@mohasinac/appkit 4.61.0 → 4.62.1

package/dist/features/admin/components/OwnerQuickActions.js

@@ -236,6 +236,28 @@ export function OwnerQuickActions({ resource, editHref, onDelete, onClone, owner
      * 🛑 `inline-flex`, never `w-full`. In normal flow this must shrink to its
      * own content — a full-width bar would read as a section divider and would
      * stretch across a card body it is only a corner of.
+     *
+     * 🛑 `shrink-0` IS THE MOBILE FIX, and it is one word because the bug was
+     * one missing word.
+     *
+     * A flex item's default is `flex-shrink: 1`, so in the title/actions row
+     * this toolbar lives in — `<Row justify="between">` with an `<h1>` on the
+     * left — the heading and the toolbar compete for width, and at ~390px the
+     * toolbar LOSES. It compresses below its own content: the icons slide under
+     * each other, the padding collapses, and the 44px tap targets stop being
+     * 44px wide. That is the "works incorrectly on mobile" report.
+     *
+     * With `shrink-0` the toolbar keeps its intrinsic size and the HEADING gives
+     * way instead — which is right, because a heading wraps gracefully onto a
+     * second line and a row of hit targets does not.
+     *
+     * 🛑 Note what this is NOT: the desktop fix (`d94496c42`) gave the toolbar a
+     * container and added an audit whose two rules are about DOM ORDER — must
+     * come after the `<h1>`, must not share the heading's row unless that row is
+     * `justify="between"`. Both pass here. R2's exemption actively WHITELISTS
+     * the layout that breaks, so the surfaces that satisfy that audit are
+     * precisely the ones most likely to be wrong at phone width. A source-order
+     * rule cannot see a width problem.
      */
     const boxClass = onDark
         ? /*
@@ -244,12 +266,12 @@ export function OwnerQuickActions({ resource, editHref, onDelete, onClone, owner
            * LIGHT background in every light theme, so a themed box on a dark hero
            * photo is a white rectangle over the artwork.
            */
-            "inline-flex rounded-[var(--appkit-radius-lg)] bg-black/55 backdrop-blur-sm p-[var(--appkit-space-1)] shadow-md"
+            "inline-flex shrink-0 rounded-[var(--appkit-radius-lg)] bg-black/55 backdrop-blur-sm p-[var(--appkit-space-1)] shadow-md"
         : /*
            * Off media: the real surface tokens, so it inverts with the theme
            * instead of being a fixed near-white that disappears in dark mode.
            */
-            "inline-flex rounded-[var(--appkit-radius-lg)] bg-[var(--appkit-color-surface-elevated)] border border-[var(--appkit-color-border)] p-[var(--appkit-space-1)] shadow-sm";
+            "inline-flex shrink-0 rounded-[var(--appkit-radius-lg)] bg-[var(--appkit-color-surface-elevated)] border border-[var(--appkit-color-border)] p-[var(--appkit-space-1)] shadow-sm";
     return (_jsxs(_Fragment, { children: [_jsxs(Row, { gap: "xs", align: "center", className: `${boxClass} ${className}`.trim(), 
                 /*
                  * Stops the click reaching an ancestor `<Link>` or the card's own

package/dist/features/admin/components/ReferenceRecordEditor.js

@@ -64,7 +64,7 @@ export function ReferenceRecordEditor({ endpoint, noun, fields, publicHref, }) {
             catch (err) {
                 const e = normalizeError(err);
                 if (!cancelled)
-                    setLoadError(e.message);
+                    setLoadError(toUserMessage(e?.code, undefined, { fallback: "Could not load that record." }));
             }
             finally {
                 if (!cancelled)

package/dist/features/admin/constants/filter-tabs.d.ts

@@ -457,6 +457,9 @@ export declare const ADMIN_COUPON_TYPE_TABS: readonly [{
 }, {
     readonly id: "buy_x_get_y";
     readonly label: "Buy X Get Y";
+}, {
+    readonly id: "points_earn";
+    readonly label: "Points Back";
 }];
 /** Empty-sentinel variant for views (like SellerBidsView) that drive the
  *  filter URL with `""` instead of `"All"` so the `"" == no filter` invariant
@@ -757,6 +760,9 @@ export declare const ADMIN_PAYMENT_CASE_KIND_TABS: readonly [{
 }, {
     readonly id: "shipping_unpriced";
     readonly label: "Shipping unpriced";
+}, {
+    readonly id: "courier_unavailable";
+    readonly label: "Courier unavailable";
 }, {
     readonly id: "dead_job";
     readonly label: "Dead job";

package/dist/features/admin/constants/filter-tabs.js

@@ -245,6 +245,11 @@ export const ADMIN_COUPON_TYPE_TABS = [
     { id: "fixed", label: "Fixed" },
     { id: "free_shipping", label: "Free Shipping" },
     { id: "buy_x_get_y", label: "Buy X Get Y" },
+    // D51. `audit-filter-tab-enums`' COVERAGE rule fails on a real union value
+    // with no chip — which is what it was extended to catch after ten such gaps
+    // were found at once (Root Cause #72), including sellers being unable to
+    // filter their own `in_review` listings.
+    { id: "points_earn", label: "Points Back" },
 ];
 // ---------------------------------------------------------------------------
 // Seller-dashboard filter-chip tab sets
@@ -441,6 +446,7 @@ export const ADMIN_PAYMENT_CASE_KIND_TABS = [
     { id: "protection_claim", label: "Protection claim" },
     { id: "grievance", label: "Grievance" },
     { id: "shipping_unpriced", label: "Shipping unpriced" },
+    { id: "courier_unavailable", label: "Courier unavailable" },
     { id: "dead_job", label: "Dead job" },
     { id: "ledger_drift", label: "Points drift" },
 ];

package/dist/features/admin/constants/site-settings-tabs.d.ts

@@ -102,7 +102,7 @@ export declare const SITE_SETTINGS_TABS: readonly [{
     readonly description: "Which listing types sellers may create, and their defaults.";
     readonly keywords: ["listing types", "auctions on", "enable", "categories"];
 }];
-export declare const SITE_SETTINGS_TAB_IDS: ("about" | "shipping" | "notifications" | "contact" | "auction" | "seo" | "listings" | "appearance" | "emi" | "gst" | "watermark" | "integrations" | "limits" | "announcement" | "branding" | "themes" | "fees" | "legal" | "procurement")[];
+export declare const SITE_SETTINGS_TAB_IDS: ("about" | "shipping" | "notifications" | "contact" | "auction" | "seo" | "listings" | "emi" | "legal" | "appearance" | "gst" | "watermark" | "integrations" | "limits" | "announcement" | "branding" | "themes" | "fees" | "procurement")[];
 /**
  * The union `?tab=` is validated against.
  *

package/dist/features/admin/hooks/useAdminListingData.js

@@ -2,6 +2,9 @@
 import { useQuery } from "@tanstack/react-query";
 import { apiClient, ApiClientError } from "../../../http/index.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
+// The defining module, not a barrel (Root Cause #18). `hasEncPrefix` is a pure
+// string test with no crypto in its import chain, so it is client-safe.
+import { hasEncPrefix } from "../../../security/pii-mask.js";
 function withQueryParams(endpoint, params) {
     const hasQuery = endpoint.includes("?");
     const query = new URLSearchParams(params).toString();
@@ -50,6 +53,19 @@ export function toRecordArray(value) {
 }
 export function toStringValue(value, fallback = "-") {
     if (typeof value === "string") {
+        /*
+         * 🛑 Ciphertext is not a display value. See the twin in
+         * `features/seller/hooks/useSellerListingData.ts` for the full account —
+         * the short version is that `mapDoc` does not decrypt, so a route that
+         * forgets `revealOrders`/`maskedOrders` hands this a stored `enc:v1:…`
+         * blob which is a perfectly ordinary `string` and renders verbatim.
+         *
+         * `/api/admin/orders` already hit this ("measured live at 3 visible
+         * `enc:v1:` strings") and fixed it at the route. This is the backstop for
+         * the next one.
+         */
+        if (hasEncPrefix(value))
+            return fallback;
         return value.trim() || fallback;
     }
     if (typeof value === "number" || typeof value === "boolean") {

package/dist/features/admin/hooks/useOptimisticRowFlag.d.ts

@@ -0,0 +1,33 @@
+import { type QueryKey } from "@tanstack/react-query";
+export interface UseOptimisticRowFlagOptions<T> {
+    /**
+     * Performs the write. Receives the row id and the value being set.
+     *
+     * 🛑 Send ONLY the field being changed. Several of this hook's consumers sit
+     * over repositories that merge a `config`/nested object by READING the
+     * document first; omitting that field short-circuits the read, so a toggle
+     * costs one write and no read.
+     */
+    mutate: (id: string, next: T) => Promise<unknown>;
+    /**
+     * Query keys to invalidate. Pass every key that renders this field —
+     * several of these records are read by a PUBLIC surface under a key of its
+     * own, and forgetting it leaves the storefront stale until its own TTL.
+     */
+    invalidate: readonly QueryKey[];
+    /** Toast copy. Receives the value that was set. */
+    successMessage: (next: T) => string;
+    /** Fallback when the thrown error carries no message. */
+    errorMessage?: string;
+}
+export interface UseOptimisticRowFlagReturn<T> {
+    /** `overrides[id] ?? row.value` — the value to render. */
+    overrides: Record<string, T>;
+    /** Resolve a row's current value against any pending override. */
+    resolve: (id: string, serverValue: T) => T;
+    /** The id currently being written, for a per-row disabled state. */
+    pendingId: string | null;
+    /** Fire the change. Safe to call from an `onChange` without awaiting. */
+    set: (id: string, next: T) => Promise<void>;
+}
+export declare function useOptimisticRowFlag<T>({ mutate, invalidate, successMessage, errorMessage, }: UseOptimisticRowFlagOptions<T>): UseOptimisticRowFlagReturn<T>;

package/dist/features/admin/hooks/useOptimisticRowFlag.js

@@ -0,0 +1,87 @@
+"use client";
+/*
+ * WHY: Eight listing views grew the same per-row "flip one field" control in
+ *      one change — homepage sections (`enabled`), carousel slides (`active`),
+ *      the six seller listing-type pages (`status`), seller bundles, grouped
+ *      listings, store categories, shipping configs and payout methods
+ *      (`isActive`). Every one needs an optimistic override so the switch
+ *      moves under the finger, a PATCH, an invalidate, and a rollback.
+ *
+ *      That is well past the Duplication Framework's Rule of Three, and the
+ *      bug-fix multiplier is the real argument: the rollback is subtly wrong
+ *      in the shape everyone writes first.
+ *
+ * 🛑 THE ROLLBACK BUG THIS EXISTS TO MAKE UNREPEATABLE
+ *
+ * The obvious implementation captures the previous override and writes it
+ * back on failure:
+ *
+ *     const prev = overrides[id];              // `undefined` on a row's
+ *     setOverrides((o) => ({...o, [id]: v}));  // FIRST toggle
+ *     catch { setOverrides((o) => ({...o, [id]: prev})); }
+ *
+ * `prev` is `undefined` the first time any given row is toggled, and writing
+ * `undefined` back is not the same as removing the key — a reader doing
+ * `overrides[id] ?? row.value` gets `undefined`, which for a boolean renders
+ * as `false`. So a FAILED toggle of a row the server holds as `true` leaves
+ * the UI asserting the opposite of the truth, which is worse than not having
+ * rolled back at all. `AdminProductsView.tsx` has this shape.
+ *
+ * The fix is to DELETE the key, which is what `clear` below does.
+ *
+ * 🛑 The key is cleared on SUCCESS too, and only AFTER the invalidation has
+ * settled. `invalidateQueries` resolves once active refetches finish, so by
+ * then `mapRows` is already reading the fresh server value and there is no
+ * visible flip-back-then-forward. An override that is never cleared pins the
+ * row forever and masks every later server-side change to it.
+ *
+ * EXPORTS: useOptimisticRowFlag, UseOptimisticRowFlagOptions
+ *
+ * @tag domain:admin,seller
+ * @tag layer:hook
+ * @tag pattern:none
+ * @tag access:client
+ * @tag consumers:AdminSectionsView,AdminCarouselView,SellerListingTypeView,SellerBundlesView,SellerGroupedListingsView,SellerStoreCategoriesView,SellerShippingConfigsView,SellerPayoutMethodsView
+ * @tag sideEffects:network
+ */
+import React from "react";
+import { useQueryClient } from "@tanstack/react-query";
+import { useToast } from "../../../ui/index.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+export function useOptimisticRowFlag({ mutate, invalidate, successMessage, errorMessage = "Could not save that change.", }) {
+    const queryClient = useQueryClient();
+    const { showToast } = useToast();
+    const [overrides, setOverrides] = React.useState({});
+    const [pendingId, setPendingId] = React.useState(null);
+    const clear = React.useCallback((id) => {
+        setOverrides((prev) => {
+            if (!(id in prev))
+                return prev;
+            const next = { ...prev };
+            // DELETE, never write back a captured value — see the header.
+            delete next[id];
+            return next;
+        });
+    }, []);
+    const set = React.useCallback(async (id, next) => {
+        setOverrides((prev) => ({ ...prev, [id]: next }));
+        setPendingId(id);
+        try {
+            await mutate(id, next);
+            await Promise.all(invalidate.map((queryKey) => queryClient.invalidateQueries({ queryKey })));
+            clear(id);
+            showToast(successMessage(next), "success");
+        }
+        catch (err) {
+            const normalized = normalizeError(err);
+            clear(id);
+            showToast(toUserMessage(normalized.code, undefined, { fallback: errorMessage }), "error");
+        }
+        finally {
+            setPendingId(null);
+        }
+    }, [mutate, invalidate, queryClient, clear, showToast, successMessage, errorMessage]);
+    const resolve = React.useCallback((id, serverValue) => (id in overrides ? overrides[id] : serverValue), [overrides]);
+    return { overrides, resolve, pendingId, set };
+}

package/dist/features/admin/repository/notification.repository.d.ts

@@ -30,6 +30,21 @@ export declare class NotificationRepository extends BaseRepository<NotificationD
      * Get unread notification count for a user.
      */
     getUnreadCount(userId: string): Promise<number>;
+    /**
+     * Mark a single notification UNREAD again.
+     *
+     * 🛑 `readAt` is cleared, not left behind. It is the timestamp of a read
+     * that the caller is now saying did not happen, and a row that is
+     * `isRead: false` with a `readAt` set is a contradiction the next reader has
+     * to resolve — the digest and the unread badge key on `isRead`, so they
+     * would disagree with anything that looked at `readAt`.
+     *
+     * There was no way to do this at all: the buyer's notifications page offered
+     * only Mark-read, and the PATCH route hard-coded `markAsRead(id)` without
+     * reading a body — so a notification clicked by accident was gone from the
+     * unread list for good.
+     */
+    markAsUnread(id: string): Promise<NotificationDocument | null>;
     /**
      * Mark a single notification as read.
      */

package/dist/features/admin/repository/notification.repository.js

@@ -59,6 +59,38 @@ export class NotificationRepository extends BaseRepository {
             return 0;
         }
     }
+    /**
+     * Mark a single notification UNREAD again.
+     *
+     * 🛑 `readAt` is cleared, not left behind. It is the timestamp of a read
+     * that the caller is now saying did not happen, and a row that is
+     * `isRead: false` with a `readAt` set is a contradiction the next reader has
+     * to resolve — the digest and the unread badge key on `isRead`, so they
+     * would disagree with anything that looked at `readAt`.
+     *
+     * There was no way to do this at all: the buyer's notifications page offered
+     * only Mark-read, and the PATCH route hard-coded `markAsRead(id)` without
+     * reading a body — so a notification clicked by accident was gone from the
+     * unread list for good.
+     */
+    async markAsUnread(id) {
+        try {
+            const now = new Date();
+            await this.getCollection()
+                .doc(id)
+                .update(prepareForFirestore({
+                [NOTIFICATION_FIELDS.IS_READ]: false,
+                [NOTIFICATION_FIELDS.READ_AT]: null,
+                [NOTIFICATION_FIELDS.UPDATED_AT]: now,
+            }));
+            return this.findById(id);
+        }
+        catch (error) {
+            void normalizeError(error);
+            serverLogger.error("Failed to mark notification unread", { id, error });
+            throw error;
+        }
+    }
     /**
      * Mark a single notification as read.
      */

package/dist/features/admin/schemas/action-index-form.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import type { QuickFieldDef } from "../../shell/QuickFormDrawer";
+/**
+ * 🛑 `keywords` is a COMMA-SEPARATED STRING here, not an array.
+ *
+ * `QuickFormDrawer` has no array control — its field types are text / number
+ * / select / toggle / date / textarea / email / url. Declaring `z.string()`
+ * and splitting at the call site keeps the schema honest about what the form
+ * actually produces, rather than describing a shape no control can emit.
+ * `splitKeywords` below is the one place that conversion happens.
+ */
+export declare const actionIndexOverrideSchema: z.ZodObject<{
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    keywords: z.ZodOptional<z.ZodString>;
+    weight: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    label: string;
+    weight?: number | undefined;
+    description?: string | undefined;
+    keywords?: string | undefined;
+}, {
+    label: string;
+    weight?: number | undefined;
+    description?: string | undefined;
+    keywords?: string | undefined;
+}>;
+export type ActionIndexOverrideFormInput = z.infer<typeof actionIndexOverrideSchema>;
+/** The drawer's fields, in the order an admin reads them. */
+export declare const ACTION_INDEX_OVERRIDE_FIELDS: QuickFieldDef[];
+/** The single place the comma-separated field becomes the stored array. */
+export declare function splitKeywords(raw: string | undefined): string[] | undefined;
+/** The reverse, for seeding the form from a stored override. */
+export declare function joinKeywords(keywords: readonly string[] | undefined): string;

package/dist/features/admin/schemas/action-index-form.js

@@ -0,0 +1,115 @@
+/*
+ * WHY: `/admin/action-index` told admins "Labels, descriptions and keywords
+ *      can be edited here" while offering only a Shown toggle. The server has
+ *      always accepted those fields — `ActionIndexOverride` carries `label`,
+ *      `description`, `keywords` and `weight`, and `PATCH
+ *      /api/admin/action-index` writes them through `setOverride`. The UI had
+ *      simply never grown the control, so the sentence was a promise nothing
+ *      kept.
+ *
+ * WHAT: The write contract for ONE entry override, as edited from the admin
+ *       row action.
+ *
+ * ## What is deliberately absent
+ *
+ * `href`, `kind`, `portal` and every permission field. The view's own
+ * docstring draws this line and it is the right one: repointing a built-in
+ * route is routing, and relaxing a permission is access control. Neither
+ * belongs in a quick-edit drawer beside a label.
+ *
+ * `enabled` is also absent — it has its own control in the Shown column, and
+ * a second place to set it is a second source of truth for one boolean.
+ *
+ * EXPORTS:
+ *   actionIndexOverrideSchema, ActionIndexOverrideFormInput,
+ *   ACTION_INDEX_OVERRIDE_FIELDS
+ *
+ * @tag domain:admin,search
+ * @tag layer:schema
+ * @tag pattern:none
+ * @tag access:isomorphic
+ * @tag consumers:AdminActionIndexView
+ * @tag sideEffects:none
+ */
+import { z } from "zod";
+/**
+ * 🛑 `keywords` is a COMMA-SEPARATED STRING here, not an array.
+ *
+ * `QuickFormDrawer` has no array control — its field types are text / number
+ * / select / toggle / date / textarea / email / url. Declaring `z.string()`
+ * and splitting at the call site keeps the schema honest about what the form
+ * actually produces, rather than describing a shape no control can emit.
+ * `splitKeywords` below is the one place that conversion happens.
+ */
+export const actionIndexOverrideSchema = z.object({
+    label: z
+        .string()
+        .trim()
+        .min(1, "A label is required — it is what the sidebar and search show.")
+        .max(80, "Keep labels under 80 characters so they fit the sidebar."),
+    description: z
+        .string()
+        .trim()
+        .max(200, "Keep descriptions under 200 characters.")
+        .optional(),
+    keywords: z
+        .string()
+        .trim()
+        .max(300, "Keep the keyword list under 300 characters.")
+        .optional(),
+    /*
+     * Ranking, not ordering. Higher sorts first in the search and the command
+     * palette. Bounded because an unbounded weight is how one entry ends up
+     * permanently above every other and nobody remembers why.
+     */
+    weight: z.coerce
+        .number()
+        .int("Weight must be a whole number.")
+        .min(0, "Weight cannot be negative.")
+        .max(100, "Weight is capped at 100.")
+        .optional(),
+});
+/** The drawer's fields, in the order an admin reads them. */
+export const ACTION_INDEX_OVERRIDE_FIELDS = [
+    {
+        name: "label",
+        label: "Label",
+        type: "text",
+        required: true,
+        helperText: "What the sidebar, header search and command palette show.",
+    },
+    {
+        name: "description",
+        label: "Description",
+        type: "textarea",
+        placeholder: "One line explaining what this entry is for",
+    },
+    {
+        name: "keywords",
+        label: "Keywords",
+        type: "text",
+        placeholder: "refunds, returns, money back",
+        helperText: "Comma-separated. Extra words that should find this entry in search.",
+    },
+    {
+        name: "weight",
+        label: "Weight",
+        type: "number",
+        helperText: "Higher sorts first in search results. 0–100.",
+    },
+];
+/** The single place the comma-separated field becomes the stored array. */
+export function splitKeywords(raw) {
+    if (raw === undefined)
+        return undefined;
+    const parts = raw
+        .split(",")
+        .map((part) => part.trim())
+        .filter(Boolean);
+    // An empty box means "no keywords", which is `[]` — not "leave them alone".
+    return parts;
+}
+/** The reverse, for seeding the form from a stored override. */
+export function joinKeywords(keywords) {
+    return (keywords ?? []).join(", ");
+}

package/dist/features/admin/schemas/admin-user-form.d.ts

@@ -82,13 +82,13 @@ export declare const lotteryPullSchema: z.ZodObject<{
     userPhone: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
 }, "strip", z.ZodTypeAny, {
     transactionId: string;
-    sourceType: "event" | "product";
+    sourceType: "product" | "event";
     paymentTime: string;
     purchasedItemNumber: number;
     userPhone?: string | undefined;
 }, {
     transactionId: string;
-    sourceType: "event" | "product";
+    sourceType: "product" | "event";
     paymentTime: string;
     purchasedItemNumber: number;
     userPhone?: string | undefined;

package/dist/features/admin/schemas/firestore.d.ts

@@ -690,6 +690,36 @@ export interface SiteSettingsDocument extends BaseDocument {
     returns: {
         windowDays: number;
     };
+    /**
+     * The support integration's on/off switch.
+     *
+     * 🛑 The ONLY new integration flag. The other three the admin page switches
+     * already have an authoritative field — `payment.razorpayEnabled`,
+     * `messaging.emailEnabled` (which `guardSend` reads), and
+     * `shipping.provider`. Adding a parallel `integrationSwitches.*` beside
+     * those would be a denormalised mirror that drifts the first time one path
+     * writes only one of a pair (Root Cause #42), and the page would then
+     * disagree with the code that enforces it. The page is a VIEW over the real
+     * fields; this is the one field that did not exist.
+     *
+     * 🛑 Also not under `siteSettings.integrations` — that key is live and holds
+     * analytics/tag IDs (GA, FB Pixel, GTM).
+     *
+     * OFF hides the WHOLE support surface from BUYERS: no nav entry, no ticket
+     * list, no contact form. Staff keep full access, so an open ticket is still
+     * workable and the employee pay-per-ticket basis survives.
+     *
+     * 🛑 A buyer mid-conversation loses sight of their thread. That is the
+     * owner's decision, accepted knowingly — and the admin row must SAY it
+     * rather than implying the switch only stops new tickets.
+     *
+     * Defaults to `true`: support being reachable is the safe state, and a
+     * settings document written before this field existed must not read as
+     * "support is off".
+     */
+    support: {
+        enabled: boolean;
+    };
     faq: {
         variables: {
             shippingDays: number;

package/dist/features/admin/schemas/firestore.js

@@ -377,6 +377,11 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
     returns: {
         windowDays: 7,
     },
+    // Reachable is the safe default, and an older settings document with no
+    // `support` group must not read as "support is off".
+    support: {
+        enabled: true,
+    },
     announcementBar: {
         enabled: true,
         message: "🎉 Up to 15% Off on Pokémon TCG this week — Use code SAVE15",

package/dist/features/audit-log/schemas/firestore.d.ts

@@ -44,6 +44,21 @@ export declare const AdminAuditActionValues: {
      * same class as `payout_mark_paid` and `coupon_update`, which are both here.
      */
     readonly POINTS_ADJUST: "points_adjust";
+    /**
+     * Staff added a buyer-facing dispute reason.
+     *
+     * 🛑 Here because the list is POLICY VOCABULARY, even though no single row
+     * decides money. The reasons are what buyers are offered when something goes
+     * wrong, so the wording shapes what gets reported and how it is triaged —
+     * and a badly-worded or leading option is the kind of thing that is only
+     * ever noticed later, by which time "who added this, and when" is the
+     * question. `createdByName` on the row answers it for the list; this answers
+     * it in the one place an admin looks for "what have staff done lately".
+     *
+     * Recorded only on a REAL creation. Re-adding wording that already exists
+     * returns the existing row, which is not an act worth logging.
+     */
+    readonly DISPUTE_REASON_CREATE: "dispute_reason_create";
 };
 export type AdminAuditAction = (typeof AdminAuditActionValues)[keyof typeof AdminAuditActionValues];
 export interface AdminAuditLogDocument extends BaseDocument {
@@ -97,5 +112,20 @@ export declare const ADMIN_AUDIT_LOG_FIELDS: {
          * same class as `payout_mark_paid` and `coupon_update`, which are both here.
          */
         readonly POINTS_ADJUST: "points_adjust";
+        /**
+         * Staff added a buyer-facing dispute reason.
+         *
+         * 🛑 Here because the list is POLICY VOCABULARY, even though no single row
+         * decides money. The reasons are what buyers are offered when something goes
+         * wrong, so the wording shapes what gets reported and how it is triaged —
+         * and a badly-worded or leading option is the kind of thing that is only
+         * ever noticed later, by which time "who added this, and when" is the
+         * question. `createdByName` on the row answers it for the list; this answers
+         * it in the one place an admin looks for "what have staff done lately".
+         *
+         * Recorded only on a REAL creation. Re-adding wording that already exists
+         * returns the existing row, which is not an act worth logging.
+         */
+        readonly DISPUTE_REASON_CREATE: "dispute_reason_create";
     };
 };

package/dist/features/audit-log/schemas/firestore.js

@@ -42,6 +42,21 @@ export const AdminAuditActionValues = {
      * same class as `payout_mark_paid` and `coupon_update`, which are both here.
      */
     POINTS_ADJUST: "points_adjust",
+    /**
+     * Staff added a buyer-facing dispute reason.
+     *
+     * 🛑 Here because the list is POLICY VOCABULARY, even though no single row
+     * decides money. The reasons are what buyers are offered when something goes
+     * wrong, so the wording shapes what gets reported and how it is triaged —
+     * and a badly-worded or leading option is the kind of thing that is only
+     * ever noticed later, by which time "who added this, and when" is the
+     * question. `createdByName` on the row answers it for the list; this answers
+     * it in the one place an admin looks for "what have staff done lately".
+     *
+     * Recorded only on a REAL creation. Re-adding wording that already exists
+     * returns the existing row, which is not an act worth logging.
+     */
+    DISPUTE_REASON_CREATE: "dispute_reason_create",
 };
 export const ADMIN_AUDIT_LOG_FIELDS = {
     ACTOR_UID: "actorUid",

package/dist/features/auth/components/RegisterForm.js

@@ -11,6 +11,7 @@ import { FormShellContext, useFormShellState } from "../../../ui/forms/FormShell
 import { registerSchema, registerPasswordSchema } from "../schemas/index.js";
 import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary.js";
 import { SectionForm, useSectionFormNav } from "../../shell/SectionForm.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 const registerClientSchema = registerSchema.extend({
     displayName: z.string().min(1, "Enter your name"),
     confirmPassword: registerPasswordSchema,
@@ -81,7 +82,7 @@ export function RegisterForm({ onSubmit, isLoading = false, error, success, labe
              * email, a rejected password — which is the one thing they can act on.
              */
             const normalized = normalizeError(err);
-            setFieldError("email", normalized.message || "Registration failed");
+            setFieldError("email", toUserMessage(normalized.code, undefined, { fallback: "We couldn't create your account. Please check your details and try again." }));
         }
     };
     return (_jsx(Row, { className: `min-h-[60vh] ${className}`, align: "center", justify: "center", padding: "x-md", children: _jsxs(Stack, { className: "max-w-md w-full", gap: "lg", children: [_jsxs(Div, { className: "text-center", children: [_jsx(Row, { justify: "center", className: "mb-3", children: _jsx(SiteMark, { size: "lg" }) }), _jsx(Heading, { level: 1, className: "font-extrabold", size: "3xl", children: labels.title ?? "Create Account" }), (labels.subtitle || renderLoginLink) && (_jsxs(Text, { className: "mt-2 text-[var(--appkit-color-text-muted)]", size: "sm", children: [labels.subtitle ?? "Already have an account?", " ", renderLoginLink?.()] }))] }), success && (_jsx(Alert, { variant: "success", compact: true, children: success })), error && (_jsx(Alert, { variant: "error", compact: true, children: error })), _jsxs(FormShellContext.Provider, { value: shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: values, onChange: (partial) => setValues((prev) => Object.assign({}, prev, partial)), onSubmit: handleSubmit, schema: registerClientSchema, openIds: nav.openIds, onOpenChange: nav.setOpenIds, isLoading: isLoading, submitLabel: isLoading

package/dist/features/auth/permissions/constants.js

@@ -344,6 +344,19 @@ export const ROUTE_PERMISSION_MAP = {
     // Payment protection — admin-only, see the permission union's own 🛑 note.
     "/admin/money-cases": "admin:payment-cases:read",
     "/admin/protection-claims": "admin:protection-claims:read",
+    /*
+     * Phase 7 invoicing — the GSTR-1 draft export.
+     *
+     * 🛑 `settings:write` rather than a new permission, and that is a judgement
+     * worth stating. The page exports the company's tax position for a quarter
+     * plus every buyer's place of supply; the set of people who should see that
+     * is the set who can already change the GSTIN and the fee schedule, which is
+     * exactly what `settings:write` names. Minting
+     * `admin:invoicing:read` would add a permission with one route and one
+     * holder — a distinction with no decision behind it, which is how a
+     * permission union becomes unreadable.
+     */
+    "/admin/invoicing": "admin:settings:write",
 };
 /**
  * Every capability, as a runtime value.