@mohasinac/appkit 4.61.0 → 4.62.1

package/dist/features/seller/components/SellerShippingConfigsView.js

@@ -10,6 +10,8 @@ import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
 import { ROUTES } from "../../../constants/index.js";
 import { toRecordArray, toStringValue } from "../hooks/useSellerListingData.js";
+import { useOptimisticRowFlag } from "../../admin/hooks/useOptimisticRowFlag.js";
+import { apiClient } from "../../../http/index.js";
 import { DataListingView } from "../../admin/components/DataListingView.js";
 const DEFAULT_SORT = "-createdAt";
 const SORT_OPTIONS = [
@@ -40,6 +42,22 @@ const COLUMNS = [
     },
 ];
 export function SellerShippingConfigsView({ onCreateClick, onEditClick, onDelete, onSetDefault, }) {
+    /*
+     * 🛑 `isActive` was a READ-ONLY badge here, and the update schema was built
+     * to take it on its own — shipping-config's even says so in a comment: "a
+     * PATCH may legitimately carry only `isActive`". Nothing in the client had
+     * ever sent one, so flipping one boolean meant a full-editor round trip.
+     *
+     * The optimistic/rollback logic lives in the hook because eight listings
+     * grew this control at once; see its header for why rollback must DELETE
+     * the override key rather than write back a captured value.
+     */
+    const activeFlag = useOptimisticRowFlag({
+        mutate: (id, next) => apiClient.patch(SELLER_ENDPOINTS.SHIPPING_CONFIG_BY_ID(id), { isActive: next }),
+        invalidate: [["seller", "shipping-configs", "listing"]],
+        successMessage: (next) => (next ? "Shipping option activated." : "Shipping option deactivated."),
+        errorMessage: "Could not change that shipping option's status.",
+    });
     const [deleteTargetId, setDeleteTargetId] = useState(null);
     const { deletingId, handleDelete: performDelete } = useEntityDelete({
         endpoint: SELLER_ENDPOINTS.SHIPPING_CONFIG_BY_ID,
@@ -113,12 +131,26 @@ export function SellerShippingConfigsView({ onCreateClick, onEditClick, onDelete
             method: String(item.method ?? ""),
             estimatedDays: typeof item.estimatedDays === "number" ? item.estimatedDays : null,
             isDefault: Boolean(item.isDefault),
-            isActive: Boolean(item.isActive),
+            // Resolved through the pending override so the Status badge and the
+            // row toggle cannot disagree between the click and the refetch.
+            isActive: activeFlag.resolve(toStringValue(item.id, `sc-${index}`), Boolean(item.isActive)),
         })),
         getTotal: (response, mappedRows) => (typeof response.total === "number" ? response.total : mappedRows.length),
         buildFilters: () => undefined,
         primaryAction: { label: "New Config", onClick: handleCreate },
         renderRowActions: (row) => (_jsx(RowActionMenu, { actions: [
+                /*
+                 * 🛑 `isActive` was a read-only badge and the update schema was
+                 * built to accept it alone. A menu entry rather than a switch here,
+                 * to match the other actions in this menu — the menu is already
+                 * click-stopped in all three renderers.
+                 */
+                {
+                    label: row.isActive ? "Deactivate" : "Activate",
+                    separator: true,
+                    disabled: activeFlag.pendingId === row.id,
+                    onClick: () => { void activeFlag.set(row.id, !row.isActive); },
+                },
                 { label: ACTIONS.STORE["edit-listing"].label, onClick: () => handleEdit(row.id) },
                 ...(!row.isDefault
                     ? [{ label: "Set as Default", disabled: settingDefaultId === row.id, onClick: () => handleSetDefault(row.id) }]

package/dist/features/seller/components/SellerShippingView.js

@@ -9,6 +9,7 @@ import { StoreAddressSelectorCreate } from "../../stores/components/StoreAddress
 import { SectionForm, useSectionFormNav } from "../../shell/index.js";
 import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 const shippingDraftSchema = z.object({
     customCarrierName: z.string().min(1, "Carrier name is required"),
     customShippingPrice: z.string(),
@@ -82,7 +83,7 @@ export function SellerShippingView({ apiBase = SELLER_ENDPOINTS.SHIPPING }) {
                 if (Array.isArray(json?.issues) && json.issues.length > 0) {
                     applyZodIssues(json.issues, setFieldError);
                 }
-                setError(json?.error ?? "Failed to save");
+                setError(toUserMessage(json?.code, undefined, { fallback: "We couldn't save your shipping settings." }));
                 return;
             }
             clearErrors();

package/dist/features/seller/components/SellerStoreCategoriesView.js

@@ -11,6 +11,8 @@ import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
 import { buildBulkAction } from "../../../_internal/shared/actions/bulk-helpers.js";
 import { ROUTES } from "../../../next/routing/route-map.js";
 import { toRecordArray, toStringValue } from "../hooks/useSellerListingData.js";
+import { useOptimisticRowFlag } from "../../admin/hooks/useOptimisticRowFlag.js";
+import { apiClient } from "../../../http/index.js";
 import { DataListingView } from "../../admin/components/DataListingView.js";
 const DEFAULT_SORT = "displayOrder";
 const SORT_OPTIONS = [
@@ -37,6 +39,22 @@ const COLUMNS = [
     },
 ];
 export function SellerStoreCategoriesView({ onCreateClick, onEditClick, onDelete, onBulkDelete, onBulkActivate, onBulkDeactivate, }) {
+    /*
+     * 🛑 `isActive` was a READ-ONLY badge here, and the update schema was built
+     * to take it on its own — shipping-config's even says so in a comment: "a
+     * PATCH may legitimately carry only `isActive`". Nothing in the client had
+     * ever sent one, so flipping one boolean meant a full-editor round trip.
+     *
+     * The optimistic/rollback logic lives in the hook because eight listings
+     * grew this control at once; see its header for why rollback must DELETE
+     * the override key rather than write back a captured value.
+     */
+    const activeFlag = useOptimisticRowFlag({
+        mutate: (id, next) => apiClient.patch(SELLER_ENDPOINTS.STORE_CATEGORY_BY_ID(id), { isActive: next }),
+        invalidate: [["seller", "store-categories", "listing"]],
+        successMessage: (next) => (next ? "Category activated." : "Category deactivated."),
+        errorMessage: "Could not change that category's status.",
+    });
     const { showToast } = useToast();
     const [deleteTargetId, setDeleteTargetId] = useState(null);
     const { deletingId, handleDelete: performDelete } = useEntityDelete({
@@ -79,7 +97,9 @@ export function SellerStoreCategoriesView({ onCreateClick, onEditClick, onDelete
             label: String(item.label ?? ""),
             slug: String(item.slug ?? ""),
             productCount: Number(item.productIds?.length ?? 0),
-            isActive: Boolean(item.isActive),
+            // Resolved through the pending override so the Status badge and the
+            // row toggle cannot disagree between the click and the refetch.
+            isActive: activeFlag.resolve(toStringValue(item.id, `cat-${index}`), Boolean(item.isActive)),
         })),
         getTotal: (response, rows) => (typeof response.total === "number" ? response.total : rows.length),
         buildFilters: () => undefined,
@@ -93,6 +113,18 @@ export function SellerStoreCategoriesView({ onCreateClick, onEditClick, onDelete
             return actions;
         },
         renderRowActions: (row) => (_jsx(RowActionMenu, { actions: [
+                /*
+                 * 🛑 `isActive` was a read-only badge and the update schema was
+                 * built to accept it alone. A menu entry rather than a switch here,
+                 * to match the other actions in this menu — the menu is already
+                 * click-stopped in all three renderers.
+                 */
+                {
+                    label: row.isActive ? "Deactivate" : "Activate",
+                    separator: true,
+                    disabled: activeFlag.pendingId === row.id,
+                    onClick: () => { void activeFlag.set(row.id, !row.isActive); },
+                },
                 {
                     label: ACTIONS.STORE["edit-listing"].label,
                     onClick: () => onEditClick

package/dist/features/seller/components/SellerSupportView.js

@@ -24,7 +24,9 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * close a complaint made against them.
  */
 import React from "react";
-import { Badge, Span, Stack, Text } from "../../../ui/index.js";
+import { useQuery } from "@tanstack/react-query";
+import { Badge, RecordDetailModal, Span, Stack, Text } from "../../../ui/index.js";
+import { apiClient } from "../../../http/index.js";
 import { DataListingView } from "../../admin/components/DataListingView.js";
 import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { SUPPORT_TICKET_FIELDS } from "../../../constants/field-names.js";
@@ -38,7 +40,58 @@ const STATUS_VARIANT = {
     resolved: "success",
     closed: "default",
 };
+/**
+ * One ticket, read-only, in the shared detail modal.
+ *
+ * Its own component so the query only runs once a row has actually been
+ * opened — the list is the common case and nobody should pay a per-ticket
+ * fetch to scroll it.
+ */
+function SellerSupportTicketModal({ ticketId, onClose, }) {
+    const { data, isLoading } = useQuery({
+        queryKey: ["store", "support-ticket", ticketId],
+        queryFn: () => apiClient.get(SELLER_ENDPOINTS.SUPPORT_TICKET_BY_ID(ticketId)),
+        staleTime: 30000,
+    });
+    const ticket = data?.ticket;
+    const messages = Array.isArray(ticket?.messages)
+        ? ticket.messages
+        : [];
+    return (_jsx(RecordDetailModal, { isOpen: true, onClose: onClose, title: toStringValue(ticket?.subject, isLoading ? "Loading…" : "Ticket"), badges: ticket
+            ? [
+                {
+                    label: toStringValue(ticket.status).replace(/_/g, " "),
+                    variant: STATUS_VARIANT[toStringValue(ticket.status)] ?? "default",
+                },
+                { label: toStringValue(ticket.category).replace(/_/g, " "), variant: "default" },
+            ]
+            : undefined, description: toStringValue(ticket?.description), fields: ticket
+            ? [
+                { label: "Ticket", value: toStringValue(ticket.id) },
+                { label: "Raised", value: toRelativeDate(ticket.createdAt) },
+                { label: "Last update", value: toRelativeDate(ticket.updatedAt ?? ticket.createdAt) },
+                { label: "Priority", value: toStringValue(ticket.priority, "—") },
+            ]
+            : undefined, items: messages.length > 0
+            ? {
+                heading: `Thread (${messages.length})`,
+                entries: messages.map((m) => ({
+                    /*
+                     * The author's ROLE, not their name. A seller reading a
+                     * complaint made against them does not need the buyer's
+                     * identity to follow the thread, and those fields are
+                     * PII-encrypted at rest precisely so they are not handed out
+                     * by default.
+                     */
+                    title: m.authorRole === "admin" ? "Support team" : "Buyer",
+                    subtitle: toStringValue(m.body),
+                    trailing: toRelativeDate((m.createdAt ?? null)),
+                })),
+            }
+            : undefined }));
+}
 export function SellerSupportView({ labels = {} }) {
+    const [detailId, setDetailId] = React.useState(null);
     const mapRows = React.useCallback((response) => {
         const items = Array.isArray(response?.items) ? response.items : [];
         return items.map((raw) => {
@@ -96,5 +149,19 @@ export function SellerSupportView({ labels = {} }) {
                         },
                         { key: "updated", header: "Updated" },
                     ],
-                } }), _jsx(Text, { size: "xs", color: "muted", children: "Replies and status changes happen in the ticket thread with our support team \u2014 a ticket raised about your store is not one you can close." })] }));
+                    /*
+                     * 🛑 This list was a DEAD END, and unlike most of the ones fixed
+                     * alongside it that was not a pure UI gap: a seller could read a
+                     * subject and a 140-character slice of the description and never
+                     * open the thread, under the footer below promising the thread is
+                     * where replies happen. `/api/store/support` was GET-list-only with
+                     * no `[id]` sibling at all, so the route had to be built first.
+                     *
+                     * A modal rather than a page: the seller cannot act on these — a
+                     * ticket raised ABOUT a store is not one its owner can reply to or
+                     * close — so there is nothing here a route would add, and this is
+                     * the same `RecordDetailModal` the other dead ends were fixed with.
+                     */
+                    onRowClick: (row) => setDetailId(row.id),
+                } }), detailId && (_jsx(SellerSupportTicketModal, { ticketId: detailId, onClose: () => setDetailId(null) })), _jsx(Text, { size: "xs", color: "muted", children: "Replies and status changes happen in the ticket thread with our support team \u2014 a ticket raised about your store is not one you can close." })] }));
 }

package/dist/features/seller/hooks/useSellerListingData.js

@@ -1,10 +1,35 @@
 "use client";
 import { formatCurrency } from "../../../utils/number.formatter.js";
+// The defining module, not a barrel (Root Cause #18). `hasEncPrefix` is a pure
+// string test with no crypto in its import chain, so it is client-safe.
+import { hasEncPrefix } from "../../../security/pii-mask.js";
 export function toRecordArray(value) {
     return Array.isArray(value) ? value.filter(Boolean) : [];
 }
 export function toStringValue(value, fallback = "-") {
     if (typeof value === "string") {
+        /*
+         * 🛑 Ciphertext is not a display value, and this is the last line of
+         * defence rather than the fix.
+         *
+         * `OrderRepository.mapDoc` deliberately does not decrypt, so any route
+         * that forgets `revealOrders`/`maskedOrders` hands this function a stored
+         * `enc:v1:…` blob — and it is a `string`, so it rendered verbatim.
+         * Measured live in the seller's order list, where the row subtitle read
+         * `enc:v1:8plr3ZzKBqejPPti:MCZsrfOidLkSL6EogbxlCzU=:…` where the buyer's
+         * name belongs.
+         *
+         * This is a RECURRING class, not one slip: eight separate files in appkit
+         * carry a comment recording the same leak, and one of them had already
+         * baked `enc:v1:…` into 383 notification bodies. The route fix is the real
+         * repair; this makes the NEXT one degrade to "-" instead of garbage.
+         *
+         * `hasEncPrefix` rather than `isPiiEncrypted`: its own docstring says this
+         * is the check the display masks want, because a settings-encrypted or
+         * malformed envelope is exactly as unshowable as a PII one.
+         */
+        if (hasEncPrefix(value))
+            return fallback;
         return value.trim() || fallback;
     }
     if (typeof value === "number" || typeof value === "boolean") {

package/dist/features/shell/SectionForm.js

@@ -325,6 +325,25 @@ export function SectionForm({ sections, values, onChange, onSubmit, submitLabel
         }
         void onSubmit();
     }, [shellCtx, onSubmit, erroringSectionIds, fieldErrors, openIds, setOpenIds, expandMode]);
+    /**
+     * Open a section if it is closed, then scroll to it.
+     *
+     * Named rather than inlined in the rail's `onClick`: inline it sat five
+     * braces deep inside the JSX, and it is the same open-then-scroll the
+     * submit handler above performs for the first erroring section — so the
+     * two now read as the same operation rather than two similar ones.
+     *
+     * 🛑 Opening is CONDITIONAL on purpose. In `single` mode an unconditional
+     * `setOpenIds([id])` would COLLAPSE the section you are already in when you
+     * click its own rail entry, so the rail would read as having closed the
+     * form.
+     */
+    const openAndScrollTo = useCallback((id) => {
+        if (!openIds.includes(id)) {
+            setOpenIds(expandMode === "single" ? [id] : [...openIds, id]);
+        }
+        scrollToSection(id);
+    }, [openIds, setOpenIds, expandMode]);
     useFormBottomActions({
         onSubmit: handleSubmit,
         onCancel,
@@ -391,21 +410,6 @@ export function SectionForm({ sections, values, onChange, onSubmit, submitLabel
      * sections").
      */
     const showRail = ordered.length >= 3;
-    /**
-     * One rail click: open the section if it is not already, then scroll to it.
-     * Named rather than inline in the button's `onClick`, where the `if` body
-     * sat a brace too deep inside the mapped JSX.
-     *
-     * Opening is conditional on purpose — in `single` mode an unconditional
-     * `setOpenIds([id])` would COLLAPSE the section you are already in when you
-     * click its own rail entry, so the rail would look like it closed the form.
-     */
-    const openAndScrollTo = (id) => {
-        if (!openIds.includes(id)) {
-            setOpenIds(expandMode === "single" ? [id] : [...openIds, id]);
-        }
-        scrollToSection(id);
-    };
     /*
      * `sticky` under the measured header, and it publishes NO height: per the
      * three-tier rule a sticky element CONSUMES the tier and never joins it.
@@ -444,7 +448,7 @@ export function SectionForm({ sections, values, onChange, onSubmit, submitLabel
                         forceOpenIds.includes(section.id);
                     return (_jsxs(Button, { type: "button", 
                         /* `ghost`, not `bare` — UI_BUTTON has no `bare` variant. */
-                        variant: "ghost", size: "sm", justify: "between", gap: "sm", className: `w-full text-left ${isOpen ? "appkit-section-rail__item--active" : ""}`, "aria-current": isOpen ? "true" : undefined, onClick: () => openAndScrollTo(section.id), children: [_jsx(Span, { size: "sm", color: isOpen ? "primary" : "muted", children: section.label }), errorCount > 0 && (_jsx(Span, { size: "xs", color: "error", weight: "semibold", children: errorCount }))] }, section.id));
+                        variant: "ghost", size: "sm", justify: "between", gap: "sm", className: `w-full text-left ${isOpen ? "appkit-section-rail__item--active" : ""}`, "aria-current": isOpen ? "true" : undefined, onClick: () => openAndScrollTo(section.id), children: [_jsx(Span, { size: "sm", color: isOpen ? "primary" : "muted", children: section.label }), submitAttempted && errorCount > 0 && (_jsx(Span, { size: "xs", color: "error", weight: "semibold", children: errorCount }))] }, section.id));
                 }) }) }) })) : null;
     const panels = (_jsxs(Stack, { gap: "md", children: [ordered.map((section) => {
                 const isRequired = section.required === true;

package/dist/features/shell/build-sections.js

@@ -288,7 +288,20 @@ function renderField(field, ctx, opts) {
              * case that most needs searching.
              */
             if (options.length > PAGINATED_SELECT_THRESHOLD) {
-                return (_jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { size: "sm", weight: "medium", color: "muted", children: [label, required ? " *" : ""] }), _jsx(PaginatedSelect, { value: typeof value === "string" ? value : null, onChange: (v) => set(v ?? ""), options: options, ariaLabel: label, placeholder: `Select ${label.toLowerCase()}…` }), meta.help && _jsx(Text, { size: "xs", color: "muted", children: meta.help }), ctx.errors[name] && (_jsx(Text, { size: "xs", color: "error", role: "alert", children: ctx.errors[name] }))] }, name));
+                /*
+                 * 🛑 The error block here used to be hand-rolled, and was the only
+                 * field in this generator whose error was not wired like the rest:
+                 * a `<Text>` with no `id`, nothing pointing `aria-describedby` at it,
+                 * no `aria-invalid` on the control, and — unlike every `Field*`
+                 * branch below — the help text was still rendered underneath the
+                 * error rather than replaced by it.
+                 *
+                 * `PaginatedSelect` now takes `name`/`error` and owns all of that,
+                 * so hand it the error and delete the copy. This is the one branch
+                 * that every schema-generated form shares, so the fix lands on all
+                 * of them at once rather than per call site.
+                 */
+                return (_jsxs(Stack, { gap: "xs", children: [_jsxs(Text, { size: "sm", weight: "medium", color: "muted", children: [label, required ? " *" : ""] }), _jsx(PaginatedSelect, { name: name, error: ctx.errors[name], value: typeof value === "string" ? value : null, onChange: (v) => set(v ?? ""), options: options, ariaLabel: label, placeholder: `Select ${label.toLowerCase()}…` }), meta.help && !ctx.errors[name] && (_jsx(Text, { size: "xs", color: "muted", children: meta.help }))] }, name));
             }
             return (_jsx(FieldSelect, { name: name, label: label, hint: meta.help, required: required, value: typeof value === "string" ? value : "", options: options, onChange: set }, name));
         }

package/dist/features/shipments/components/AdminShipmentLotItemsView.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import React from "react";
+import { z } from "zod";
 import { useApiMutation } from "@mohasinac/appkit/client";
 import { Alert, Badge, Button, Div, Heading, Modal, Pagination, Skeleton, Stack, Table, Thead, Tbody, Tr, Th, Td, Text, Textarea, } from "../../../ui/index.js";
 import { apiClient } from "../../../http/index.js";
@@ -11,6 +12,7 @@ import { applyZodIssues } from "../../../ui/forms/apply-zod-issues.js";
 import { ValidationError } from "../../../errors/validation-error.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { QuickEditMenu } from "../../admin/components/QuickEditMenu.js";
 import { useShipmentItems } from "../hooks/useShipments.js";
 import { ShipmentItemLinkModal } from "./ShipmentItemLinkModal.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
@@ -32,6 +34,30 @@ function parseBulkText(text) {
     })
         .filter((row) => row.title.length > 0);
 }
+/**
+ * The three fields a lot item can be corrected on after import.
+ *
+ * Deliberately NOT the whole of `shipmentItemBaseSchema`: `isForSelfUse`
+ * decides whether `price` is required at all and flipping it from a
+ * three-field drawer would silently change what the row means to the
+ * projections, and `categorySlugs`/`brandSlug` belong to the link flow that
+ * already owns them.
+ */
+const shipmentItemQuickEditSchema = z.object({
+    title: z.string().trim().min(1, "Item title is required"),
+    quantity: z.coerce.number().int().min(1, "Quantity must be at least 1."),
+    price: z.coerce.number().min(0, "Price cannot be negative."),
+});
+const SHIPMENT_ITEM_QUICK_FIELDS = [
+    { name: "title", label: "Title", type: "text", required: true },
+    { name: "quantity", label: "Quantity", type: "number", required: true },
+    {
+        name: "price",
+        label: "Projected sale price",
+        type: "number",
+        helperText: "Feeds this lot's projected revenue, and every profit figure on the projections screen.",
+    },
+];
 export function AdminShipmentLotItemsView({ shipmentId, lotId }) {
     const [page, setPage] = React.useState(1);
     const [pageSize, setPageSize] = React.useState(50);
@@ -113,6 +139,19 @@ export function AdminShipmentLotItemsView({ shipmentId, lotId }) {
         mutationFn: (itemId) => apiClient.delete(ADMIN_ENDPOINTS.SHIPMENT_LOT_ITEM_BY_ID(shipmentId, lotId, itemId)),
         onSuccess: () => refetch(),
     });
+    const editItemMutation = useApiMutation({
+        successMessage: "Item updated",
+        errorMessage: "Could not update that item.",
+        mutationFn: ({ itemId, values }) => {
+            const parsed = shipmentItemQuickEditSchema.parse(values);
+            return apiClient.patch(ADMIN_ENDPOINTS.SHIPMENT_LOT_ITEM_BY_ID(shipmentId, lotId, itemId), parsed);
+        },
+        onSuccess: () => refetch(),
+    });
+    /** Named so the row-action array stays a flat list of declarations. */
+    const saveItemEdit = React.useCallback(async (itemId, values) => {
+        await editItemMutation.mutateAsync({ itemId, values });
+    }, [editItemMutation]);
     const unlinkItemMutation = useApiMutation({
         successMessage: "Item unlinked",
         mutationFn: (itemId) => apiClient.patch(ADMIN_ENDPOINTS.SHIPMENT_LOT_ITEM_BY_ID(shipmentId, lotId, itemId), {
@@ -134,7 +173,21 @@ export function AdminShipmentLotItemsView({ shipmentId, lotId }) {
                                 return;
                             }
                             addItemMutation.mutate();
-                        }, onValidationChange: () => itemForm.validate(itemDraft), schema: shipmentItemFormSchema, openIds: itemNav.openIds, onOpenChange: itemNav.setOpenIds, submitLabel: "Save Item", cancelLabel: "Cancel", onCancel: () => setShowAddItem(false), isLoading: addItemMutation.isPending })] })), isLoading ? (_jsxs(Stack, { gap: "sm", children: [_jsx(Skeleton, { variant: "rectangular", height: "32px" }), _jsx(Skeleton, { variant: "rectangular", height: "32px" })] })) : items.length === 0 ? (_jsx(Text, { variant: "secondary", children: "No items tracked yet." })) : (_jsxs(Table, { children: [_jsx(Thead, { children: _jsxs(Tr, { children: [_jsx(Th, { children: "Title" }), _jsx(Th, { children: "Qty" }), _jsx(Th, { children: "Price" }), _jsx(Th, { children: "Status" }), _jsx(Th, {})] }) }), _jsx(Tbody, { children: items.map((item) => (_jsxs(Tr, { children: [_jsx(Td, { children: item.title }), _jsx(Td, { children: item.quantity }), _jsx(Td, { children: item.isForSelfUse ? "—" : formatCurrency(item.price ?? 0) }), _jsx(Td, { children: item.isForSelfUse ? (_jsx(Badge, { variant: "secondary", children: "Self use" })) : item.linkedProductId ? (_jsx(Badge, { variant: "success", children: "Linked" })) : (_jsx(Badge, { variant: "default", children: "Unlinked" })) }), _jsxs(Td, { className: "flex gap-[var(--appkit-space-2)]", children: [!item.isForSelfUse &&
+                        }, onValidationChange: () => itemForm.validate(itemDraft), schema: shipmentItemFormSchema, openIds: itemNav.openIds, onOpenChange: itemNav.setOpenIds, submitLabel: "Save Item", cancelLabel: "Cancel", onCancel: () => setShowAddItem(false), isLoading: addItemMutation.isPending })] })), isLoading ? (_jsxs(Stack, { gap: "sm", children: [_jsx(Skeleton, { variant: "rectangular", height: "32px" }), _jsx(Skeleton, { variant: "rectangular", height: "32px" })] })) : items.length === 0 ? (_jsx(Text, { variant: "secondary", children: "No items tracked yet." })) : (_jsxs(Table, { children: [_jsx(Thead, { children: _jsxs(Tr, { children: [_jsx(Th, { children: "Title" }), _jsx(Th, { children: "Qty" }), _jsx(Th, { children: "Price" }), _jsx(Th, { children: "Status" }), _jsx(Th, {})] }) }), _jsx(Tbody, { children: items.map((item) => (_jsxs(Tr, { children: [_jsx(Td, { children: item.title }), _jsx(Td, { children: item.quantity }), _jsx(Td, { children: item.isForSelfUse ? "—" : formatCurrency(item.price ?? 0) }), _jsx(Td, { children: item.isForSelfUse ? (_jsx(Badge, { variant: "secondary", children: "Self use" })) : item.linkedProductId ? (_jsx(Badge, { variant: "success", children: "Linked" })) : (_jsx(Badge, { variant: "default", children: "Unlinked" })) }), _jsxs(Td, { className: "flex gap-[var(--appkit-space-2)]", children: [_jsx(QuickEditMenu, { actions: [
+                                                {
+                                                    label: "Edit item",
+                                                    formTitle: `Edit "${item.title}"`,
+                                                    schema: shipmentItemQuickEditSchema,
+                                                    fields: SHIPMENT_ITEM_QUICK_FIELDS,
+                                                    defaultValues: {
+                                                        title: item.title,
+                                                        quantity: item.quantity,
+                                                        price: item.price ?? 0,
+                                                    },
+                                                    onSubmit: (values) => saveItemEdit(item.id, values),
+                                                    submitLabel: "Save item",
+                                                },
+                                            ] }), !item.isForSelfUse &&
                                             (item.linkedProductId ? (_jsx(Button, { size: "sm", variant: "ghost", isLoading: unlinkItemMutation.isPending, onClick: () => unlinkItemMutation.mutate(item.id), children: "Unlink" })) : (_jsx(Button, { size: "sm", variant: "ghost", onClick: () => setLinkTarget({ itemId: item.id, title: item.title }), children: "Create pre-order link" }))), _jsx(Button, { size: "sm", variant: "ghost", action: ACTIONS.SHIPMENT["delete"], isLoading: deleteItemMutation.isPending, onClick: () => deleteItemMutation.mutate(item.id), children: "Delete" })] })] }, item.id))) })] })), meta && meta.totalPages > 1 && (_jsx(Pagination, { currentPage: page, totalPages: meta.totalPages, onPageChange: setPage, pageSize: pageSize, onPageSizeChange: (size) => {
                     setPageSize(size);
                     setPage(1);

package/dist/features/shipments/components/AdminShipmentProjectionsView.js

@@ -1,7 +1,8 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import React from "react";
-import { Button, Div, Heading, Modal, Pagination, Select, Skeleton, Stack, Table, Thead, Tbody, Tr, Th, Td, Text } from "../../../ui/index.js";
+import { Button, Div, Heading, Modal, Pagination, Select, Skeleton, Stack, Table, Thead, Tbody, Tr, Th, Td, Text, TextLink } from "../../../ui/index.js";
+import { ROUTES } from "../../../next/routing/route-map.js";
 import { useShipmentProjections, useShipmentItems } from "../hooks/useShipments.js";
 import { ShipmentItemLinkModal } from "./ShipmentItemLinkModal.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
@@ -25,7 +26,7 @@ export function AdminShipmentProjectionsView() {
     const [sorts, setSorts] = React.useState(SORT_OPTIONS[0].value);
     const { lots, meta, isLoading, refetch } = useShipmentProjections({ page, pageSize, sorts });
     const [pickerLot, setPickerLot] = React.useState(null);
-    return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { layout: "flex", align: "center", justify: "between", children: [_jsx(Heading, { level: 2, children: "Projections" }), _jsx(Select, { "aria-label": "Sort by", value: sorts, onValueChange: setSorts, options: SORT_OPTIONS })] }), isLoading ? (_jsxs(Stack, { gap: "sm", children: [_jsx(Skeleton, { variant: "rectangular", height: "32px" }), _jsx(Skeleton, { variant: "rectangular", height: "32px" }), _jsx(Skeleton, { variant: "rectangular", height: "32px" })] })) : lots.length === 0 ? (_jsx(Text, { variant: "secondary", children: "No lots to project yet." })) : (_jsxs(Table, { children: [_jsx(Thead, { children: _jsxs(Tr, { children: [_jsx(Th, { children: "Lot" }), _jsx(Th, { children: "Items" }), _jsx(Th, { children: "Landed Cost" }), _jsx(Th, { children: "Projected Revenue" }), _jsx(Th, { children: "Projected Profit" }), _jsx(Th, {})] }) }), _jsx(Tbody, { children: lots.map((lot) => (_jsxs(Tr, { children: [_jsx(Td, { children: lot.lotName }), _jsx(Td, { children: lot.itemCount }), _jsx(Td, { children: formatCurrency(lot.totalLandedCost) }), _jsx(Td, { children: formatCurrency(lot.projectedRevenue) }), _jsx(Td, { className: lot.projectedProfit < 0 ? "text-error" : "text-success", children: formatCurrency(lot.projectedProfit) }), _jsx(Td, { children: _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setPickerLot(lot), children: "Create pre-order link" }) })] }, lot.id))) })] })), meta && meta.totalPages > 1 && (_jsx(Pagination, { currentPage: page, totalPages: meta.totalPages, onPageChange: setPage, pageSize: pageSize, onPageSizeChange: (size) => {
+    return (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { layout: "flex", align: "center", justify: "between", children: [_jsx(Heading, { level: 2, children: "Projections" }), _jsx(Select, { "aria-label": "Sort by", value: sorts, onValueChange: setSorts, options: SORT_OPTIONS })] }), isLoading ? (_jsxs(Stack, { gap: "sm", children: [_jsx(Skeleton, { variant: "rectangular", height: "32px" }), _jsx(Skeleton, { variant: "rectangular", height: "32px" }), _jsx(Skeleton, { variant: "rectangular", height: "32px" })] })) : lots.length === 0 ? (_jsx(Text, { variant: "secondary", children: "No lots to project yet." })) : (_jsxs(Table, { children: [_jsx(Thead, { children: _jsxs(Tr, { children: [_jsx(Th, { children: "Lot" }), _jsx(Th, { children: "Items" }), _jsx(Th, { children: "Landed Cost" }), _jsx(Th, { children: "Projected Revenue" }), _jsx(Th, { children: "Projected Profit" }), _jsx(Th, {})] }) }), _jsx(Tbody, { children: lots.map((lot) => (_jsxs(Tr, { children: [_jsx(Td, { children: _jsx(TextLink, { href: String(ROUTES.ADMIN.SHIPMENT_LOT_ITEMS(lot.shipmentId, lot.id)), children: lot.lotName }) }), _jsx(Td, { children: lot.itemCount }), _jsx(Td, { children: formatCurrency(lot.totalLandedCost) }), _jsx(Td, { children: formatCurrency(lot.projectedRevenue) }), _jsx(Td, { className: lot.projectedProfit < 0 ? "text-error" : "text-success", children: formatCurrency(lot.projectedProfit) }), _jsx(Td, { children: _jsx(Button, { size: "sm", variant: "ghost", onClick: () => setPickerLot(lot), children: "Create pre-order link" }) })] }, lot.id))) })] })), meta && meta.totalPages > 1 && (_jsx(Pagination, { currentPage: page, totalPages: meta.totalPages, onPageChange: setPage, pageSize: pageSize, onPageSizeChange: (size) => {
                     setPageSize(size);
                     setPage(1);
                 } })), pickerLot && (_jsx(LotItemPickerModal, { lot: pickerLot, onClose: () => setPickerLot(null), onLinked: refetch }))] }));

package/dist/features/shipments/schemas/validation.d.ts

@@ -15,7 +15,7 @@ export declare const createShipmentSchema: z.ZodObject<{
     laborRatePerHour: z.ZodOptional<z.ZodNumber>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    status: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs";
+    status: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs";
     shipmentNumber: string;
     supplierName: string;
     customsTotal: number;
@@ -29,7 +29,7 @@ export declare const createShipmentSchema: z.ZodObject<{
     laborHoursSpent?: number | undefined;
     laborRatePerHour?: number | undefined;
 }, {
-    status: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs";
+    status: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs";
     shipmentNumber: string;
     supplierName: string;
     customsTotal: number;
@@ -58,7 +58,7 @@ export declare const updateShipmentSchema: z.ZodObject<{
     laborRatePerHour: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
     notes: z.ZodOptional<z.ZodOptional<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
-    status?: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs" | undefined;
+    status?: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs" | undefined;
     trackingNumber?: string | undefined;
     notes?: string | undefined;
     carrier?: string | undefined;
@@ -72,7 +72,7 @@ export declare const updateShipmentSchema: z.ZodObject<{
     laborHoursSpent?: number | undefined;
     laborRatePerHour?: number | undefined;
 }, {
-    status?: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs" | undefined;
+    status?: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs" | undefined;
     trackingNumber?: string | undefined;
     notes?: string | undefined;
     carrier?: string | undefined;

package/dist/features/shipping-boxes/repository/shipping-boxes.repository.d.ts

@@ -0,0 +1,43 @@
+import type { FirebaseSieveFields, FirebaseSieveResult, SieveModel } from "../../../providers/db-firebase";
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type ShippingBoxDocument } from "../schemas/firestore";
+/**
+ * The shared carton library. See the schema header for why it is global.
+ */
+export declare class ShippingBoxesRepository extends BaseRepository<ShippingBoxDocument> {
+    static readonly SIEVE_FIELDS: FirebaseSieveFields;
+    constructor();
+    /**
+     * The picker's list. Active only, by name.
+     *
+     * 🛑 Retired presets are excluded here and NOT deleted, so a draft shipment
+     * holding one does not lose it mid-dispatch.
+     */
+    listActive(model: SieveModel): Promise<FirebaseSieveResult<ShippingBoxDocument>>;
+    /**
+     * Create a preset, keyed on a slug of its name.
+     *
+     * 🛑 `box-<slug>` as the document id, so the SAME carton name cannot be added
+     * twice by two sellers. That is the whole value of a shared library — two
+     * rows called "Standard carton" with different numbers is worse than one
+     * row, because the picker gives no way to tell them apart.
+     *
+     * A colliding create is reported to the caller rather than silently
+     * overwriting: the existing row has an author and may be in use, and the
+     * second seller's intent ("I want a preset for this") is already satisfied
+     * by the row that exists.
+     */
+    createPreset(input: {
+        name: string;
+        length: number;
+        width: number;
+        height: number;
+        tareWeight?: number;
+        createdByUid: string;
+        createdByName: string;
+    }): Promise<{
+        box: ShippingBoxDocument;
+        created: boolean;
+    }>;
+}
+export declare const shippingBoxesRepository: ShippingBoxesRepository;

package/dist/features/shipping-boxes/repository/shipping-boxes.repository.js

@@ -0,0 +1,90 @@
+import { BaseRepository } from "../../../providers/db-firebase/index.js";
+import { slugify } from "../../../utils/string.formatter.js";
+import { SHIPPING_BOX_COLLECTION, SHIPPING_BOX_FIELDS, SHIPPING_BOX_LIMITS, } from "../schemas/firestore.js";
+/**
+ * The shared carton library. See the schema header for why it is global.
+ */
+export class ShippingBoxesRepository extends BaseRepository {
+    constructor() {
+        super(SHIPPING_BOX_COLLECTION);
+    }
+    /**
+     * The picker's list. Active only, by name.
+     *
+     * 🛑 Retired presets are excluded here and NOT deleted, so a draft shipment
+     * holding one does not lose it mid-dispatch.
+     */
+    async listActive(model) {
+        const baseQuery = this.getCollection().where(SHIPPING_BOX_FIELDS.IS_ACTIVE, "==", true);
+        return this.sieveQuery(model, ShippingBoxesRepository.SIEVE_FIELDS, {
+            baseQuery,
+            defaultPageSize: 20,
+            maxPageSize: 50,
+        });
+    }
+    /**
+     * Create a preset, keyed on a slug of its name.
+     *
+     * 🛑 `box-<slug>` as the document id, so the SAME carton name cannot be added
+     * twice by two sellers. That is the whole value of a shared library — two
+     * rows called "Standard carton" with different numbers is worse than one
+     * row, because the picker gives no way to tell them apart.
+     *
+     * A colliding create is reported to the caller rather than silently
+     * overwriting: the existing row has an author and may be in use, and the
+     * second seller's intent ("I want a preset for this") is already satisfied
+     * by the row that exists.
+     */
+    async createPreset(input) {
+        const name = input.name.trim();
+        const id = `box-${slugify(name)}`;
+        const existing = await this.findById(id);
+        if (existing)
+            return { box: existing, created: false };
+        const now = new Date();
+        const box = {
+            id,
+            name,
+            length: clampCm(input.length),
+            width: clampCm(input.width),
+            height: clampCm(input.height),
+            ...(input.tareWeight === undefined ? {} : { tareWeight: clampKg(input.tareWeight) }),
+            createdByUid: input.createdByUid,
+            createdByName: input.createdByName,
+            isActive: true,
+            createdAt: now,
+            updatedAt: now,
+        };
+        await this.createWithId(id, box);
+        return { box, created: true };
+    }
+}
+ShippingBoxesRepository.SIEVE_FIELDS = {
+    /*
+     * `name` is sortable AND filterable because this list is picked from by
+     * typing — `PaginatedSelect` searches it. A field the picker searches that
+     * is not allowlisted here would have its clause silently DROPPED and the
+     * search would return the whole library while looking like it filtered
+     * (Root Cause #62).
+     */
+    name: { canFilter: true, canSort: true },
+    isActive: { canFilter: true, canSort: false },
+    createdByUid: { canFilter: true, canSort: false },
+};
+/*
+ * Clamped rather than rejected. These bounds exist so a typo cannot reach a
+ * courier API as a 4-metre parcel; they are not a tariff, and refusing a
+ * legitimate large parcel client-side is worse than letting it through to be
+ * priced by `checkServiceability` against the real figures.
+ */
+function clampCm(v) {
+    if (!Number.isFinite(v))
+        return SHIPPING_BOX_LIMITS.minCm;
+    return Math.min(SHIPPING_BOX_LIMITS.maxCm, Math.max(SHIPPING_BOX_LIMITS.minCm, v));
+}
+function clampKg(v) {
+    if (!Number.isFinite(v))
+        return SHIPPING_BOX_LIMITS.minKg;
+    return Math.min(SHIPPING_BOX_LIMITS.maxKg, Math.max(SHIPPING_BOX_LIMITS.minKg, v));
+}
+export const shippingBoxesRepository = new ShippingBoxesRepository();