@mohasinac/appkit 4.62.0 → 4.63.0

package/dist/features/promotions/schemas/firestore.d.ts

@@ -72,6 +72,29 @@ export interface CouponDocument extends BaseDocument {
     discount: DiscountConfig;
     bxgy?: BXGYConfig;
     tiers?: TieredDiscount[];
+    /**
+     * D51 — percentage of the amount PAID that a `points_earn` coupon awards as
+     * points. Meaningless, and ignored, on every other type.
+     *
+     * ## 🛑 Why this is not `discount.value`
+     *
+     * `discount` is read by `computeGroupCouponDiscount` to reduce the order.
+     * Overloading its `value` to mean "percent awarded as points" would make a
+     * points coupon discount the order by the same number it was supposed to
+     * credit — the exact overloading that `bxgy` and `tiers` are separate fields
+     * to avoid.
+     *
+     * `discount` stays REQUIRED on the interface because every existing coupon
+     * has one and widening it to optional would ripple through ~30 readers; a
+     * points coupon carries `{ value: 0 }`. The protection that matters is in
+     * the discount loop, which skips on TYPE rather than trusting that zero
+     * (`coupon-discount.ts`) — bad data cannot bypass a type check.
+     *
+     * The base is the post-discount amount actually paid in money, which is
+     * `POINTS_EARN_PERCENT`'s existing rule; this field exists so a campaign can
+     * raise it (the festival double event) without editing a constant.
+     */
+    pointsPercent?: number;
     usage: UsageConfig;
     validity: ValidityConfig;
     restrictions: RestrictionsConfig;
@@ -143,6 +166,7 @@ export declare const COUPON_FIELDS: {
         readonly FIXED: CouponType;
         readonly FREE_SHIPPING: CouponType;
         readonly BUY_X_GET_Y: CouponType;
+        readonly POINTS_EARN: CouponType;
     };
     readonly SCOPE_VALUES: {
         readonly ADMIN: "admin";

package/dist/features/promotions/schemas/firestore.js

@@ -48,6 +48,7 @@ export const COUPON_FIELDS = {
         FIXED: "fixed",
         FREE_SHIPPING: "free_shipping",
         BUY_X_GET_Y: "buy_x_get_y",
+        POINTS_EARN: "points_earn",
     },
     SCOPE_VALUES: {
         ADMIN: "admin",
@@ -59,6 +60,9 @@ export const COUPON_TYPE_LABELS = {
     fixed: "Fixed Amount Discount",
     free_shipping: "Free Shipping",
     buy_x_get_y: "Buy X Get Y",
+    // Named for what the buyer gets, not for the mechanism. "Points earn" is
+    // our word for it; "Points back" is what appears on their balance.
+    points_earn: "Points Back",
 };
 export const DEFAULT_COUPON_DATA = {
     usage: { currentUsage: 0 },

package/dist/features/promotions/types/index.d.ts

@@ -1,4 +1,22 @@
-export type CouponType = "percentage" | "fixed" | "free_shipping" | "buy_x_get_y";
+export type CouponType = "percentage" | "fixed" | "free_shipping" | "buy_x_get_y"
+/**
+ * D51 — a coupon that awards POINTS rather than discounting the order.
+ *
+ * 🛑 It carries `pointsPercent`, not a discount value, and it must never
+ * reach the discount arithmetic: a `points_earn` coupon with a `discount`
+ * field read by `computeGroupCouponDiscount` would silently discount the
+ * order as well as award points.
+ *
+ * It exists because `RIPLI05` is a PERMANENT, site-wide coupon, and
+ * `detectCouponConflict` permits exactly one admin coupon site-wide — so
+ * putting it in the admin slot would make every other platform coupon
+ * unusable for as long as it exists. It gets its own stacking bucket.
+ *
+ * Adding it here is a compile error at `COUPON_TYPE_LABELS`, which is a
+ * `Record<CouponType, string>` — that is the point of declaring the union
+ * first.
+ */
+ | "points_earn";
 export type CouponScope = "admin" | "seller";
 export interface CouponItem {
     id: string;

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -52,6 +52,20 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
     findApprovedByStore(storeId: string, limit?: number): Promise<ReviewDocument[]>;
     findByUser(userId: string): Promise<ReviewDocument[]>;
     findApprovedByUser(userId: string): Promise<ReviewDocument[]>;
+    /**
+     * How many reviews this account has WRITTEN.
+     *
+     * Deliberately every status and both reviewer roles — it counts the same set
+     * `GET /api/user/reviews` lists by default (`findByUser`), so the number in
+     * the sidebar and the rows on the page it links to agree by construction. A
+     * count that quietly excluded pending reviews would read as the author's
+     * work having vanished.
+     *
+     * An aggregation, not `findByUser(...).length`: that sibling downloads every
+     * review the account has ever written to learn how many there are, and the
+     * caller here runs on every session profile fetch.
+     */
+    countByUser(userId: string): Promise<number>;
     findPending(): Promise<ReviewDocument[]>;
     findByStatus(status: ReviewStatus): Promise<ReviewDocument[]>;
     /**

package/dist/features/reviews/repository/reviews.repository.js

@@ -175,6 +175,22 @@ class ReviewRepository extends BaseRepository {
             .get();
         return snapshot.docs.map((doc) => this.mapDoc(doc));
     }
+    /**
+     * How many reviews this account has WRITTEN.
+     *
+     * Deliberately every status and both reviewer roles — it counts the same set
+     * `GET /api/user/reviews` lists by default (`findByUser`), so the number in
+     * the sidebar and the rows on the page it links to agree by construction. A
+     * count that quietly excluded pending reviews would read as the author's
+     * work having vanished.
+     *
+     * An aggregation, not `findByUser(...).length`: that sibling downloads every
+     * review the account has ever written to learn how many there are, and the
+     * caller here runs on every session profile fetch.
+     */
+    async countByUser(userId) {
+        return getFirestoreCount(this.getCollection().where(REVIEW_FIELDS.USER_ID, "==", userId));
+    }
     async findPending() {
         return this.findBy(REVIEW_FIELDS.STATUS, "pending");
     }

package/dist/features/scams/components/ScamProfileView.js

@@ -4,7 +4,7 @@ import { formatCurrency } from "../../../utils/number.formatter.js";
 const CLS_OUTLINE_BTN = "appkit-button appkit-button--outline appkit-button--md flex w-full items-center gap-[var(--appkit-space-2)]";
 import Link from "next/link.js";
 import { Shield, Phone, Wallet, Mail, AlertOctagon, Flag, Eye, Users, Calendar, ExternalLink, FileText, MessageSquare, Link2, } from "lucide-react";
-import { Alert, Anchor, Badge, Breadcrumb, Card, CardBody, CardHeader, Container, Div, EmptyState, Grid, Heading, Main, Row, Section, Span, Stack, Text, } from "../../../ui/index.js";
+import { Alert, Anchor, Badge, Breadcrumb, Card, CardBody, CardHeader, Container, Disclaimer, Div, EmptyState, Grid, Heading, Main, Row, Section, Span, Stack, Text, } from "../../../ui/index.js";
 import { MediaImage } from "../../media/MediaImage.js";
 import { SCAM_PLATFORM_LABELS, SCAMMER_STATUS_LABELS, SOCIAL_PLATFORM_LABELS, CONTEST_TYPE_LABELS, } from "../schemas/firestore.js";
 import { SCAM_TYPE_LABELS, getScamType } from "../constants/scam-types.js";
@@ -32,7 +32,7 @@ function statusVariant(status) {
 }
 // ─── Sub-components ───────────────────────────────────────────────────────────
 function ScammerHeaderCard({ scammer }) {
-    return (_jsx(Card, { variant: "elevated", padding: "lg", children: _jsxs(Stack, { gap: "md", children: [_jsxs(Row, { justify: "between", gap: "md", align: "start", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "bold", size: "2xl", children: scammer.displayNames[0] }), scammer.displayNames.length > 1 && (_jsxs(Text, { variant: "secondary", size: "sm", children: ["Also known as: ", scammer.displayNames.slice(1).join(", ")] }))] }), _jsx(Badge, { variant: statusVariant(scammer.status), children: SCAMMER_STATUS_LABELS[scammer.status] ?? scammer.status })] }), _jsxs(Row, { gap: "xs", wrap: true, children: [_jsx(Badge, { variant: "warning", children: SCAM_TYPE_LABELS[scammer.scamType] ?? scammer.scamType }), _jsxs(Badge, { variant: "default", children: ["via ", SCAM_PLATFORM_LABELS[scammer.scamPlatform] ?? scammer.scamPlatform] }), scammer.tags.includes("repeat_offender") && (_jsx(Badge, { variant: "danger", children: "Repeat Offender" }))] }), _jsxs(Row, { gap: "md", wrap: true, children: [_jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Eye, { className: "h-4 w-4" }), scammer.views, " views"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Users, { className: "h-4 w-4" }), scammer.incidentCount + 1, " victim", scammer.incidentCount !== 0 ? "s" : "", " reported"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Calendar, { className: "h-4 w-4" }), "Reported ", formatDate(scammer.createdAt)] }), scammer.amountLost ? (_jsxs(Text, { className: "text-[color:var(--appkit-color-danger,theme(colors.red.600))]", size: "sm", weight: "medium", children: [formatCurrency(scammer.amountLost), " lost (primary incident)"] })) : null] })] }) }));
+    return (_jsx(Card, { variant: "elevated", padding: "lg", children: _jsxs(Stack, { gap: "md", children: [_jsx(Disclaimer, { id: "scam-registry" }), _jsxs(Row, { justify: "between", gap: "md", align: "start", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "bold", size: "2xl", children: scammer.displayNames[0] }), scammer.displayNames.length > 1 && (_jsxs(Text, { variant: "secondary", size: "sm", children: ["Also known as: ", scammer.displayNames.slice(1).join(", ")] }))] }), _jsx(Badge, { variant: statusVariant(scammer.status), children: SCAMMER_STATUS_LABELS[scammer.status] ?? scammer.status })] }), _jsxs(Row, { gap: "xs", wrap: true, children: [_jsx(Badge, { variant: "warning", children: SCAM_TYPE_LABELS[scammer.scamType] ?? scammer.scamType }), _jsxs(Badge, { variant: "default", children: ["via ", SCAM_PLATFORM_LABELS[scammer.scamPlatform] ?? scammer.scamPlatform] }), scammer.tags.includes("repeat_offender") && (_jsx(Badge, { variant: "danger", children: "Repeat Offender" }))] }), _jsxs(Row, { gap: "md", wrap: true, children: [_jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Eye, { className: "h-4 w-4" }), scammer.views, " views"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Users, { className: "h-4 w-4" }), scammer.incidentCount + 1, " victim", scammer.incidentCount !== 0 ? "s" : "", " reported"] }), _jsxs(Text, { variant: "secondary", layout: "flex", gap: "1.5", size: "sm", children: [_jsx(Calendar, { className: "h-4 w-4" }), "Reported ", formatDate(scammer.createdAt)] }), scammer.amountLost ? (_jsxs(Text, { className: "text-[color:var(--appkit-color-danger,theme(colors.red.600))]", size: "sm", weight: "medium", children: [formatCurrency(scammer.amountLost), " lost (primary incident)"] })) : null] })] }) }));
 }
 function ScammerIncidentsSection({ incidents }) {
     return (_jsxs(Stack, { gap: "sm", children: [_jsx(Row, { justify: "between", align: "center", children: _jsxs(Heading, { level: 2, size: "base", weight: "semibold", children: ["Additional Incidents", incidents.length > 0 && ` (${incidents.length})`] }) }), incidents.length === 0 ? (_jsx(EmptyState, { icon: _jsx(FileText, { className: "h-8 w-8" }), title: "No additional incidents yet", description: "Other victims' verified reports linked to this profile will appear here." })) : (_jsx(Stack, { gap: "sm", children: incidents.map((inc) => (_jsx(Card, { variant: "outlined", padding: "md", children: _jsxs(Stack, { gap: "xs", children: [_jsxs(Row, { justify: "between", align: "start", gap: "sm", wrap: true, children: [_jsxs(Row, { gap: "xs", wrap: true, children: [_jsx(Badge, { variant: "warning", children: SCAM_TYPE_LABELS[inc.scamType] ?? inc.scamType }), _jsxs(Badge, { variant: "default", children: ["via ", SCAM_PLATFORM_LABELS[inc.scamPlatform] ?? inc.scamPlatform] })] }), _jsx(Text, { variant: "secondary", size: "xs", children: formatDate(inc.createdAt) })] }), inc.itemInvolved && (_jsxs(Text, { variant: "secondary", size: "xs", children: ["Item: ", inc.itemInvolved] })), inc.amountLost ? (_jsxs(Text, { className: "text-[color:var(--appkit-color-danger,theme(colors.red.600))]", size: "xs", weight: "medium", children: [formatCurrency(inc.amountLost), " lost"] })) : null, _jsx(Text, { variant: "secondary", className: "leading-relaxed", size: "sm", children: inc.description.length > 200

package/dist/features/scams/components/ScamRegistryView.js

@@ -7,7 +7,7 @@ const CLS_ICON_SM = "h-3 w-3 shrink-0";
 const CLS_ROW_CHEVRON = "h-4 w-4 shrink-0 transition group-hover:text-error text-[var(--appkit-color-text-faint)]";
 const CLS_PILL_LINK = "inline-flex items-center gap-[var(--appkit-space-1)] rounded-full bg-error-surface dark:bg-error-surface px-[var(--appkit-space-2-5)] py-[var(--appkit-space-0-5)] text-[length:var(--appkit-text-xs)] font-medium text-error dark:text-error hover:bg-error-surface transition-colors";
 import { Shield, Phone, Wallet, Mail, ChevronRight, Search } from "lucide-react";
-import { Button, Container, Div, Form, Heading, Main, Section, Select, Text, Grid, Stack, Row, Card, Badge, Alert, EmptyState, Input, } from "../../../ui/index.js";
+import { Button, Container, Disclaimer, Div, Form, Heading, Main, Section, Select, Text, Grid, Stack, Row, Card, Badge, Alert, EmptyState, Input, } from "../../../ui/index.js";
 import { listVerifiedScammers } from "../actions/scam-actions.js";
 import { SCAM_PLATFORM_LABELS } from "../schemas/firestore.js";
 import { SCAM_TYPES, SCAM_TYPE_LABELS } from "../constants/scam-types.js";
@@ -61,7 +61,7 @@ export async function ScamRegistryView({ searchParams = {} }) {
         const qs = p.toString();
         return `/scams${qs ? `?${qs}` : ""}`;
     }
-    return (_jsxs(Main, { children: [_jsx(Div, { className: "border-b appkit-alert--warning", rounded: "none", children: _jsx(Container, { padding: "y-xs", size: "xl", className: "", children: _jsxs(Alert, { variant: "warning", compact: true, children: ["All profiles on this page have been verified by our moderation team. If you recognise a scammer not listed here,", " ", _jsx(Link, { href: reportHref, className: "font-medium underline hover:no-underline", children: "report them" }), "."] }) }) }), _jsx(Section, { padding: "y-2xl", children: _jsx(Container, { size: "xl", children: _jsxs(Stack, { gap: "xl", children: [_jsxs(Row, { justify: "between", gap: "md", align: "end", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "semibold", size: "3xl", children: "Scam Registry" }), _jsx(Text, { variant: "secondary", size: "sm", children: "Verified scammers active in India's collectibles community. Search by name, phone, or UPI." })] }), _jsxs(Link, { href: reportHref, className: "appkit-button appkit-button--danger appkit-button--md shrink-0", children: [_jsx(Shield, { className: "h-4 w-4" }), "Report a Scammer"] })] }), _jsx(Form, { method: "GET", children: _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Div, { className: "flex-1 min-w-48", children: _jsx(Input, { type: "search", name: "q", defaultValue: query, placeholder: "Search name, phone, UPI ID, or email\u2026", icon: _jsx(Search, { className: "h-4 w-4" }) }) }), _jsx(Select, { name: "scamType", defaultValue: scamType, options: SCAM_TYPES.map((t) => ({ value: t.id, label: t.label })), placeholder: "All scam types" }), _jsx(Select, { name: "sort", defaultValue: sort, options: SORT_OPTIONS.map((o) => ({ value: o.value, label: o.label })) }), _jsx(Button, { type: "submit", variant: "primary", size: "sm", children: "Search" }), (query || scamType || sort !== "-createdAt") && (_jsx(Link, { href: ROUTES.PUBLIC.SCAMS, className: "rounded-lg border border-[var(--appkit-color-border)] px-[var(--appkit-space-4)] py-[var(--appkit-space-2)] text-[length:var(--appkit-text-sm)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover transition-colors", children: "Clear" }))] }) }), scamType && SCAM_TYPE_LABELS[scamType] && (_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { variant: "secondary", size: "xs", children: "Filtering by:" }), _jsxs(Link, { href: buildHref({ scamType: "" }), className: CLS_PILL_LINK, children: [SCAM_TYPE_LABELS[scamType], _jsx(Span, { "aria-hidden": "true", children: "\u00D7" })] })] })), result.items.length === 0 ? (_jsx(EmptyState, { icon: _jsx(Shield, { className: "h-12 w-12" }), title: query || scamType
+    return (_jsxs(Main, { children: [_jsx(Div, { className: "border-b appkit-alert--warning", rounded: "none", children: _jsx(Container, { padding: "y-xs", size: "xl", className: "", children: _jsxs(Alert, { variant: "warning", compact: true, children: ["All profiles on this page have been verified by our moderation team. If you recognise a scammer not listed here,", " ", _jsx(Link, { href: reportHref, className: "font-medium underline hover:no-underline", children: "report them" }), "."] }) }) }), _jsx(Section, { padding: "y-2xl", children: _jsx(Container, { size: "xl", children: _jsxs(Stack, { gap: "xl", children: [_jsxs(Row, { justify: "between", gap: "md", align: "end", wrap: true, children: [_jsxs(Stack, { gap: "xs", children: [_jsx(Heading, { level: 1, weight: "semibold", size: "3xl", children: "Scam Registry" }), _jsx(Text, { variant: "secondary", size: "sm", children: "Reports of scams in India's collectibles community, submitted by buyers and sellers. Search by name, phone, or UPI." })] }), _jsxs(Link, { href: reportHref, className: "appkit-button appkit-button--danger appkit-button--md shrink-0", children: [_jsx(Shield, { className: "h-4 w-4" }), "Report a Scammer"] })] }), _jsx(Disclaimer, { id: "scam-registry" }), _jsx(Form, { method: "GET", children: _jsxs(Row, { wrap: true, gap: "sm", children: [_jsx(Div, { className: "flex-1 min-w-48", children: _jsx(Input, { type: "search", name: "q", defaultValue: query, placeholder: "Search name, phone, UPI ID, or email\u2026", icon: _jsx(Search, { className: "h-4 w-4" }) }) }), _jsx(Select, { name: "scamType", defaultValue: scamType, options: SCAM_TYPES.map((t) => ({ value: t.id, label: t.label })), placeholder: "All scam types" }), _jsx(Select, { name: "sort", defaultValue: sort, options: SORT_OPTIONS.map((o) => ({ value: o.value, label: o.label })) }), _jsx(Button, { type: "submit", variant: "primary", size: "sm", children: "Search" }), (query || scamType || sort !== "-createdAt") && (_jsx(Link, { href: ROUTES.PUBLIC.SCAMS, className: "rounded-lg border border-[var(--appkit-color-border)] px-[var(--appkit-space-4)] py-[var(--appkit-space-2)] text-[length:var(--appkit-text-sm)] text-[var(--appkit-color-text-muted)] hover:bg-surface-hover transition-colors", children: "Clear" }))] }) }), scamType && SCAM_TYPE_LABELS[scamType] && (_jsxs(Row, { gap: "sm", align: "center", children: [_jsx(Text, { variant: "secondary", size: "xs", children: "Filtering by:" }), _jsxs(Link, { href: buildHref({ scamType: "" }), className: CLS_PILL_LINK, children: [SCAM_TYPE_LABELS[scamType], _jsx(Span, { "aria-hidden": "true", children: "\u00D7" })] })] })), result.items.length === 0 ? (_jsx(EmptyState, { icon: _jsx(Shield, { className: "h-12 w-12" }), title: query || scamType
                                     ? "No verified scammers matched your filters"
                                     : "No verified scammers in the registry yet", description: query || scamType
                                     ? "Try a different search or clear your filters."

package/dist/features/scams/repository/scammer.repository.js

@@ -142,7 +142,8 @@ class ScammerRepository extends BaseRepository {
                 reason: ctx?.reason,
                 note: ctx?.note,
                 // A scammer profile is built entirely from identifying details, and
-                // `encryptPiiFields` never descends into arrays.
+                // `encryptPiiFields` covers a field only where it is NAMED. It CAN
+                // reach into an array via `array[].key`, but a bare key does not.
                 piiFields: SCAMMER_HISTORY_PII_FIELDS,
             });
             const data = prepareForFirestore(withEntry ?? { ...input, updatedAt: new Date() });

package/dist/features/scams/schemas/firestore.d.ts

@@ -403,6 +403,7 @@ export declare const SCAMMER_TRACKED_FIELDS: readonly ["status", "verifiedBy", "
 /**
  * PII on this document, for `withHistory`'s scrub. A scammer profile is built
  * ENTIRELY out of identifying details, so this list is long on purpose —
- * `encryptPiiFields` never descends into arrays, and history is an array.
+ * `encryptPiiFields` covers only NAMED paths, and nobody is going to declare
+ * `statusHistory[].changes.<key>` for every field that might land there.
  */
 export declare const SCAMMER_HISTORY_PII_FIELDS: readonly ["name", "displayName", "email", "phone", "phoneNumber", "upiId", "bankAccount", "accountNumber", "reporterEmail", "reporterName"];

package/dist/features/scams/schemas/firestore.js

@@ -248,7 +248,8 @@ export const SCAMMER_TRACKED_FIELDS = [
 /**
  * PII on this document, for `withHistory`'s scrub. A scammer profile is built
  * ENTIRELY out of identifying details, so this list is long on purpose —
- * `encryptPiiFields` never descends into arrays, and history is an array.
+ * `encryptPiiFields` covers only NAMED paths, and nobody is going to declare
+ * `statusHistory[].changes.<key>` for every field that might land there.
  */
 export const SCAMMER_HISTORY_PII_FIELDS = [
     "name",

package/dist/features/search/action-index/tab-entries.js

@@ -103,7 +103,7 @@ export const CONSOLIDATED_TAB_SURFACES = [
         tab: "navigation",
         portal: "admin",
         sectionPath: "Admin › System › Permissions Toggles",
-        requiredPermission: "settings:write",
+        requiredPermission: "admin:settings:write",
     },
 ];
 export function deriveConsolidatedTabEntries(hrefs) {

package/dist/features/seller/actions/offer-actions.js

@@ -7,6 +7,9 @@
 import { serverLogger } from "../../../monitoring/index.js";
 import { offerRepository } from "../repository/offer.repository.js";
 import { productRepository } from "../../products/repository/products.repository.js";
+import { categoriesRepository } from "../../categories/repository/categories.repository.js";
+import { resolveParcel } from "../../../_internal/shared/features/shipping/parcel.js";
+import { checkDestinations, assertAllServiceable, } from "../../../_internal/server/features/shipping/book-split.js";
 import { ProductStatusValues } from "../../products/schemas/index.js";
 import { sendNotification } from "../../admin/actions/notification-actions.js";
 import { userRepository } from "../../auth/repository/user.repository.js";
@@ -184,6 +187,59 @@ export async function respondToOffer(userId, input) {
         throw new ValidationError(ERROR_MESSAGES.OFFER.EXPIRED);
     let updated;
     if (action === "accept") {
+        /*
+         * ── S5a: a coordinated offer must be SHIPPABLE before it is binding ──
+         *
+         * Accepting locks a price and starts the buyer's checkout deadline, so it
+         * is the last moment at which "the courier cannot reach one of these
+         * addresses" costs nobody anything. After it, the coordinator has paid
+         * and the only remedies left are a refund and an apology.
+         *
+         * 🛑 Deliberately NOT at booking time, which is the obvious place and the
+         * wrong one: by then the money is taken, and a four-destination order
+         * that fails on the fourth has three parcels the carrier already accepted
+         * and no rollback. `assertAllServiceable` still guards the booking path —
+         * this is the check that keeps it from ever being reached in that state.
+         *
+         * 🛑 Costs NOTHING on an ordinary offer. `coordination` is absent on
+         * every non-coordinated one, so this whole block is skipped — a check
+         * that charges every seller for a feature most never use is how Rule #6's
+         * round-trip budget gets spent by accident.
+         *
+         * 🛑 The weight comes from `resolveParcel`, NOT from a literal. That
+         * module's whole argument is that an item weight systematically
+         * under-estimates a packed box (a bey is ~30 g loose and ~300 g boxed),
+         * and a hard-coded `1` here would be a fourth, worse tier beside the
+         * three it defines. The shipment tier is deliberately absent — nothing is
+         * packed yet at accept time, which is exactly the case tier two and three
+         * exist for.
+         *
+         * 🛑 **No resolvable weight SKIPS the check** rather than guessing one.
+         * The carrier is being asked "can you reach this pincode with a parcel of
+         * this size", so an invented weight asks a question about a parcel that
+         * does not exist and may refuse a destination that is perfectly
+         * reachable. Not checking is honest; the booking path still has
+         * `assertAllServiceable`, and a listing with no weight at any tier has a
+         * data problem this is not the place to report.
+         */
+        const members = offer.coordination?.members ?? [];
+        if (members.length > 0) {
+            const offerProduct = await productRepository.findById(offer.productId);
+            /*
+             * 🛑 `categorySlugs[0]` is the LEAF, and `findById` is the right lookup
+             * for it. Products carry the full ancestor chain `[leaf, …, root]` and
+             * categories are pure slugs (`id === slug`), so this is one get rather
+             * than the `where("slug","==")` query `findBySlugAndType` would run —
+             * and the leaf is the tier whose packed default is actually about this
+             * kind of item. A root's default would be the average of the catalogue.
+             */
+            const leafSlug = offerProduct?.categorySlugs?.[0];
+            const leaf = leafSlug ? await categoriesRepository.findById(leafSlug) : null;
+            const parcel = resolveParcel(null, offerProduct, leaf?.productDefaults ?? null);
+            if (parcel) {
+                assertAllServiceable(await checkDestinations(members, parcel.weightG / 1000));
+            }
+        }
         updated = await offerRepository.accept(offerId, offer.offerAmount, sellerNote, new Date(Date.now() + OFFER_CHECKOUT_WINDOW_MS));
     }
     else if (action === "decline") {

package/dist/features/seller/actions/seller-actions.d.ts

@@ -181,7 +181,7 @@ export declare function listSellerPayouts(userId: string, params?: {
     page?: number;
     pageSize?: number;
 }): Promise<{
-    items: import("../../payments").PayoutDocument[];
+    items: import("../../payments").StorePayoutDocument[];
     total: number;
     page: number;
     pageSize: number;

package/dist/features/seller/actions/seller-actions.js

@@ -28,7 +28,7 @@ import { couponsRepository } from "../../promotions/repository/coupons.repositor
 import { generateStoreSlug } from "../../stores/schemas/firestore.js";
 import { siteSettingsRepository } from "../../admin/repository/site-settings.repository.js";
 import { computePayoutDeduction } from "../../../_internal/shared/fees/calculator.js";
-import { ordersTaxableValue, ordersShippingReimbursement, } from "../../../_internal/shared/checkout/order-math.js";
+import { ordersTaxableValue, ordersShippingReimbursement, ordersPointsBorneByStore, } from "../../../_internal/shared/checkout/order-math.js";
 import { getDefaultCurrency } from "../../../core/baseline-resolver.js";
 import { finalizeStagedMediaUrl, finalizeStagedMediaField, finalizeStagedMediaArray, } from "../../media/finalize.js";
 import { StoreStatusValues } from "../../stores/schemas/firestore.js";
@@ -249,7 +249,19 @@ async function computeSellerEarnings(sellerId) {
      * alone.
      */
     const shippingReimbursement = ordersShippingReimbursement(eligibleOrders);
-    const deduction = computePayoutDeduction(grossAmount, siteSettings.commissions, shippingReimbursement);
+    /*
+     * D46/D47 — the points programme, which the STORE funds at both ends
+     * (decisions 3 and 17): points issued on these orders plus points spent on
+     * them. Deducted outside the commission and gateway bases, for the inverse
+     * of postage's reason — the seller agreed to fund a discount, not to pay us a
+     * commission on the discount they funded.
+     *
+     * 🛑 Passed at all FOUR call sites, exactly like `shippingReimbursement`
+     * above. `ordersPointsFunded` existed with zero consumers before this, which
+     * meant the platform had silently been funding the earn.
+     */
+    const pointsFunded = ordersPointsBorneByStore(eligibleOrders);
+    const deduction = computePayoutDeduction(grossAmount, siteSettings.commissions, shippingReimbursement, pointsFunded);
     return {
         eligibleOrders,
         grossAmount,
@@ -257,6 +269,22 @@ async function computeSellerEarnings(sellerId) {
         gatewayFee: deduction.gatewayFee,
         gstAmount: deduction.gstOnFee,
         netAmount: deduction.netAmount,
+        /*
+         * Surfaced so a seller can see WHY a payout is short of
+         * `gross − fees`. Two terms now move `netAmount` without appearing in
+         * `totalDeduction` — postage up, points down — and a net figure that
+         * cannot be reconstructed from the figures beside it reads as an error in
+         * our arithmetic rather than as the two things the seller agreed to.
+         *
+         * 🛑 Returned rather than written to `PayoutDocument`, matching
+         * `shippingReimbursement`, which is also not on that schema. One of these
+         * should probably be persisted eventually — a settled payout cannot be
+         * re-explained from a preview — but adding a document field with no reader
+         * is the pattern this very function just finished closing, so it waits for
+         * the admin surface that would read it.
+         */
+        shippingReimbursement: deduction.shippingReimbursement,
+        pointsFunded: deduction.pointsFunded,
         productCount: products.length,
         commissions: siteSettings.commissions,
     };
@@ -271,6 +299,8 @@ export async function requestPayout(userId, userName, userEmail, input) {
     if (earnings.netAmount <= 0 || earnings.eligibleOrders.length === 0)
         throw new ValidationError("No eligible earnings available for payout.");
     const payout = await payoutRepository.createPayout({
+        /* A seller requesting their own earnings — a liability settlement. */
+        payeeType: "store",
         storeId: userId,
         sellerName: userName,
         sellerEmail: userEmail,
@@ -359,8 +389,12 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
      * scheduled job pay differently for the same orders. */
     const grossAmount = ordersTaxableValue(eligible);
     const bulkSiteSettings = await siteSettingsRepository.getSingleton();
-    const bulkDeduction = computePayoutDeduction(grossAmount, bulkSiteSettings.commissions, ordersShippingReimbursement(eligible));
+    const bulkDeduction = computePayoutDeduction(grossAmount, bulkSiteSettings.commissions, ordersShippingReimbursement(eligible), 
+    // The store-funded points, both ends — see the preview path above.
+    ordersPointsBorneByStore(eligible));
     const payoutDoc = await payoutRepository.createPayout({
+        /* A seller requesting their own earnings — a liability settlement. */
+        payeeType: "store",
         storeId: userId,
         sellerName: userDisplayName,
         sellerEmail: userEmail,

package/dist/features/seller/components/DispatchForm.d.ts

@@ -0,0 +1,11 @@
+import React from "react";
+export declare function DispatchForm({ orderId, 
+/** Already dispatched? Then there is nothing to book and nothing to record. */
+trackingNumber, 
+/** Set by `bookShipment`; a booked parcel must not be re-booked. */
+platformBooked, onDispatched, }: {
+    orderId: string;
+    trackingNumber?: string;
+    platformBooked?: boolean;
+    onDispatched: () => void;
+}): React.JSX.Element;

package/dist/features/seller/components/DispatchForm.js

@@ -0,0 +1,190 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/*
+ * WHY: Bug 0e — a seller could not express "book this through us". The write
+ *      shape said `method: z.literal("custom")`, so there was no option to
+ *      offer; `platformBookedShipment`, which `order-math.ts` gates shipping
+ *      reimbursement on, had ZERO writers.
+ *
+ *      The schema now carries a discriminated union and the server does the
+ *      booking. This is the control that reaches it.
+ *
+ * WHAT: One dispatch panel with two branches — post it yourself, or book a
+ *       pickup on the platform's carrier account.
+ *
+ * EXPORTS: DispatchForm
+ *
+ * @tag domain:seller,orders,shipping
+ * @tag layer:component
+ * @tag pattern:form
+ * @tag access:client
+ * @tag consumers:SellerOrderDetailPanel
+ * @tag sideEffects:network
+ */
+import React, { useState } from "react";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { apiClient, ApiClientError } from "../../../http/index.js";
+import { useApiMutation } from "../../../client/api/useApiMutation.js";
+import { useQuery } from "@tanstack/react-query";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+import { Button } from "../../../ui/components/Button.js";
+import { Div } from "../../../ui/components/Div.js";
+import { Row } from "../../../ui/components/Layout.js";
+import { Stack } from "../../../ui/components/Layout.js";
+import { Text } from "../../../ui/components/Typography.js";
+import { Form } from "../../../ui/components/Form.js";
+import { FieldInput } from "../../../ui/forms/FieldInput.js";
+import { FieldSelect } from "../../../ui/forms/FieldSelect.js";
+import { shipOrderSchema } from "../schemas/order-forms.js";
+import { applyZodIssues, rootLevelMessages } from "../../../ui/forms/apply-zod-issues.js";
+/**
+ * Box presets, in centimetres and kilograms.
+ *
+ * 🛑 A PRESET rather than four number inputs, and that is the whole UX
+ * argument: a seller packing a Beyblade does not know the parcel's
+ * dimensions, and a carrier rejects a wrong one with an opaque error at
+ * pickup time rather than at booking time. Four free fields produce four
+ * chances to guess. "Custom" exists for the genuinely odd parcel.
+ */
+const BOX_PRESETS = [
+    { id: "small", label: "Small — single top (0.3 kg)", weight: 0.3, length: 20, width: 15, height: 10 },
+    { id: "medium", label: "Medium — a few items (1 kg)", weight: 1, length: 30, width: 25, height: 15 },
+    { id: "large", label: "Large — stadium or bundle (3 kg)", weight: 3, length: 45, width: 35, height: 25 },
+];
+export function DispatchForm({ orderId, 
+/** Already dispatched? Then there is nothing to book and nothing to record. */
+trackingNumber, 
+/** Set by `bookShipment`; a booked parcel must not be re-booked. */
+platformBooked, onDispatched, }) {
+    const [method, setMethod] = useState("custom");
+    const [carrier, setCarrier] = useState("");
+    const [tracking, setTracking] = useState("");
+    const [trackingUrl, setTrackingUrl] = useState("");
+    const [pickupId, setPickupId] = useState("");
+    const [boxId, setBoxId] = useState(BOX_PRESETS[1].id);
+    const [error, setError] = useState(null);
+    /*
+     * 🛑 Fetched ONLY when the platform branch is open. The custom branch is
+     * the common case and needs no address at all, so loading this on mount
+     * would be a request on every order panel open for a field most sellers
+     * never reach (Rule #6).
+     */
+    /*
+     * 🛑 `toUserMessage(code)` on failure, never the server's own `error`
+     * string — an unmapped code would print server internals into the panel,
+     * which is literally how a Node `MODULE_NOT_FOUND` with a require stack
+     * reached a buyer-facing modal (Root Cause #86). `ApiClientError` carries
+     * the stable code, so the mapping survives the move off raw `fetch`.
+     */
+    /*
+     * 🛑 A REF, because `setFieldError` comes from `<Form>`'s render-prop and
+     * therefore does not exist in component scope where the mutation is
+     * declared. The mutation needs a STABLE sink — passing the render-prop
+     * helper directly is impossible, and re-creating the mutation per render to
+     * close over it would reset its pending state mid-request.
+     *
+     * It is assigned inside the render-prop below, so by the time any submit
+     * can fire it is populated. The `?.` is not defensive decoration: the first
+     * render completes before `<Form>` calls its child.
+     */
+    const fieldErrorSink = React.useRef(null);
+    const shipMutation = useApiMutation({
+        /*
+         * 🛑 Passed so the server's own per-field `issues` land on the fields
+         * they name. The route parses the same `shipOrderSchema` this form does,
+         * so a rejection it produces that the client parse did not is real news
+         * — a carrier the courier does not recognise, a pickup address that
+         * stopped being serviceable — and collapsing that into one generic
+         * sentence hides which input to fix.
+         */
+        setFieldError: (field, message) => fieldErrorSink.current?.(field, message),
+        mutationFn: (payload) => apiClient.post(SELLER_ENDPOINTS.ORDER_SHIP(orderId), payload),
+        onSuccess: () => onDispatched(),
+        onError: (err) => {
+            void normalizeError(err);
+            setError(toUserMessage(err instanceof ApiClientError ? err.code : undefined));
+        },
+    });
+    /*
+     * 🛑 `enabled` is what keeps this request off the common path. The custom
+     * branch needs no address at all, so loading pickups on mount would fire a
+     * request on every order panel a seller opens for a field most of them
+     * never reach (Rule #6). `useQuery` also dedupes and caches it, which the
+     * hand-rolled effect could not — it refetched on every branch toggle.
+     */
+    const pickupsQuery = useQuery({
+        queryKey: ["store", "addresses", "pickup"],
+        enabled: method === "platform",
+        queryFn: () => apiClient.get(SELLER_ENDPOINTS.STORE_ADDRESSES),
+    });
+    const pickups = Array.isArray(pickupsQuery.data?.items)
+        ? pickupsQuery.data.items
+        : [];
+    /*
+     * 🛑 A FAILED request and an empty list must not render the same. An empty
+     * dropdown reads as "this store has no pickup addresses" — a fact about the
+     * store — when it may be a network error, and the two need different
+     * actions from the seller.
+     */
+    const pickupsFailed = pickupsQuery.isError;
+    React.useEffect(() => {
+        if (pickups.length === 1 && !pickupId)
+            setPickupId(pickups[0].id);
+    }, [pickups, pickupId]);
+    if (trackingNumber) {
+        return (_jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatched" }), _jsx(Text, { size: "xs", color: "muted", children: platformBooked
+                        ? `Booked through LetItRip · ${trackingNumber}`
+                        : `Posted by you · ${trackingNumber}` })] }));
+    }
+    const submit = async (
+    /* The `<Form>` render-prop's own signature — `applyZodIssues` clears a
+     * field by passing `null`, so a `string`-only sink is not assignable. */
+    setFieldError, clearErrors) => {
+        clearErrors();
+        setError(null);
+        const box = BOX_PRESETS.find((b) => b.id === boxId) ?? BOX_PRESETS[1];
+        const payload = method === "platform"
+            ? {
+                method: "platform",
+                pickupAddressId: pickupId,
+                dimensions: {
+                    weight: box.weight,
+                    length: box.length,
+                    width: box.width,
+                    height: box.height,
+                },
+            }
+            : {
+                method: "custom",
+                shippingCarrier: carrier.trim(),
+                trackingNumber: tracking.trim(),
+                trackingUrl: trackingUrl.trim(),
+            };
+        /*
+         * Parsed against the SAME schema the route and the action use, so the
+         * branch's required fields are stated once. `applyZodIssues` can only
+         * attach path-bearing issues, so root-level refinements are surfaced
+         * separately or a refused save shows nothing at all.
+         */
+        const parsed = shipOrderSchema.safeParse(payload);
+        if (!parsed.success) {
+            applyZodIssues(parsed.error.issues, setFieldError);
+            const root = rootLevelMessages(parsed.error.issues);
+            if (root.length > 0)
+                setError(root.join(" "));
+            return;
+        }
+        shipMutation.mutate(parsed.data);
+    };
+    return (_jsxs(Stack, { gap: "3", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatch" }), _jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: method === "custom" ? "primary" : "outline", "aria-pressed": method === "custom", onClick: () => setMethod("custom"), children: "I posted it" }), _jsx(Button, { size: "sm", variant: method === "platform" ? "primary" : "outline", "aria-pressed": method === "platform", onClick: () => setMethod("platform"), children: "Book through LetItRip" })] }), _jsx(Form, { onSubmit: (e) => e.preventDefault(), children: ({ setFieldError, clearErrors }) => {
+                    fieldErrorSink.current = setFieldError;
+                    return (_jsxs(Stack, { gap: "3", children: [method === "custom" ? (_jsxs(_Fragment, { children: [_jsx(FieldInput, { name: "shippingCarrier", label: "Carrier", required: true, value: carrier, onChange: setCarrier }), _jsx(FieldInput, { name: "trackingNumber", label: "Tracking number", required: true, value: tracking, onChange: setTracking }), _jsx(FieldInput, { name: "trackingUrl", label: "Tracking URL", required: true, type: "url", value: trackingUrl, onChange: setTrackingUrl })] })) : (_jsxs(_Fragment, { children: [pickupsFailed ? (_jsx(Text, { size: "xs", color: "error", role: "alert", children: "Could not load your pickup addresses. Reopen this panel to try again." })) : pickups.length === 0 ? (_jsx(Text, { size: "xs", color: "muted", children: "Loading your pickup addresses\u2026" })) : (_jsx(FieldSelect, { name: "pickupAddressId", label: "Collect from", required: true, value: pickupId, onChange: setPickupId, options: pickups.map((p) => ({
+                                            value: p.id,
+                                            label: [p.label, p.city, p.postalCode].filter(Boolean).join(" · ") || p.id,
+                                        })) })), _jsx(FieldSelect, { name: "box", label: "Parcel size", required: true, value: boxId, onChange: setBoxId, options: BOX_PRESETS.map((b) => ({ value: b.id, label: b.label })) }), _jsx(Text, { size: "xs", color: "muted", children: "The courier is booked on the platform's account and the tracking id comes back from them \u2014 you do not enter one." })] })), error && (_jsx(Div, { textSize: "xs", className: "border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", role: "alert", children: error })), _jsx(Button, { type: "submit", action: method === "platform"
+                                    ? ACTIONS.STORE["dispatch-platform"]
+                                    : ACTIONS.STORE["dispatch-custom"], isLoading: shipMutation.isPending, onClick: () => void submit(setFieldError, clearErrors) })] }));
+                } })] }));
+}