isPending ? "Accepting…" : `Accept ${formatRupees(offer.counterAmount)}` }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20", children: "Withdraw" })] })] })), offer.status === "accepted" && onCheckout && (_jsx(Button, { size: "sm", variant: "primary", onClick: () => act(() => onCheckout(offer.id), { status: "paid" }), disabled: isPending, children: isPending ? "Processing…" : "Checkout at Agreed Price" })), offer.status === "pending" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming("withdraw"), disabled: isPending, className: "text-error border border-error/20 text-[length:var(--appkit-text-xs)]", children: "Withdraw Offer" })), confirming === "withdraw" && (_jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: "ghost", onClick: () => act(() => onWithdraw(offer.id), { status: "withdrawn" }), disabled: isPending, className: "text-error border border-error/20", children: isPending ? "Withdrawing…" : "Confirm Withdraw" }), _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setConfirming(null), disabled: isPending, children: "Cancel" })] })), error && _jsx(Alert, { variant: "error", children: _jsx(Text, { size: "xs", children: error }) })] }));
 }
 export function UserOffersPanel({ fetchEndpoint = ACCOUNT_ENDPOINTS.OFFERS, onAcceptCounter, onWithdraw, onCheckout, className = "", }) {
     const [offers, setOffers] = useState([]);
@@ -92,7 +94,7 @@ export function UserOffersPanel({ fetchEndpoint = ACCOUNT_ENDPOINTS.OFFERS, onAc
         }
         catch (err) {
             void normalizeError(err);
-            setFetchError(err instanceof Error ? err.message : "Failed to load offers.");
+            setFetchError(toUserMessage(err?.code, undefined, { fallback: "Failed to load offers." }));
         }
         finally {
             setLoading(false);

package/dist/features/admin/components/AdminActionIndexView.js

@@ -27,10 +27,12 @@ import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import React from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useApiMutation } from "@mohasinac/appkit/client";
-import { Alert, Badge, Row, Span, Stack, Text, Toggle, useToast } from "../../../ui/index.js";
+import { Alert, Badge, Row, Span, Stack, Text, TextLink, Toggle, useToast } from "../../../ui/index.js";
 import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { DataListingView } from "./DataListingView.js";
+import { QuickEditMenu } from "./QuickEditMenu.js";
+import { actionIndexOverrideSchema, splitKeywords, joinKeywords, ACTION_INDEX_OVERRIDE_FIELDS, } from "../schemas/action-index-form.js";
 const ENDPOINT = ADMIN_ENDPOINTS.ACTION_INDEX;
 export function AdminActionIndexView({ labels = {} }) {
     const queryClient = useQueryClient();
@@ -41,7 +43,12 @@ export function AdminActionIndexView({ labels = {} }) {
         staleTime: 60000,
     });
     const payload = query.data?.data;
-    const overrides = payload?.control?.entries ?? {};
+    /*
+     * Memoised because the `?? {}` fallback is a fresh object every render,
+     * which makes the `rows` memo below rebuild on every render — it reads
+     * `overrides` for each entry's effective `enabled`.
+     */
+    const overrides = React.useMemo(() => payload?.control?.entries ?? {}, [payload?.control?.entries]);
     const toggleMutation = useApiMutation({
         errorMessage: "Could not update that entry.",
         mutationFn: async (vars) => apiClient.patch(ENDPOINT, {
@@ -53,6 +60,44 @@ export function AdminActionIndexView({ labels = {} }) {
             void queryClient.invalidateQueries({ queryKey: ["admin", "action-index"] });
         },
     });
+    /*
+     * Spread the EXISTING override first, exactly as the toggle does. The
+     * endpoint's `setOverride` replaces the whole override object, so sending
+     * only the edited fields would silently clear this entry's `enabled` —
+     * re-showing something an admin had deliberately hidden.
+     */
+    const overrideMutation = useApiMutation({
+        errorMessage: "Could not save that entry.",
+        mutationFn: async (vars) => {
+            const parsed = actionIndexOverrideSchema.parse(vars.values);
+            return apiClient.patch(ENDPOINT, {
+                entryId: vars.entryId,
+                override: {
+                    ...overrides[vars.entryId],
+                    label: parsed.label,
+                    description: parsed.description,
+                    keywords: splitKeywords(parsed.keywords),
+                    weight: parsed.weight,
+                },
+            });
+        },
+        onSuccess: () => {
+            showToast("Entry saved.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "action-index"] });
+        },
+    });
+    /** Named so the row-action array stays a flat list of declarations. */
+    const saveOverride = React.useCallback(async (entryId, values) => {
+        await overrideMutation.mutateAsync({ entryId, values });
+    }, [overrideMutation]);
+    const clearMutation = useApiMutation({
+        errorMessage: "Could not reset that entry.",
+        mutationFn: async (entryId) => apiClient.patch(ENDPOINT, { entryId, clear: true }),
+        onSuccess: () => {
+            showToast("Entry reset to its code default.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "action-index"] });
+        },
+    });
     /*
      * Ordered by weight, then label — the same ranking `matchesNavQuery` gives
      * the search, so the admin reading this list sees entries in the order a
@@ -69,6 +114,10 @@ export function AdminActionIndexView({ labels = {} }) {
         href: `${entry.href}${entry.deepLink ?? ""}`,
         permission: entry.requiredPermission ?? "—",
         enabled: overrides[entry.id]?.enabled !== false,
+        // Seeds the edit drawer. `entry.*` is already override-merged by
+        // `mergeActionIndex`, so these are the effective values an admin sees.
+        keywords: joinKeywords(entry.keywords),
+        weight: entry.weight ?? 0,
     })), [payload?.entries, overrides]);
     const sync = payload?.sync;
     return (_jsxs(Stack, { gap: "md", children: [sync && sync.orphanedOverrides.length > 0 && (_jsxs(Alert, { variant: "warning", title: "Overrides with no entry", children: [sync.orphanedOverrides.length, " saved override", sync.orphanedOverrides.length === 1 ? "" : "s", " point at entries the code no longer has (", sync.orphanedOverrides.slice(0, 4).join(", "), sync.orphanedOverrides.length > 4 ? "…" : "", "). They are ignored \u2014 clear them when convenient."] })), _jsx(DataListingView, { config: {
@@ -109,9 +158,19 @@ export function AdminActionIndexView({ labels = {} }) {
                         },
                         { key: "portal", header: "Portal" },
                         {
+                            /*
+                             * A LINK, not mono text.
+                             *
+                             * This row IS a destination — "where is it" is half of what
+                             * this screen exists to answer, and the answer was printed as
+                             * inert text beside a toggle. The link is also what makes the
+                             * row reachable at all: every other column is metadata about
+                             * the entry, so without it there is no way to go look at the
+                             * thing being enabled or disabled.
+                             */
                             key: "href",
                             header: "Goes to",
-                            render: (row) => (_jsx(Span, { size: "xs", family: "mono", color: "muted", children: row.href })),
+                            render: (row) => (_jsx(TextLink, { href: row.href, size: "xs", onClick: (e) => e.stopPropagation(), children: _jsx(Span, { size: "xs", family: "mono", children: row.href }) })),
                         },
                         {
                             key: "permission",
@@ -121,8 +180,44 @@ export function AdminActionIndexView({ labels = {} }) {
                         {
                             key: "enabled",
                             header: "Shown",
-                            render: (row) => (_jsx(Row, { align: "center", gap: "sm", children: _jsx(Toggle, { checked: row.enabled, size: "sm", "aria-label": `Show ${row.primary}`, onChange: (next) => toggleMutation.mutate({ entryId: row.id, enabled: next }) }) })),
+                            render: (row) => (_jsx(Row, { align: "center", gap: "sm", children: _jsx(Toggle, { checked: row.enabled, size: "sm", ariaLabel: `Show ${row.primary} in navigation and search`, onChange: (next) => toggleMutation.mutate({ entryId: row.id, enabled: next }) }) })),
                         },
                     ],
-                } }), _jsx(Text, { size: "xs", color: "muted", children: "Hiding an entry removes it from the sidebar, the header search and the command palette at once. Labels, descriptions and keywords can be edited here; a route and its required permission belong to the code." })] }));
+                    /*
+                     * 🛑 This exists because the footer below already PROMISED it:
+                     * "Labels, descriptions and keywords can be edited here." They
+                     * could not. `PATCH /api/admin/action-index` has always accepted
+                     * `label` / `description` / `keywords` / `weight` in an override
+                     * (see `ActionIndexOverride`), and the only control on this screen
+                     * was the Shown toggle — so the sentence described a capability the
+                     * server had and the UI had never grown. Root Cause #51's shape: a
+                     * label describing something other than what the surface does.
+                     *
+                     * `href`, `kind` and every permission field stay out, per the
+                     * component docstring: repointing a built-in route is routing, and
+                     * relaxing a permission is access control.
+                     */
+                    renderRowActions: (row) => (_jsx(QuickEditMenu, { actions: [
+                            {
+                                label: "Edit entry",
+                                formTitle: `Edit "${row.primary}"`,
+                                schema: actionIndexOverrideSchema,
+                                fields: ACTION_INDEX_OVERRIDE_FIELDS,
+                                defaultValues: {
+                                    label: row.primary,
+                                    description: row.secondary,
+                                    keywords: row.keywords,
+                                    weight: row.weight,
+                                },
+                                onSubmit: (values) => saveOverride(row.id, values),
+                                submitLabel: "Save entry",
+                            },
+                            {
+                                label: "Reset to code default",
+                                separator: true,
+                                destructive: true,
+                                onClick: () => clearMutation.mutate(row.id),
+                            },
+                        ] })),
+                } }), _jsx(Text, { size: "xs", color: "muted", children: "Hiding an entry removes it from the sidebar, the header search and the command palette at once. Use the row menu to edit an entry\u2019s label, description, keywords and search weight, or to reset it to its code default; a route and its required permission belong to the code." })] }));
 }

package/dist/features/admin/components/AdminAddressClustersView.js

@@ -2,7 +2,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useQuery } from "@tanstack/react-query";
 import { useQueryClient } from "@tanstack/react-query";
-import { Badge, Button, Div, Heading, Row, Span, Stack, Text, useToast } from "../../../ui/index.js";
+import { Badge, Button, Div, Heading, Row, Span, Stack, Text, TextLink, useToast } from "../../../ui/index.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { apiClient } from "../../../http/index.js";
 import { useApiMutation } from "@mohasinac/appkit/client";
@@ -31,6 +32,24 @@ export function AdminAddressClustersView(_props) {
             void queryClient.invalidateQueries({ queryKey: ["admin", "address-clusters"] });
         },
     });
+    /*
+     * 🛑 "Flag Suspicious" was ONE-WAY: there was no unflag, so a wrong call —
+     * or a cluster that turned out to be a family sharing an address — left a
+     * permanent mark with no way back from this screen.
+     *
+     * `clear_ban` has existed on the route the whole time and calls
+     * `clearBanById`; only the control was missing.
+     */
+    const clearFlagMutation = useApiMutation({
+        errorMessage: "Failed to clear that flag.",
+        mutationFn: async (id) => {
+            await apiClient.patch(ADMIN_ENDPOINTS.ADDRESS_BY_ID(id), { action: "clear_ban" });
+        },
+        onSuccess: () => {
+            showToast("Flag cleared.", "success");
+            void queryClient.invalidateQueries({ queryKey: ["admin", "address-clusters"] });
+        },
+    });
     const clusters = data?.clusters ?? [];
-    return (_jsxs(Stack, { gap: "lg", padding: "page", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", color: "primary", children: "Address Clusters" }), _jsx(Text, { size: "sm", color: "muted", className: "mt-1", children: "Users sharing the same physical address. Flagging is informational only \u2014 users are not blocked." })] }), isLoading && (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), error && (_jsx(Div, { surface: "danger-surface", color: "error", padding: "inline", rounded: "xl", textSize: "sm", children: "Failed to load clusters." })), !isLoading && clusters.length === 0 && (_jsx(Div, { surface: "muted", padding: "y-4xl", rounded: "xl", className: "text-center", children: _jsx(Text, { color: "muted", size: "sm", children: "No shared addresses found." }) })), clusters.map((cluster) => (_jsxs(Stack, { surface: "card", padding: "md", gap: "md", rounded: "xl", border: "default", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Text, { size: "xs", color: "muted", weight: "medium", children: "Hash" }), _jsx(Span, { size: "xs", color: "muted", className: "font-mono truncate max-w-xs", children: cluster.addressHash })] }), _jsxs(Badge, { variant: "secondary", size: "sm", children: [cluster.addresses.length, " accounts"] })] }), _jsx(Stack, { gap: "xs", children: cluster.addresses.map((addr) => (_jsxs(Row, { justify: "between", align: "center", gap: "sm", surface: "muted", padding: "inlineSm", rounded: "lg", children: [_jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsxs(Text, { size: "sm", weight: "medium", color: "primary", className: "truncate", children: [addr.ownerType === "user" ? "User" : "Store", ": ", addr.ownerId] }), addr.city && (_jsx(Text, { size: "xs", color: "muted", children: [addr.city, addr.state, addr.postalCode].filter(Boolean).join(", ") }))] }), _jsxs(Row, { gap: "xs", align: "center", children: [addr.banStatus && (_jsx(Badge, { variant: BAN_BADGE[addr.banStatus] ?? "secondary", size: "sm", children: addr.banStatus.replace(/_/g, " ") })), addr.banStatus !== "suspicious" && (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => flagMutation.mutate(addr.id), disabled: flagMutation.isPending, children: "Flag Suspicious" }))] })] }, addr.id))) })] }, cluster.addressHash)))] }));
+    return (_jsxs(Stack, { gap: "lg", padding: "page", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Heading, { level: 2, size: "lg", weight: "semibold", color: "primary", children: "Address Clusters" }), _jsx(Text, { size: "sm", color: "muted", className: "mt-1", children: "Users sharing the same physical address. Flagging is informational only \u2014 users are not blocked." })] }), isLoading && (_jsx(Row, { justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), error && (_jsx(Div, { surface: "danger-surface", color: "error", padding: "inline", rounded: "xl", textSize: "sm", children: "Failed to load clusters." })), !isLoading && clusters.length === 0 && (_jsx(Div, { surface: "muted", padding: "y-4xl", rounded: "xl", className: "text-center", children: _jsx(Text, { color: "muted", size: "sm", children: "No shared addresses found." }) })), clusters.map((cluster) => (_jsxs(Stack, { surface: "card", padding: "md", gap: "md", rounded: "xl", border: "default", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", children: [_jsxs(Stack, { gap: "none", children: [_jsx(Text, { size: "xs", color: "muted", weight: "medium", children: "Hash" }), _jsx(Span, { size: "xs", color: "muted", className: "font-mono truncate max-w-xs", children: cluster.addressHash })] }), _jsxs(Badge, { variant: "secondary", size: "sm", children: [cluster.addresses.length, " accounts"] })] }), _jsx(Stack, { gap: "xs", children: cluster.addresses.map((addr) => (_jsxs(Row, { justify: "between", align: "center", gap: "sm", surface: "muted", padding: "inlineSm", rounded: "lg", children: [_jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsxs(TextLink, { href: addr.ownerType === "user" ? String(ROUTES.ADMIN.USER_DETAIL(addr.ownerId)) : String(ROUTES.ADMIN.STORE_DETAIL(addr.ownerId)), size: "sm", weight: "medium", truncate: true, children: [addr.ownerType === "user" ? "User" : "Store", ": ", addr.ownerId] }), addr.city && (_jsx(Text, { size: "xs", color: "muted", children: [addr.city, addr.state, addr.postalCode].filter(Boolean).join(", ") }))] }), _jsxs(Row, { gap: "xs", align: "center", children: [addr.banStatus && (_jsx(Badge, { variant: BAN_BADGE[addr.banStatus] ?? "secondary", size: "sm", children: addr.banStatus.replace(/_/g, " ") })), addr.banStatus === "suspicious" ? (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => clearFlagMutation.mutate(addr.id), disabled: clearFlagMutation.isPending, children: "Clear flag" })) : (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => flagMutation.mutate(addr.id), disabled: flagMutation.isPending, children: "Flag Suspicious" }))] })] }, addr.id))) })] }, cluster.addressHash)))] }));
 }

package/dist/features/admin/components/AdminBlogEditorView.js

@@ -201,13 +201,13 @@ export function AdminBlogEditorView({ postId, onSaved, onDeleted, embedded, ...r
             required: true,
             quick: true,
             fields: ["title", "slug", "excerpt", "content"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Content" }), _jsx(Input, { label: "Title", value: values.title, onChange: (e) => {
+            render: ({ values, onChange, errors }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Content" }), _jsx(Input, { label: "Title", error: errors.title, value: values.title, onChange: (e) => {
                             const v = e.target.value;
                             onChange({ title: v, ...(!slugManual && { slug: toSlug(v) }) });
-                        }, placeholder: "e.g. How to Grade Pok\u00E9mon Cards" }), _jsx(Input, { label: "Slug", value: values.slug, onChange: (e) => {
+                        }, placeholder: "e.g. How to Grade Pok\u00E9mon Cards" }), _jsx(Input, { label: "Slug", error: errors.slug, value: values.slug, onChange: (e) => {
                             setSlugManual(true);
                             onChange({ slug: e.target.value });
-                        }, placeholder: "blog-how-to-grade-pokemon-cards", helperText: "Auto-generated from title. Must start with 'blog-'." }), _jsx(Input, { label: "Excerpt", value: values.excerpt, onChange: (e) => onChange({ excerpt: e.target.value }), placeholder: "Short summary shown in listings and cards" }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Content" }), _jsx(RichTextEditor, { ariaLabel: "Content", value: values.content, onChange: (v) => onChange({ content: v }), placeholder: "Write your article here...", minHeightClassName: "min-h-[320px]" })] })] })),
+                        }, placeholder: "blog-how-to-grade-pokemon-cards", helperText: "Auto-generated from title. Must start with 'blog-'." }), _jsx(Input, { label: "Excerpt", error: errors.excerpt, value: values.excerpt, onChange: (e) => onChange({ excerpt: e.target.value }), placeholder: "Short summary shown in listings and cards" }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "Content" }), _jsx(RichTextEditor, { ariaLabel: "Content", value: values.content, onChange: (v) => onChange({ content: v }), placeholder: "Write your article here...", minHeightClassName: "min-h-[320px]" })] })] })),
         },
         {
             id: "media",
@@ -216,20 +216,20 @@ export function AdminBlogEditorView({ postId, onSaved, onDeleted, embedded, ...r
             // its children, which would abort an in-flight upload.
             keepMounted: true,
             fields: ["coverImage", "youtubeId"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Media" }), _jsx(ImageUpload, { label: "Cover Image", currentImage: values.coverImage, onUpload: (file) => upload(file, "blog", true, {
+            render: ({ values, onChange, errors }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Media" }), _jsx(ImageUpload, { label: "Cover Image", currentImage: values.coverImage, onUpload: (file) => upload(file, "blog", true, {
                             type: "blog-cover",
                             title: values.title || values.slug,
                             category: values.category,
-                        }), onChange: (url) => onChange({ coverImage: url }) }), _jsx(Input, { label: "YouTube Video ID (optional)", value: values.youtubeId, onChange: (e) => onChange({ youtubeId: e.target.value }), placeholder: "e.g. dQw4w9WgXcQ", helperText: "The 11-character video ID from the YouTube URL." })] })),
+                        }), onChange: (url) => onChange({ coverImage: url }) }), _jsx(Input, { label: "YouTube Video ID (optional)", error: errors.youtubeId, value: values.youtubeId, onChange: (e) => onChange({ youtubeId: e.target.value }), placeholder: "e.g. dQw4w9WgXcQ", helperText: "The 11-character video ID from the YouTube URL." })] })),
         },
         {
             id: "seo",
             label: "SEO & Tags",
             quick: true,
             fields: ["category", "tags", "metaTitle", "metaDescription"],
-            render: ({ values, onChange }) => {
+            render: ({ values, onChange, errors }) => {
                 const readTime = Math.max(1, Math.round(values.content.replace(/<[^>]*>/g, "").split(/\s+/).filter(Boolean).length / 200));
-                return (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "SEO & Tags" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Category", options: CATEGORY_OPTIONS, value: values.category, onValueChange: (v) => onChange({ category: v }) }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-1.5", size: "sm", weight: "medium", children: "Estimated Read Time" }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["~", readTime, " min (auto-calculated from content)"] })] })] }), _jsx(TagInput, { label: "Tags", value: values.tags, onChange: (t) => onChange({ tags: t }), placeholder: "e.g. pokemon, grading, tcg" }), _jsx(Input, { label: "Meta Title (optional)", value: values.metaTitle, onChange: (e) => onChange({ metaTitle: e.target.value }), placeholder: "Defaults to post title" }), _jsx(Input, { label: "Meta Description (optional)", value: values.metaDescription, onChange: (e) => onChange({ metaDescription: e.target.value }), placeholder: "SEO description \u2014 max 160 chars", maxLength: 160 })] }));
+                return (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "SEO & Tags" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Category", error: errors.category, options: CATEGORY_OPTIONS, value: values.category, onValueChange: (v) => onChange({ category: v }) }), _jsxs(Div, { children: [_jsx(Text, { className: "mb-1.5", size: "sm", weight: "medium", children: "Estimated Read Time" }), _jsxs(Text, { className: "text-[var(--appkit-color-text-muted)]", size: "sm", children: ["~", readTime, " min (auto-calculated from content)"] })] })] }), _jsx(TagInput, { label: "Tags", error: errors.tags, value: values.tags, onChange: (t) => onChange({ tags: t }), placeholder: "e.g. pokemon, grading, tcg" }), _jsx(Input, { label: "Meta Title (optional)", error: errors.metaTitle, value: values.metaTitle, onChange: (e) => onChange({ metaTitle: e.target.value }), placeholder: "Defaults to post title" }), _jsx(Input, { label: "Meta Description (optional)", error: errors.metaDescription, value: values.metaDescription, onChange: (e) => onChange({ metaDescription: e.target.value }), placeholder: "SEO description \u2014 max 160 chars", maxLength: 160 })] }));
             },
         },
         {
@@ -237,7 +237,7 @@ export function AdminBlogEditorView({ postId, onSaved, onDeleted, embedded, ...r
             label: "Publish",
             quick: true,
             fields: ["status", "publishedAt", "authorName", "isFeatured"],
-            render: ({ values, onChange }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Publish Settings" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Status", options: STATUS_OPTIONS, value: values.status, onValueChange: (v) => onChange({ status: v }) }), _jsx(Input, { label: "Publish date (optional)", value: values.publishedAt, onChange: (e) => onChange({ publishedAt: e.target.value }), type: "date", helperText: "Auto-set to now when publishing." })] }), _jsx(Input, { label: "Author Name", value: values.authorName, onChange: (e) => onChange({ authorName: e.target.value }), placeholder: "Author display name" }), _jsx(Toggle, { label: "Featured post", checked: values.isFeatured, onChange: (checked) => onChange({ isFeatured: checked }) }), isEdit && (_jsx(Div, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", children: _jsx(Button, { type: "button", variant: "danger", size: "sm", onClick: () => setShowDeleteConfirm(true), isLoading: deleteMutation.isPending, children: "Delete post" }) }))] })),
+            render: ({ values, onChange, errors }) => (_jsxs(Stack, { gap: "5", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Publish Settings" }), _jsxs(Div, { layout: "grid", gap: "4", className: "grid-cols-2", children: [_jsx(Select, { label: "Status", error: errors.status, options: STATUS_OPTIONS, value: values.status, onValueChange: (v) => onChange({ status: v }) }), _jsx(Input, { label: "Publish date (optional)", error: errors.publishedAt, value: values.publishedAt, onChange: (e) => onChange({ publishedAt: e.target.value }), type: "date", helperText: "Auto-set to now when publishing." })] }), _jsx(Input, { label: "Author Name", error: errors.authorName, value: values.authorName, onChange: (e) => onChange({ authorName: e.target.value }), placeholder: "Author display name" }), _jsx(Toggle, { label: "Featured post", checked: values.isFeatured, onChange: (checked) => onChange({ isFeatured: checked }) }), isEdit && (_jsx(Div, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", children: _jsx(Button, { type: "button", variant: "danger", size: "sm", onClick: () => setShowDeleteConfirm(true), isLoading: deleteMutation.isPending, children: "Delete post" }) }))] })),
         },
     ];
     const deleteModal = (_jsx(ConfirmDeleteModal, { isOpen: showDeleteConfirm, onConfirm: () => {

package/dist/features/admin/components/AdminCarouselEditorView.js

@@ -224,7 +224,7 @@ export function AdminCarouselEditorView({ slideId, onSaved, onDeleted, onCancel,
             label: "Slide info",
             required: true,
             fields: ["title", "active", "order", "settings"],
-            render: () => (_jsxs(Stack, { gap: "md", children: [_jsx(FieldInput, { name: "title", label: "Title", value: title, onChange: (v) => setTitle(v), required: true, placeholder: "e.g. Hot Wheels RLC Exclusives" }), _jsx(Toggle, { label: "Active (visible on homepage)", checked: active, onChange: setActive }), _jsx(Input, { label: "Display order", type: "number", value: order, onChange: (e) => setOrder(e.target.value), min: 0, placeholder: "1" }), _jsx(Select, { label: "Slide height", value: height, onChange: (e) => setHeight(e.target.value), options: HEIGHT_OPTIONS }), _jsx(Input, { label: "Autoplay delay (ms)", type: "number", value: autoplayDelayMs, onChange: (e) => setAutoplayDelayMs(e.target.value), min: 1000, max: 15000, placeholder: "4000", helperText: "How long this slide shows before auto-advancing. Default: 4000 ms." })] })),
+            render: () => (_jsxs(Stack, { gap: "md", children: [_jsx(FieldInput, { name: "title", label: "Title", value: title, onChange: (v) => setTitle(v), required: true, placeholder: "e.g. Hot Wheels RLC Exclusives" }), _jsx(Toggle, { label: "Active (visible on homepage)", checked: active, onChange: setActive }), _jsx(Input, { label: "Display order", error: form.shellCtx.errors.order, type: "number", value: order, onChange: (e) => setOrder(e.target.value), min: 0, placeholder: "1" }), _jsx(Select, { label: "Slide height", value: height, onChange: (e) => setHeight(e.target.value), options: HEIGHT_OPTIONS }), _jsx(Input, { label: "Autoplay delay (ms)", type: "number", value: autoplayDelayMs, onChange: (e) => setAutoplayDelayMs(e.target.value), min: 1000, max: 15000, placeholder: "4000", helperText: "How long this slide shows before auto-advancing. Default: 4000 ms." })] })),
         },
         {
             id: "background",