@mohasinac/appkit 4.62.0 → 4.62.1

package/dist/features/promotions/constants/coupon-help.js

@@ -18,7 +18,11 @@ export const COUPON_HELP = {
     stackingRules: [
         "One store coupon per store. If your cart has items from three stores, you can apply each of those stores' coupons at the same time.",
         "Plus one platform-wide LetItRip coupon, on top of any store coupons.",
-        "A second coupon for the same store, or a second platform-wide coupon, will be declined — remove the first one to swap it.",
+        // D51's third bucket, stated for the buyer. Without this line the rule
+        // above reads as "one platform coupon" and a buyer with a points offer
+        // applied would reasonably think it was using up that slot.
+        "Plus one points offer, which stacks with everything else — it earns you points rather than discounting, so it never takes the place of a discount coupon.",
+        "A second coupon for the same store, a second platform-wide coupon, or a second points offer will be declined — remove the first one to swap it.",
     ],
     /** How the discount is actually distributed. */
     applicationHeading: "Where each discount lands",
@@ -26,6 +30,10 @@ export const COUPON_HELP = {
         "A store coupon only discounts that store's items.",
         "A platform-wide coupon is spread proportionally across every store in your cart.",
         "Orders are placed per store, so each store's order shows its own share of the discount.",
+        // Stated because the ORDER of operations is what a buyer would otherwise
+        // guess wrong — points are earned on what you actually paid, so a discount
+        // reduces the points as well as the price.
+        "A points offer earns points on what you pay after any discounts, so the two interact rather than ignoring each other.",
     ],
     /** Reuses the failure reasons already written for the buyer shopping guide. */
     failureHeading: "Why a coupon might not apply",

package/dist/features/promotions/schemas/firestore.d.ts

@@ -72,6 +72,29 @@ export interface CouponDocument extends BaseDocument {
     discount: DiscountConfig;
     bxgy?: BXGYConfig;
     tiers?: TieredDiscount[];
+    /**
+     * D51 — percentage of the amount PAID that a `points_earn` coupon awards as
+     * points. Meaningless, and ignored, on every other type.
+     *
+     * ## 🛑 Why this is not `discount.value`
+     *
+     * `discount` is read by `computeGroupCouponDiscount` to reduce the order.
+     * Overloading its `value` to mean "percent awarded as points" would make a
+     * points coupon discount the order by the same number it was supposed to
+     * credit — the exact overloading that `bxgy` and `tiers` are separate fields
+     * to avoid.
+     *
+     * `discount` stays REQUIRED on the interface because every existing coupon
+     * has one and widening it to optional would ripple through ~30 readers; a
+     * points coupon carries `{ value: 0 }`. The protection that matters is in
+     * the discount loop, which skips on TYPE rather than trusting that zero
+     * (`coupon-discount.ts`) — bad data cannot bypass a type check.
+     *
+     * The base is the post-discount amount actually paid in money, which is
+     * `POINTS_EARN_PERCENT`'s existing rule; this field exists so a campaign can
+     * raise it (the festival double event) without editing a constant.
+     */
+    pointsPercent?: number;
     usage: UsageConfig;
     validity: ValidityConfig;
     restrictions: RestrictionsConfig;
@@ -143,6 +166,7 @@ export declare const COUPON_FIELDS: {
         readonly FIXED: CouponType;
         readonly FREE_SHIPPING: CouponType;
         readonly BUY_X_GET_Y: CouponType;
+        readonly POINTS_EARN: CouponType;
     };
     readonly SCOPE_VALUES: {
         readonly ADMIN: "admin";

package/dist/features/promotions/schemas/firestore.js

@@ -48,6 +48,7 @@ export const COUPON_FIELDS = {
         FIXED: "fixed",
         FREE_SHIPPING: "free_shipping",
         BUY_X_GET_Y: "buy_x_get_y",
+        POINTS_EARN: "points_earn",
     },
     SCOPE_VALUES: {
         ADMIN: "admin",
@@ -59,6 +60,9 @@ export const COUPON_TYPE_LABELS = {
     fixed: "Fixed Amount Discount",
     free_shipping: "Free Shipping",
     buy_x_get_y: "Buy X Get Y",
+    // Named for what the buyer gets, not for the mechanism. "Points earn" is
+    // our word for it; "Points back" is what appears on their balance.
+    points_earn: "Points Back",
 };
 export const DEFAULT_COUPON_DATA = {
     usage: { currentUsage: 0 },

package/dist/features/promotions/types/index.d.ts

@@ -1,4 +1,22 @@
-export type CouponType = "percentage" | "fixed" | "free_shipping" | "buy_x_get_y";
+export type CouponType = "percentage" | "fixed" | "free_shipping" | "buy_x_get_y"
+/**
+ * D51 — a coupon that awards POINTS rather than discounting the order.
+ *
+ * 🛑 It carries `pointsPercent`, not a discount value, and it must never
+ * reach the discount arithmetic: a `points_earn` coupon with a `discount`
+ * field read by `computeGroupCouponDiscount` would silently discount the
+ * order as well as award points.
+ *
+ * It exists because `RIPLI05` is a PERMANENT, site-wide coupon, and
+ * `detectCouponConflict` permits exactly one admin coupon site-wide — so
+ * putting it in the admin slot would make every other platform coupon
+ * unusable for as long as it exists. It gets its own stacking bucket.
+ *
+ * Adding it here is a compile error at `COUPON_TYPE_LABELS`, which is a
+ * `Record<CouponType, string>` — that is the point of declaring the union
+ * first.
+ */
+ | "points_earn";
 export type CouponScope = "admin" | "seller";
 export interface CouponItem {
     id: string;

package/dist/features/scams/components/ScamProfileView.js

@@ -4,7 +4,7 @@ import { formatCurrency } from "../../../utils/number.formatter.js";
 const CLS_OUTLINE_BTN = "appkit-button appkit-button--outline appkit-button--md flex w-full items-center gap-[var(--appkit-space-2)]";
 import Link from "next/link.js";
 import { Shield, Phone, Wallet, Mail, AlertOctagon, Flag, Eye, Users, Calendar, ExternalLink, FileText, MessageSquare, Link2, } from "lucide-react";
-import { Alert, Anchor, Badge, Breadcrumb, Card, CardBody, CardHeader, Container, Div, EmptyState, Grid, Heading, Main, Row, Section, Span, Stack, Text, } from "../../../ui/index.js";
+import { Alert, Anchor, Badge, Breadcrumb, Card, CardBody, CardHeader, Container, Disclaimer, Div, EmptyState, Grid, Heading, Main, Row, Section, Span, Stack, Text, } from "../../../ui/index.js";
 import { MediaImage } from "../../media/MediaImage.js";
 import { SCAM_PLATFORM_LABELS, SCAMMER_STATUS_LABELS, SOCIAL_PLATFORM_LABELS, CONTEST_TYPE_LABELS, } from "../schemas/firestore.js";
 import { SCAM_TYPE_LABELS, getScamType } from "../constants/scam-types.js";
@@ -32,7 +32,7 @@ function statusVariant(status) {
 }
 // ─── Sub-components ───────────────────────────────────────────────────────────
 function ScammerHeaderCard({ scammer }) {
-    return (_jsx(Card, { variant: "elevated", padding: "lg", children: _jsxs(Stack, { gap: "md", children: [_jsxs(Row, { justify: "between", gap: "md", align: "start", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "bold", size: "2xl", children: scammer.displayNames[0] }), scammer.displayNames.length > 1 && (_jsxs(Text, { variant: "secondary", size: "sm", children: ["Also known as: ", scammer.displayNames.slice(1).join(", ")] }))] }), _jsx(Badge, { variant: statusVariant(scammer.status), children: SCAMMER_STATUS_LABELS[scammer.status] ?? scammer.status })] }), _jsxs(Row, { gap: "xs", wrap: true, children: [_jsx(Badge, { variant: "warning", children: SCAM_TYPE_LABELS[scammer.scamType] ?? scammer.scamType }), _jsxs(Badge, { variant: "default", children: ["via ", SCAM_PLATFORM_LABELS[scammer.scamPlatform] ?? scammer.scamPlatform] }), scammer.tags.includes("repeat_offender") && (_jsx(Badge, { variant: "danger", children: "Repeat Offender" }))] }), _jsxs(Row, { gap: "md", wrap: true, children: [_jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Eye, { className: "h-4 w-4" }), scammer.views, " views"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Users, { className: "h-4 w-4" }), scammer.incidentCount + 1, " victim", scammer.incidentCount !== 0 ? "s" : "", " reported"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Calendar, { className: "h-4 w-4" }), "Reported ", formatDate(scammer.createdAt)] }), scammer.amountLost ? (_jsxs(Text, { className: "text-[color:var(--appkit-color-danger,theme(colors.red.600))]", size: "sm", weight: "medium", children: [formatCurrency(scammer.amountLost), " lost (primary incident)"] })) : null] })] }) }));
+    return (_jsx(Card, { variant: "elevated", padding: "lg", children: _jsxs(Stack, { gap: "md", children: [_jsx(Disclaimer, { id: "scam-registry" }), _jsxs(Row, { justify: "between", gap: "md", align: "start", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "bold", size: "2xl", children: scammer.displayNames[0] }), scammer.displayNames.length > 1 && (_jsxs(Text, { variant: "secondary", size: "sm", children: ["Also known as: ", scammer.displayNames.slice(1).join(", ")] }))] }), _jsx(Badge, { variant: statusVariant(scammer.status), children: SCAMMER_STATUS_LABELS[scammer.status] ?? scammer.status })] }), _jsxs(Row, { gap: "xs", wrap: true, children: [_jsx(Badge, { variant: "warning", children: SCAM_TYPE_LABELS[scammer.scamType] ?? scammer.scamType }), _jsxs(Badge, { variant: "default", children: ["via ", SCAM_PLATFORM_LABELS[scammer.scamPlatform] ?? scammer.scamPlatform] }), scammer.tags.includes("repeat_offender") && (_jsx(Badge, { variant: "danger", children: "Repeat Offender" }))] }), _jsxs(Row, { gap: "md", wrap: true, children: [_jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Eye, { className: "h-4 w-4" }), scammer.views, " views"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Users, { className: "h-4 w-4" }), scammer.incidentCount + 1, " victim", scammer.incidentCount !== 0 ? "s" : "", " reported"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Calendar, { className: "h-4 w-4" }), "Reported ", formatDate(scammer.createdAt)] }), scammer.amountLost ? (_jsxs(Text, { className: "text-[color:var(--appkit-color-danger,theme(colors.red.600))]", size: "sm", weight: "medium", children: [formatCurrency(scammer.amountLost), " lost (primary incident)"] })) : null] })] }) }));
 }
 function ScammerIncidentsSection({ incidents }) {
     return (_jsxs(Stack, { gap: "sm", children: [_jsx(Row, { justify: "between", align: "center", children: _jsxs(Heading, { level: 2, size: "base", weight: "semibold", children: ["Additional Incidents", incidents.length > 0 && ` (${incidents.length})`] }) }), incidents.length === 0 ? (_jsx(EmptyState, { icon: _jsx(FileText, { className: "h-8 w-8" }), title: "No additional incidents yet", description: "Other victims' verified reports linked to this profile will appear here." })) : (_jsx(Stack, { gap: "sm", children: incidents.map((inc) => (_jsx(Card, { variant: "outlined", padding: "md", children: _jsxs(Stack, { gap: "xs", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", wrap: true, children: [_jsxs(Row, { gap: "xs", wrap: true, children: [_jsx(Badge, { variant: "warning", children: SCAM_TYPE_LABELS[inc.scamType] ?? inc.scamType }), _jsxs(Badge, { variant: "default", children: ["via ", SCAM_PLATFORM_LABELS[inc.scamPlatform] ?? inc.scamPlatform] })] }), _jsx(Text, { variant: "secondary", size: "xs", children: formatDate(inc.createdAt) })] }), inc.itemInvolved && (_jsxs(Text, { variant: "secondary", size: "xs", children: ["Item: ", inc.itemInvolved] })), inc.amountLost ? (_jsxs(Text, { className: "text-[color:var(--appkit-color-danger,theme(colors.red.600))]", size: "xs", weight: "medium", children: [formatCurrency(inc.amountLost), " lost"] })) : null, _jsx(Text, { variant: "secondary", className: "leading-relaxed", size: "sm", children: inc.description.length > 200

package/dist/features/scams/components/ScamRegistryView.js

@@ -7,7 +7,7 @@ const CLS_ICON_SM = "h-3 w-3 shrink-0";
 const CLS_ROW_CHEVRON = "h-4 w-4 shrink-0 transition group-hover:text-error text-[var(--appkit-color-text-faint)]";
 const CLS_PILL_LINK = "inline-flex items-center gap-[var(--appkit-space-1)] rounded-full bg-error-surface dark:bg-error-surface px-[var(--appkit-space-2-5)] py-[var(--appkit-space-0-5)] text-[length:var(--appkit-text-xs)] font-medium text-error dark:text-error hover:bg-error-surface transition-colors";
 import { Shield, Phone, Wallet, Mail, ChevronRight, Search } from "lucide-react";
-import { Button, Container, Div, Form, Heading, Main, Section, Select, Text, Grid, Stack, Row, Card, Badge, Alert, EmptyState, Input, } from "../../../ui/index.js";
+import { Button, Container, Disclaimer, Div, Form, Heading, Main, Section, Select, Text, Grid, Stack, Row, Card, Badge, Alert, EmptyState, Input, } from "../../../ui/index.js";
 import { listVerifiedScammers } from "../actions/scam-actions.js";
 import { SCAM_PLATFORM_LABELS } from "../schemas/firestore.js";
 import { SCAM_TYPES, SCAM_TYPE_LABELS } from "../constants/scam-types.js";
@@ -61,7 +61,7 @@ export async function ScamRegistryView({ searchParams = {} }) {
         const qs = p.toString();
         return `/scams${qs ? `?${qs}` : ""}`;
     }
-    return (_jsxs(Main, { children: [_jsx(Div, { className: "border-b appkit-alert--warning", rounded: "none", children: _jsx(Container, { padding: "y-xs", size: "xl", className: "", children: _jsxs(Alert, { variant: "warning", compact: true, children: ["All profiles on this page have been verified by our moderation team. If you recognise a scammer not listed here,", " ", _jsx(Link, { href: reportHref, className: "font-medium underline hover:no-underline", children: "report them" }), "."] }) }) }), _jsx(Section, { padding: "y-2xl", children: _jsx(Container, { size: "xl", children: _jsxs(Stack, { gap: "xl", children: [_jsxs(Row, { justify: "between", gap: "md", align: "end", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "semibold", size: "3xl", children: "Scam Registry" }), _jsx(Text, { variant: "secondary", size: "sm", children: "Verified scammers active in India's collectibles community. Search by name, phone, or UPI." })] }), _jsxs(Link, { href: reportHref, className: "appkit-button appkit-button--danger appkit-button--md shrink-0", children: [_jsx(Shield, { className: "h-4 w-4" }), "Report a Scammer"] })] }), _jsx(Form, { method: "GET", children: _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Div, { className: "flex-1 min-w-48", children: _jsx(Input, { type: "search", name: "q", defaultValue: query, placeholder: "Search name, phone, UPI ID, or email\u2026", icon: _jsx(Search, { className: "h-4 w-4" }) }) }), _jsx(Select, { name: "scamType", defaultValue: scamType, options: SCAM_TYPES.map((t) => ({ value: t.id, label: t.label })), placeholder: "All scam types" }), _jsx(Select, { name: "sort", defaultValue: sort, options: SORT_OPTIONS.map((o) => ({ value: o.value, label: o.label })) }), _jsx(Button, { type: "submit", variant: "primary", size: "sm", children: "Search" }), (query || scamType || sort !== "-createdAt") && (_jsx(Link, { href: ROUTES.PUBLIC.SCAMS, className: "rounded-lg border border-[var(--appkit-color-border)] px-[var(--appkit-space-4)] py-[var(--appkit-space-2)] text-[length:var(--appkit-text-sm)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover transition-colors", children: "Clear" }))] }) }), scamType && SCAM_TYPE_LABELS[scamType] && (_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { variant: "secondary", size: "xs", children: "Filtering by:" }), _jsxs(Link, { href: buildHref({ scamType: "" }), className: CLS_PILL_LINK, children: [SCAM_TYPE_LABELS[scamType], _jsx(Span, { "aria-hidden": "true", children: "\u00D7" })] })] })), result.items.length === 0 ? (_jsx(EmptyState, { icon: _jsx(Shield, { className: "h-12 w-12" }), title: query || scamType
+    return (_jsxs(Main, { children: [_jsx(Div, { className: "border-b appkit-alert--warning", rounded: "none", children: _jsx(Container, { padding: "y-xs", size: "xl", className: "", children: _jsxs(Alert, { variant: "warning", compact: true, children: ["All profiles on this page have been verified by our moderation team. If you recognise a scammer not listed here,", " ", _jsx(Link, { href: reportHref, className: "font-medium underline hover:no-underline", children: "report them" }), "."] }) }) }), _jsx(Section, { padding: "y-2xl", children: _jsx(Container, { size: "xl", children: _jsxs(Stack, { gap: "xl", children: [_jsxs(Row, { justify: "between", gap: "md", align: "end", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "semibold", size: "3xl", children: "Scam Registry" }), _jsx(Text, { variant: "secondary", size: "sm", children: "Reports of scams in India's collectibles community, submitted by buyers and sellers. Search by name, phone, or UPI." })] }), _jsxs(Link, { href: reportHref, className: "appkit-button appkit-button--danger appkit-button--md shrink-0", children: [_jsx(Shield, { className: "h-4 w-4" }), "Report a Scammer"] })] }), _jsx(Disclaimer, { id: "scam-registry" }), _jsx(Form, { method: "GET", children: _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Div, { className: "flex-1 min-w-48", children: _jsx(Input, { type: "search", name: "q", defaultValue: query, placeholder: "Search name, phone, UPI ID, or email\u2026", icon: _jsx(Search, { className: "h-4 w-4" }) }) }), _jsx(Select, { name: "scamType", defaultValue: scamType, options: SCAM_TYPES.map((t) => ({ value: t.id, label: t.label })), placeholder: "All scam types" }), _jsx(Select, { name: "sort", defaultValue: sort, options: SORT_OPTIONS.map((o) => ({ value: o.value, label: o.label })) }), _jsx(Button, { type: "submit", variant: "primary", size: "sm", children: "Search" }), (query || scamType || sort !== "-createdAt") && (_jsx(Link, { href: ROUTES.PUBLIC.SCAMS, className: "rounded-lg border border-[var(--appkit-color-border)] px-[var(--appkit-space-4)] py-[var(--appkit-space-2)] text-[length:var(--appkit-text-sm)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover transition-colors", children: "Clear" }))] }) }), scamType && SCAM_TYPE_LABELS[scamType] && (_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { variant: "secondary", size: "xs", children: "Filtering by:" }), _jsxs(Link, { href: buildHref({ scamType: "" }), className: CLS_PILL_LINK, children: [SCAM_TYPE_LABELS[scamType], _jsx(Span, { "aria-hidden": "true", children: "\u00D7" })] })] })), result.items.length === 0 ? (_jsx(EmptyState, { icon: _jsx(Shield, { className: "h-12 w-12" }), title: query || scamType
                                     ? "No verified scammers matched your filters"
                                     : "No verified scammers in the registry yet", description: query || scamType
                                     ? "Try a different search or clear your filters."

package/dist/features/search/action-index/tab-entries.js

@@ -103,7 +103,7 @@ export const CONSOLIDATED_TAB_SURFACES = [
         tab: "navigation",
         portal: "admin",
         sectionPath: "Admin › System › Permissions Toggles",
-        requiredPermission: "settings:write",
+        requiredPermission: "admin:settings:write",
     },
 ];
 export function deriveConsolidatedTabEntries(hrefs) {

package/dist/features/seller/actions/seller-actions.js

@@ -28,7 +28,7 @@ import { couponsRepository } from "../../promotions/repository/coupons.repositor
 import { generateStoreSlug } from "../../stores/schemas/firestore.js";
 import { siteSettingsRepository } from "../../admin/repository/site-settings.repository.js";
 import { computePayoutDeduction } from "../../../_internal/shared/fees/calculator.js";
-import { ordersTaxableValue, ordersShippingReimbursement, } from "../../../_internal/shared/checkout/order-math.js";
+import { ordersTaxableValue, ordersShippingReimbursement, ordersPointsBorneByStore, } from "../../../_internal/shared/checkout/order-math.js";
 import { getDefaultCurrency } from "../../../core/baseline-resolver.js";
 import { finalizeStagedMediaUrl, finalizeStagedMediaField, finalizeStagedMediaArray, } from "../../media/finalize.js";
 import { StoreStatusValues } from "../../stores/schemas/firestore.js";
@@ -249,7 +249,19 @@ async function computeSellerEarnings(sellerId) {
      * alone.
      */
     const shippingReimbursement = ordersShippingReimbursement(eligibleOrders);
-    const deduction = computePayoutDeduction(grossAmount, siteSettings.commissions, shippingReimbursement);
+    /*
+     * D46/D47 — the points programme, which the STORE funds at both ends
+     * (decisions 3 and 17): points issued on these orders plus points spent on
+     * them. Deducted outside the commission and gateway bases, for the inverse
+     * of postage's reason — the seller agreed to fund a discount, not to pay us a
+     * commission on the discount they funded.
+     *
+     * 🛑 Passed at all FOUR call sites, exactly like `shippingReimbursement`
+     * above. `ordersPointsFunded` existed with zero consumers before this, which
+     * meant the platform had silently been funding the earn.
+     */
+    const pointsFunded = ordersPointsBorneByStore(eligibleOrders);
+    const deduction = computePayoutDeduction(grossAmount, siteSettings.commissions, shippingReimbursement, pointsFunded);
     return {
         eligibleOrders,
         grossAmount,
@@ -257,6 +269,22 @@ async function computeSellerEarnings(sellerId) {
         gatewayFee: deduction.gatewayFee,
         gstAmount: deduction.gstOnFee,
         netAmount: deduction.netAmount,
+        /*
+         * Surfaced so a seller can see WHY a payout is short of
+         * `gross − fees`. Two terms now move `netAmount` without appearing in
+         * `totalDeduction` — postage up, points down — and a net figure that
+         * cannot be reconstructed from the figures beside it reads as an error in
+         * our arithmetic rather than as the two things the seller agreed to.
+         *
+         * 🛑 Returned rather than written to `PayoutDocument`, matching
+         * `shippingReimbursement`, which is also not on that schema. One of these
+         * should probably be persisted eventually — a settled payout cannot be
+         * re-explained from a preview — but adding a document field with no reader
+         * is the pattern this very function just finished closing, so it waits for
+         * the admin surface that would read it.
+         */
+        shippingReimbursement: deduction.shippingReimbursement,
+        pointsFunded: deduction.pointsFunded,
         productCount: products.length,
         commissions: siteSettings.commissions,
     };
@@ -359,7 +387,9 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
      * scheduled job pay differently for the same orders. */
     const grossAmount = ordersTaxableValue(eligible);
     const bulkSiteSettings = await siteSettingsRepository.getSingleton();
-    const bulkDeduction = computePayoutDeduction(grossAmount, bulkSiteSettings.commissions, ordersShippingReimbursement(eligible));
+    const bulkDeduction = computePayoutDeduction(grossAmount, bulkSiteSettings.commissions, ordersShippingReimbursement(eligible), 
+    // The store-funded points, both ends — see the preview path above.
+    ordersPointsBorneByStore(eligible));
     const payoutDoc = await payoutRepository.createPayout({
         storeId: userId,
         sellerName: userDisplayName,

package/dist/features/seller/components/SellerOrdersView.js

@@ -2,7 +2,12 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { formatPhysicalLocation } from "../../../utils/physical-location.js";
 import { OrderAddonBadges } from "../../orders/components/OrderAddonBadges.js";
+import { OrderProvenanceCard } from "../../orders/components/OrderProvenanceCard.js";
+import { groupOrderItemsByLine } from "../../orders/utils/bundle-grouping.js";
 import { normalizeError } from "../../../errors/normalize.js";
+// The defining module, not a barrel (Root Cause #18). Maps a server error CODE
+// to user-facing copy; it can never return server text, which is the point.
+import { toUserMessage } from "../../../errors/error-display-map.js";
 import { Row, SIEVE_OP, sieveFilter } from "@mohasinac/appkit/client";
 import { sortBy } from "@mohasinac/appkit/client";
 import React, { useState, useCallback } from "react";
@@ -12,6 +17,7 @@ import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints.js";
 import { Badge, Button, Div, FilterChipGroup, SideDrawer, Span, Stack, Text, useToast } from "../../../ui/index.js";
 import { SELLER_ORDER_STATUS_TABS } from "../../admin/constants/filter-tabs.js";
 import { useOrderScope } from "../../orders/components/OrderScopeTabs.js";
+import { ORDER_LANE_TABS } from "../../orders/constants/order-lane-tabs.js";
 import { OrderStatusValues } from "../../orders/schemas/firestore.js";
 import { isManualPaymentMethod } from "../../orders/constants/payment-window.js";
 import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
@@ -60,6 +66,14 @@ const UPDATE_STATUS_OPTIONS = [
     { value: "delivered", label: "Delivered" },
     { value: "cancelled", label: "Cancelled" },
 ];
+/**
+ * One item row. Extracted verbatim when grouping landed so the single and
+ * grouped paths cannot render differently — two copies of this markup is how
+ * the field-name bug below would come back on one path only.
+ */
+function sellerOrderItemRow(item, key) {
+    return (_jsxs(Row, { paddingY: "y-xs-tall", padding: "x-sm", align: "center", justify: "between", gap: "3", children: [_jsxs(Row, { align: "center", gap: "sm", className: "min-w-0", children: [_jsx(Div, { className: "h-10 w-10 shrink-0", rounded: "md", overflow: "hidden", children: _jsx(MediaImage, { src: item.image, alt: item.title ?? "Order item", size: "thumbnail" }) }), _jsxs(Div, { className: "min-w-0", children: [_jsx(Text, { size: "sm", className: "truncate", weight: "medium", children: item.productTitle ?? item.title ?? item.productId ?? "Item" }), _jsxs(Text, { size: "xs", className: "text-[var(--appkit-color-text-muted)]", children: ["Qty: ", item.quantity ?? 1] })] })] }), _jsx(Text, { size: "sm", className: "shrink-0", weight: "medium", children: toCurrency(item.totalPrice ?? item.unitPrice ?? item.price ?? 0) })] }, key));
+}
 /**
  * Manual-payment state for the seller's read-only badge. Derived from the same
  * two fields the admin queue uses (`paymentProofUrl` + `paymentReviewOutcome`)
@@ -198,8 +212,33 @@ export function SellerOrderDetailPanel({ orderId, apiBase, onClose, }) {
                 body: JSON.stringify(payload),
             });
             if (!res.ok) {
-                const d = await res.json().catch(() => ({}));
-                throw new Error(d?.error ?? "Failed to update order");
+                const d = (await res.json().catch(() => ({})));
+                /*
+                 * 🛑 FIELD ERRORS GO ON THE FIELD. The server already sends them.
+                 *
+                 * `mapToHttpError` answers a rejected body with
+                 * `{ status: 400, code: VALIDATION_FAILED, message: "Validation
+                 * failed", issues }` — the per-field detail is ON THE WIRE. This
+                 * handler used to throw `d.error` and render it in the banner below,
+                 * so the seller saw a bare "Validation failed" with nothing marked and
+                 * no way to tell WHICH field was wrong. Rule #9 §6.
+                 *
+                 * `applyZodIssues` keys by the full dotted path, so a nested field
+                 * lands on itself rather than collapsing onto `issue.path[0]`.
+                 */
+                if (Array.isArray(d.issues) && d.issues.length > 0) {
+                    applyZodIssues(d.issues, form.setFieldError);
+                    return;
+                }
+                /*
+                 * 🛑 NEVER the server's own message, and this is not hypothetical.
+                 * `d.error` is server text; rendering it is how a Node
+                 * `MODULE_NOT_FOUND` with a `/var/task/.next/...` require stack was
+                 * once shown inside a buyer's "Place your bid" modal (Root Cause #86).
+                 * `toUserMessage` resolves through `errors.codes.*`, terminates at
+                 * UNKNOWN, and cannot return server internals.
+                 */
+                throw new Error(toUserMessage(d.code));
             }
             const updated = await res.json();
             const next = (updated?.data ?? updated);
@@ -217,8 +256,19 @@ export function SellerOrderDetailPanel({ orderId, apiBase, onClose, }) {
             });
         }
         catch (err) {
-            void normalizeError(err);
-            setSaveError(err.message);
+            /*
+             * `normalizeError`'s RESULT, not an `as Error` cast. The cast asserted a
+             * shape nothing checked, and the only reason it happened to work is that
+             * every throw above is one we construct — a rejected promise from `fetch`
+             * or a JSON parse failure is not an `Error` by that assertion's logic,
+             * it just happens to be one at runtime.
+             *
+             * What reaches the banner is now bounded: either `toUserMessage(code)`
+             * from the throw above (mapped copy, never server text) or a browser-level
+             * network message. Field-level problems never get here at all — they were
+             * routed to the fields by `applyZodIssues`.
+             */
+            setSaveError(normalizeError(err).message);
         }
         finally {
             setSaving(false);
@@ -249,21 +299,21 @@ export function SellerOrderDetailPanel({ orderId, apiBase, onClose, }) {
     const addrLine = typeof rawAddr === "string" && rawAddr.trim()
         ? rawAddr.trim()
         : [addr.addressLine1, addr.city, addr.state, addr.pincode].filter(Boolean).join(", ");
-    return (_jsxs(_Fragment, { children: [loading && (_jsx(Row, { align: "center", justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), fetchError && (_jsx(Div, { textSize: "sm", className: "mx-4 mt-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "lg", children: fetchError })), order && !loading && (_jsxs(Stack, { gap: "none", children: [_jsxs(Stack, { className: `flex-1 ${__O.yAuto}`, gap: "5", padding: "md", children: [_jsxs(Row, { align: "center", justify: "between", children: [_jsx(Badge, { variant: STATUS_BADGE_VARIANT[order.status ?? ""] ?? "default", children: order.status ?? "Unknown" }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text-muted)]", children: toRelativeDate(order.createdAt) })] }), (order.items ?? []).length > 0 && (_jsxs(Div, { children: [_jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text)] mb-2", weight: "semibold", children: "Items" }), _jsx(Div, { className: "divide-y divide-[var(--appkit-color-border)] divide-[var(--appkit-color-border)] border border-[var(--appkit-color-border)]", rounded: "lg", children: (order.items ?? []).map((item, i) => (_jsxs(Row, { paddingY: "y-xs-tall", padding: "x-sm", align: "center", justify: "between", gap: "3", children: [_jsxs(Row, { align: "center", gap: "sm", className: "min-w-0", children: [_jsx(Div, { className: "h-10 w-10 shrink-0", rounded: "md", overflow: "hidden", children: _jsx(MediaImage, { src: item.image, alt: item.title ?? "Order item", size: "thumbnail" }) }), _jsxs(Div, { className: "min-w-0", children: [_jsx(Text, { size: "sm", className: "truncate", weight: "medium", children: item.productTitle ?? item.title ?? item.productId ?? "Item" }), _jsxs(Text, { size: "xs", className: "text-[var(--appkit-color-text-muted)]", children: ["Qty: ", item.quantity ?? 1] })] })] }), _jsx(Text, { size: "sm", className: "shrink-0", weight: "medium", children: toCurrency(item.totalPrice ?? item.unitPrice ?? item.price ?? 0) })] }, i))) })] })), _jsx(OrderAddonBadges, { order: order, variant: "detail" }), order.giftWrapAddon && (_jsxs(Div, { className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)]", surface: "subtle", padding: "inline", rounded: "lg", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "\uD83C\uDF81 Gift wrap requested" }), order.giftWrapMessage && (_jsxs(Text, { size: "sm", className: "mt-1 text-[var(--appkit-color-text-muted)]", children: ["\u201C", order.giftWrapMessage, "\u201D"] }))] })), _jsxs(Row, { surface: "muted", padding: "inline", align: "center", justify: "between", rounded: "lg", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Total" }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-primary)]", weight: "bold", children: toCurrency(order.totalAmount ?? order.totalPrice ?? 0) })] }), addrLine && (_jsxs(Div, { children: [_jsx(Text, { size: "sm", className: "mb-1", weight: "semibold", children: "Shipping address" }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text-muted)]", children: [String(addr.fullName ?? ""), addrLine].filter(Boolean).join(" · ") })] })), order.paymentMethod && (_jsxs(Div, { children: [_jsxs(Row, { align: "center", justify: "between", className: "mb-1", gap: "3", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Payment" }), isManualPaymentMethod(order.paymentMethod) && (_jsx(Badge, { variant: sellerPaymentBadge(order).variant, children: sellerPaymentBadge(order).label }))] }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text-muted)]", transform: "capitalize", children: order.paymentMethod }), isManualPaymentMethod(order.paymentMethod) && order.paymentTransactionId && (_jsxs(Text, { size: "xs", color: "muted", className: "mt-1", children: ["UTR: ", order.paymentTransactionId] }))] })), order.emiEnabled && (_jsxs(Div, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", children: [_jsxs(Row, { align: "center", justify: "between", className: "mb-2", children: [_jsxs(Text, { size: "sm", weight: "semibold", children: ["EMI plan ", order.emiTenureMonths ? `· ${order.emiTenureMonths} months` : ""] }), _jsx(Badge, { variant: order.emiComplete ? "success" : "warning", children: order.emiComplete ? "Fully paid" : "In progress" })] }), _jsxs(Row, { align: "center", justify: "between", className: "mb-2", children: [_jsx(Text, { size: "xs", color: "muted", children: "Token collected" }), _jsx(Text, { size: "xs", weight: "medium", children: toCurrency(order.emiTokenAmount ?? 0) })] }), _jsxs(Row, { align: "center", justify: "between", className: "mb-3", children: [_jsx(Text, { size: "xs", color: "muted", children: "Remaining balance" }), _jsx(Text, { size: "xs", weight: "medium", children: toCurrency(order.emiRemainingBalance ?? 0) })] }), _jsx(Div, { className: "divide-y divide-[var(--appkit-color-border)] border border-[var(--appkit-color-border)]", rounded: "lg", children: (order.emiInstallments ?? []).map((inst) => (_jsxs(Row, { paddingY: "y-xs-tall", padding: "x-sm", align: "center", justify: "between", gap: "3", children: [_jsxs(Div, { className: "min-w-0", children: [_jsxs(Text, { size: "sm", weight: "medium", children: ["Installment ", inst.index, " \u00B7 ", toCurrency(inst.amount)] }), _jsx(Text, { size: "xs", color: "muted", children: inst.status === "paid" && inst.paidAt
-                                                                ? `Paid ${toRelativeDate(inst.paidAt)}`
-                                                                : inst.dueDate
-                                                                    ? `Due ${toRelativeDate(inst.dueDate)}`
-                                                                    : "" })] }), _jsxs(Row, { align: "center", gap: "sm", className: "shrink-0", children: [_jsx(Badge, { variant: EMI_INSTALLMENT_BADGE_VARIANT[inst.status] ?? "default", children: inst.status }), inst.status !== "paid" && (_jsx(Button, { action: ACTIONS.STORE["mark-installment-paid"], size: "sm", variant: "outline", isLoading: markingPaidIndex === inst.index, disabled: markingPaidIndex !== null, onClick: () => handleMarkInstallmentPaid(inst.index), children: "Mark paid" }))] })] }, inst.index))) }), emiError && (_jsx(Div, { textSize: "xs", className: "mt-2 border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", children: emiError }))] })), _jsxs(Stack, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", gap: "3", children: [_jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
-                                                    // SectionForm scrolls to the first erroring section and then
-                                                    // submits regardless, so the guard lives here.
-                                                    form.clearErrors();
-                                                    const parsed = sellerOrderUpdateSchema.safeParse(visibleValues(sellerOrderUpdateSchema, draft));
-                                                    if (!parsed.success) {
-                                                        applyZodIssues(parsed.error.issues, form.setFieldError);
-                                                        return;
-                                                    }
-                                                    void handleSave();
-                                                }, onValidationChange: () => form.validate(draft), schema: sellerOrderUpdateSchema, openIds: nav.openIds, onOpenChange: nav.setOpenIds, submitLabel: "Save", cancelLabel: "Close", onCancel: onClose, isLoading: saving })] }), saveError && (_jsx(Div, { textSize: "xs", className: "border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", children: saveError }))] })] }), _jsxs(Row, { border: "top", paddingY: "y-sm-tall", padding: "x-md", align: "center", justify: "end", gap: "3", children: [_jsx(Button, { variant: "outline", onClick: onClose, disabled: saving, children: "Close" }), _jsx(Button, { onClick: handleSave, isLoading: saving, disabled: saving, children: "Save" })] })] }))] }));
+    return (_jsxs(_Fragment, { children: [loading && (_jsx(Row, { align: "center", justify: "center", padding: "y-4xl", children: _jsx(Div, { className: "h-6 w-6 animate-spin border-2 border-[var(--appkit-color-primary)] border-t-transparent", rounded: "full" }) })), fetchError && (_jsx(Div, { textSize: "sm", className: "mx-4 mt-4 border border-error/20", color: "error", surface: "danger-surface", padding: "inline", rounded: "lg", children: fetchError })), order && !loading && (_jsx(Stack, { gap: "none", children: _jsxs(Stack, { className: `flex-1 ${__O.yAuto}`, gap: "5", padding: "md", children: [_jsxs(Row, { align: "center", justify: "between", children: [_jsx(Badge, { variant: STATUS_BADGE_VARIANT[order.status ?? ""] ?? "default", children: order.status ?? "Unknown" }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text-muted)]", children: toRelativeDate(order.createdAt) })] }), _jsx(OrderProvenanceCard, { sourceContext: order.sourceContext, currency: order.currency }), (order.items ?? []).length > 0 && (_jsxs(Div, { children: [_jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text)] mb-2", weight: "semibold", children: "Items" }), _jsx(Div, { className: "divide-y divide-[var(--appkit-color-border)] divide-[var(--appkit-color-border)] border border-[var(--appkit-color-border)]", rounded: "lg", children: groupOrderItemsByLine(order.items ?? []).map((group, gi) => group.kind === "single" ? (sellerOrderItemRow(group.item, `s-${group.index}`)) : (_jsxs(Div, { children: [_jsxs(Row, { paddingY: "y-xs", padding: "x-sm", align: "center", gap: "sm", surface: "muted", children: [_jsx(Text, { size: "xs", weight: "semibold", children: group.groupTitle ?? "Grouped purchase" }), _jsx(Text, { size: "xs", className: "text-[var(--appkit-color-text-muted)]", children: `${group.memberCount} ${group.memberCount === 1 ? "item" : "items"} · one line` })] }), _jsx(Div, { className: "pl-4", children: group.items.map(({ item, index }) => sellerOrderItemRow(item, `m-${index}`)) })] }, `g-${gi}`))) })] })), _jsx(OrderAddonBadges, { order: order, variant: "detail" }), order.giftWrapAddon && (_jsxs(Div, { className: "border border-[var(--appkit-color-primary-200)] dark:border-[var(--appkit-color-primary-800)]", surface: "subtle", padding: "inline", rounded: "lg", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "\uD83C\uDF81 Gift wrap requested" }), order.giftWrapMessage && (_jsxs(Text, { size: "sm", className: "mt-1 text-[var(--appkit-color-text-muted)]", children: ["\u201C", order.giftWrapMessage, "\u201D"] }))] })), _jsxs(Row, { surface: "muted", padding: "inline", align: "center", justify: "between", rounded: "lg", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Total" }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-primary)]", weight: "bold", children: toCurrency(order.totalAmount ?? order.totalPrice ?? 0) })] }), addrLine && (_jsxs(Div, { children: [_jsx(Text, { size: "sm", className: "mb-1", weight: "semibold", children: "Shipping address" }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text-muted)]", children: [String(addr.fullName ?? ""), addrLine].filter(Boolean).join(" · ") })] })), order.paymentMethod && (_jsxs(Div, { children: [_jsxs(Row, { align: "center", justify: "between", className: "mb-1", gap: "3", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Payment" }), isManualPaymentMethod(order.paymentMethod) && (_jsx(Badge, { variant: sellerPaymentBadge(order).variant, children: sellerPaymentBadge(order).label }))] }), _jsx(Text, { size: "sm", className: "text-[var(--appkit-color-text-muted)]", transform: "capitalize", children: order.paymentMethod }), isManualPaymentMethod(order.paymentMethod) && order.paymentTransactionId && (_jsxs(Text, { size: "xs", color: "muted", className: "mt-1", children: ["UTR: ", order.paymentTransactionId] }))] })), order.emiEnabled && (_jsxs(Div, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", children: [_jsxs(Row, { align: "center", justify: "between", className: "mb-2", children: [_jsxs(Text, { size: "sm", weight: "semibold", children: ["EMI plan ", order.emiTenureMonths ? `· ${order.emiTenureMonths} months` : ""] }), _jsx(Badge, { variant: order.emiComplete ? "success" : "warning", children: order.emiComplete ? "Fully paid" : "In progress" })] }), _jsxs(Row, { align: "center", justify: "between", className: "mb-2", children: [_jsx(Text, { size: "xs", color: "muted", children: "Token collected" }), _jsx(Text, { size: "xs", weight: "medium", children: toCurrency(order.emiTokenAmount ?? 0) })] }), _jsxs(Row, { align: "center", justify: "between", className: "mb-3", children: [_jsx(Text, { size: "xs", color: "muted", children: "Remaining balance" }), _jsx(Text, { size: "xs", weight: "medium", children: toCurrency(order.emiRemainingBalance ?? 0) })] }), _jsx(Div, { className: "divide-y divide-[var(--appkit-color-border)] border border-[var(--appkit-color-border)]", rounded: "lg", children: (order.emiInstallments ?? []).map((inst) => (_jsxs(Row, { paddingY: "y-xs-tall", padding: "x-sm", align: "center", justify: "between", gap: "3", children: [_jsxs(Div, { className: "min-w-0", children: [_jsxs(Text, { size: "sm", weight: "medium", children: ["Installment ", inst.index, " \u00B7 ", toCurrency(inst.amount)] }), _jsx(Text, { size: "xs", color: "muted", children: inst.status === "paid" && inst.paidAt
+                                                            ? `Paid ${toRelativeDate(inst.paidAt)}`
+                                                            : inst.dueDate
+                                                                ? `Due ${toRelativeDate(inst.dueDate)}`
+                                                                : "" })] }), _jsxs(Row, { align: "center", gap: "sm", className: "shrink-0", children: [_jsx(Badge, { variant: EMI_INSTALLMENT_BADGE_VARIANT[inst.status] ?? "default", children: inst.status }), inst.status !== "paid" && (_jsx(Button, { action: ACTIONS.STORE["mark-installment-paid"], size: "sm", variant: "outline", isLoading: markingPaidIndex === inst.index, disabled: markingPaidIndex !== null, onClick: () => handleMarkInstallmentPaid(inst.index), children: "Mark paid" }))] })] }, inst.index))) }), emiError && (_jsx(Div, { textSize: "xs", className: "mt-2 border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", children: emiError }))] })), _jsxs(Stack, { className: "border-t border-[var(--appkit-color-border)]", padding: "t-md", gap: "3", children: [_jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
+                                                // SectionForm scrolls to the first erroring section and then
+                                                // submits regardless, so the guard lives here.
+                                                form.clearErrors();
+                                                const parsed = sellerOrderUpdateSchema.safeParse(visibleValues(sellerOrderUpdateSchema, draft));
+                                                if (!parsed.success) {
+                                                    applyZodIssues(parsed.error.issues, form.setFieldError);
+                                                    return;
+                                                }
+                                                void handleSave();
+                                            }, onValidationChange: () => form.validate(draft), schema: sellerOrderUpdateSchema, openIds: nav.openIds, onOpenChange: nav.setOpenIds, submitLabel: "Save", cancelLabel: "Close", onCancel: onClose, isLoading: saving })] }), saveError && (_jsx(Div, { textSize: "xs", className: "border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", children: saveError }))] })] }) }))] }));
 }
 function OrderDetailDrawer({ orderId, apiBase, onClose, }) {
     return (_jsx(SideDrawer, { isOpen: true, title: `Order ${orderId}`, onClose: onClose, children: _jsx(SellerOrderDetailPanel, { orderId: orderId, apiBase: apiBase, onClose: onClose }) }));
@@ -343,9 +393,7 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
         {
             key: "primary",
             header: "Order",
-            render: (row) => (_jsxs(Row, { gap: "sm", align: "center", className: "min-w-0", children: [_jsx(Div, { className: "h-10 w-10 shrink-0", rounded: "md", overflow: "hidden", children: _jsx(MediaImage, { src: row.itemImage, alt: row.itemTitle ?? "Order item", size: "thumbnail" }) }), _jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsx(Text, { className: "truncate", size: "sm", weight: "semibold", children: row.itemTitle
-                                    ? `${row.itemTitle}${row.itemCount > 1 ? ` +${row.itemCount - 1} more` : ""}`
-                                    : row.primary }), _jsxs(Text, { size: "xs", color: "muted", children: [row.buyerName, " \u00B7 ", row.itemCount, " item", row.itemCount !== 1 ? "s" : ""] })] })] })),
+            render: (row) => (_jsxs(Row, { gap: "sm", align: "center", className: "min-w-0", children: [_jsx(Div, { className: "h-10 w-10 shrink-0", rounded: "md", overflow: "hidden", children: _jsx(MediaImage, { src: row.itemImage, alt: row.itemTitle ?? "Order item", size: "thumbnail" }) }), _jsxs(Stack, { gap: "none", className: "min-w-0", children: [_jsx(Text, { className: "truncate", size: "sm", weight: "semibold", children: row.primary }), _jsxs(Text, { size: "xs", color: "muted", children: [row.buyerName, " \u00B7 ", row.itemCount, " item", row.itemCount !== 1 ? "s" : ""] })] })] })),
         },
         {
             key: "totalAmount",
@@ -392,7 +440,7 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
             commit: "debounce",
         },
         emptyLabel: "No orders yet",
-        filterKeys: ["status"],
+        filterKeys: ["status", "orderType"],
         defaultSort: DEFAULT_SORT,
         queryKey: ["seller", "orders", "listing"],
         endpoint: SELLER_ENDPOINTS.ORDERS,
@@ -425,10 +473,45 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
                  * below as `itemTitle`.
                  */
                 primary: (() => {
-                    const title = typeof firstItem.productTitle === "string" ? firstItem.productTitle : "";
+                    /*
+                     * Counted in LINES, not item rows, and a grouped line is named by
+                     * its own title.
+                     *
+                     * This was `items[0].productTitle` + `itemsArr.length - 1`, so a
+                     * four-member bundle read "Dranzer S +3 more" — an arbitrary
+                     * member, implying four separate purchases. Grouping through the
+                     * same helper the drawer now uses makes it "Starter Bundle", and a
+                     * bundle beside one standalone item "+1 more".
+                     */
+                    const groups = groupOrderItemsByLine(itemsArr
+                        .filter((entry) => Boolean(entry) && typeof entry === "object")
+                        /*
+                         * Narrowed, not cast: `Record<string, unknown>` does NOT
+                         * satisfy `OrderItemForLineGrouping` — its `groupSlug` is
+                         * `unknown`, which is not assignable to `string | undefined`.
+                         * A cast would compile and then group on whatever junk a bad
+                         * document carried.
+                         */
+                        .map((e) => ({
+                        productTitle: typeof e.productTitle === "string" ? e.productTitle : undefined,
+                        groupSlug: typeof e.groupSlug === "string" ? e.groupSlug : undefined,
+                        groupTitle: typeof e.groupTitle === "string" ? e.groupTitle : undefined,
+                        bundleCategorySlug: typeof e.bundleCategorySlug === "string" ? e.bundleCategorySlug : undefined,
+                        bundleProductIds: Array.isArray(e.bundleProductIds)
+                            ? e.bundleProductIds.filter((v) => typeof v === "string")
+                            : undefined,
+                    })));
+                    const head = groups[0];
+                    const extra = Math.max(0, groups.length - 1);
+                    const title = head === undefined
+                        ? typeof firstItem.productTitle === "string"
+                            ? firstItem.productTitle
+                            : ""
+                        : head.kind === "bundle"
+                            ? (head.groupTitle ?? "Grouped purchase")
+                            : (head.item.productTitle ?? "");
                     if (!title)
                         return `Order ${toStringValue(item.id, "-")}`;
-                    const extra = itemsArr.length - 1;
                     return extra > 0 ? `${title} +${extra} more` : title;
                 })(),
                 /*
@@ -456,10 +539,29 @@ export function SellerOrdersView({ orderDetailApiBase = SELLER_ENDPOINTS.ORDERS,
         // The scope narrows; the status chip drills down inside it. Both are
         // emitted — an explicit status always wins, since picking "Delivered"
         // while sitting on Active should show delivered orders, not nothing.
-        buildFilters: (state) => (state.status && state.status !== "All" ? sieveFilter("status", SIEVE_OP.EQ, state.status) : undefined),
+        /*
+         * Two independent axes, joined. The lane answers "how was this won", the
+         * status answers "where is it now" — a seller asking "which of my auction
+         * wins are still unshipped" should not have to choose between them.
+         *
+         * 🛑 `orderType` is a registered SELLER_SIEVE_FIELD as of this change. It
+         * was not, and the failure would have been invisible: `throwExceptions` is
+         * false, so an unallowlisted field drops its clause and the chip would have
+         * returned the seller's whole order list while looking like it filtered
+         * (Root Cause #62). `standard` is stripped from the query server-side and
+         * refined in memory — see `/api/store/orders`.
+         */
+        buildFilters: (state) => [
+            state.status && state.status !== "All"
+                ? sieveFilter("status", SIEVE_OP.EQ, state.status)
+                : null,
+            state.orderType ? sieveFilter("orderType", SIEVE_OP.EQ, state.orderType) : null,
+        ]
+            .filter(Boolean)
+            .join(",") || undefined,
         buildExtraParams: () => orderScope.extraParams,
         renderAboveContent: orderScope.renderAboveContent,
-        renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsx(FilterChipGroup, { label: "Status", tabs: STATUS_OPTIONS, value: pendingFilters.status ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, status: id })) })),
+        renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsxs(_Fragment, { children: [_jsx(FilterChipGroup, { label: "Status", tabs: STATUS_OPTIONS, value: pendingFilters.status ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, status: id })) }), _jsx(FilterChipGroup, { label: "Type", tabs: ORDER_LANE_TABS, value: pendingFilters.orderType ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, orderType: id })) })] })),
         buildBulkActions: (selection) => {
             const handlePrintPackingSlips = () => {
                 const ids = selection.selectedIds.join(",");

package/dist/features/seller/hooks/useSellerListingData.js

@@ -1,10 +1,35 @@
 "use client";
 import { formatCurrency } from "../../../utils/number.formatter.js";
+// The defining module, not a barrel (Root Cause #18). `hasEncPrefix` is a pure
+// string test with no crypto in its import chain, so it is client-safe.
+import { hasEncPrefix } from "../../../security/pii-mask.js";
 export function toRecordArray(value) {
     return Array.isArray(value) ? value.filter(Boolean) : [];
 }
 export function toStringValue(value, fallback = "-") {
     if (typeof value === "string") {
+        /*
+         * 🛑 Ciphertext is not a display value, and this is the last line of
+         * defence rather than the fix.
+         *
+         * `OrderRepository.mapDoc` deliberately does not decrypt, so any route
+         * that forgets `revealOrders`/`maskedOrders` hands this function a stored
+         * `enc:v1:…` blob — and it is a `string`, so it rendered verbatim.
+         * Measured live in the seller's order list, where the row subtitle read
+         * `enc:v1:8plr3ZzKBqejPPti:MCZsrfOidLkSL6EogbxlCzU=:…` where the buyer's
+         * name belongs.
+         *
+         * This is a RECURRING class, not one slip: eight separate files in appkit
+         * carry a comment recording the same leak, and one of them had already
+         * baked `enc:v1:…` into 383 notification bodies. The route fix is the real
+         * repair; this makes the NEXT one degrade to "-" instead of garbage.
+         *
+         * `hasEncPrefix` rather than `isPiiEncrypted`: its own docstring says this
+         * is the check the display masks want, because a settings-encrypted or
+         * malformed envelope is exactly as unshowable as a PII one.
+         */
+        if (hasEncPrefix(value))
+            return fallback;
         return value.trim() || fallback;
     }
     if (typeof value === "number" || typeof value === "boolean") {

package/dist/features/shipments/schemas/validation.d.ts

@@ -15,7 +15,7 @@ export declare const createShipmentSchema: z.ZodObject<{
     laborRatePerHour: z.ZodOptional<z.ZodNumber>;
     notes: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    status: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs";
+    status: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs";
     shipmentNumber: string;
     supplierName: string;
     customsTotal: number;
@@ -29,7 +29,7 @@ export declare const createShipmentSchema: z.ZodObject<{
     laborHoursSpent?: number | undefined;
     laborRatePerHour?: number | undefined;
 }, {
-    status: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs";
+    status: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs";
     shipmentNumber: string;
     supplierName: string;
     customsTotal: number;
@@ -58,7 +58,7 @@ export declare const updateShipmentSchema: z.ZodObject<{
     laborRatePerHour: z.ZodOptional<z.ZodOptional<z.ZodNumber>>;
     notes: z.ZodOptional<z.ZodOptional<z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
-    status?: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs" | undefined;
+    status?: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs" | undefined;
     trackingNumber?: string | undefined;
     notes?: string | undefined;
     carrier?: string | undefined;
@@ -72,7 +72,7 @@ export declare const updateShipmentSchema: z.ZodObject<{
     laborHoursSpent?: number | undefined;
     laborRatePerHour?: number | undefined;
 }, {
-    status?: "received" | "completed" | "processing" | "cancelled" | "ordered" | "in_transit" | "planning" | "customs" | undefined;
+    status?: "received" | "completed" | "processing" | "cancelled" | "in_transit" | "ordered" | "planning" | "customs" | undefined;
     trackingNumber?: string | undefined;
     notes?: string | undefined;
     carrier?: string | undefined;