@mohasinac/appkit 4.62.1 → 4.63.1

package/dist/features/pricing/components/AdminPricingView.js

@@ -0,0 +1,157 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { Badge, Button, Heading, Row, Stack, Text } from "../../../ui/index.js";
+import { Modal } from "../../../ui/components/Modal.js";
+import { useToast } from "../../../ui/components/Toast.js";
+import { Form } from "../../../ui/components/Form.js";
+import { FieldInput } from "../../../ui/forms/FieldInput.js";
+import { FieldTextarea } from "../../../ui/forms/FieldTextarea.js";
+import { FormErrorSummary } from "../../../ui/forms/FormErrorSummary.js";
+import { apiClient } from "../../../http/ApiClient.js";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { RATE_TIER_ORDER, } from "../../../_internal/shared/features/pricing/rate-registry.js";
+const TIER_LABEL = {
+    statutory: "Statutory",
+    policy: "Policy ceiling",
+    operational: "Operational",
+};
+const TIER_BLURB = {
+    statutory: "Set by law, not by us. Sourced per HSN code in Tax codes — they deliberately do not appear below.",
+    policy: "A ceiling the owner decides. Administrator only, and a reason is required.",
+    operational: "Tuned, audited and reversible by back-office staff.",
+};
+const TIER_TONE = {
+    statutory: "warning",
+    policy: "info",
+    operational: "default",
+};
+/**
+ * 🛑 Format by the descriptor's UNIT, never by guessing from the value.
+ *
+ * `2` is 2% as a commission, ₹2 as a floor and 2 days as a hold, and the three
+ * are side by side in one table. A bare number would make the COD ceiling and
+ * the COD percentage read as the same kind of thing.
+ */
+function formatRate(value, unit) {
+    if (value === null)
+        return "—";
+    switch (unit) {
+        case "percent":
+            return `${value}%`;
+        case "rupees":
+            return `₹${value.toLocaleString("en-IN")}`;
+        case "days":
+            return value === 1 ? "1 day" : `${value} days`;
+        case "minutes":
+            return value === 1 ? "1 minute" : `${value} minutes`;
+        case "count":
+            return String(value);
+    }
+}
+function formatWhen(iso) {
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? "—" : d.toLocaleDateString("en-IN", { dateStyle: "medium" });
+}
+export function AdminPricingView({ endpoint }) {
+    const { showToast } = useToast();
+    const [rates, setRates] = useState(null);
+    const [loadError, setLoadError] = useState(null);
+    const [editing, setEditing] = useState(null);
+    const [draftValue, setDraftValue] = useState("");
+    const [draftReason, setDraftReason] = useState("");
+    const [saving, setSaving] = useState(false);
+    const load = useCallback(async () => {
+        setLoadError(null);
+        try {
+            const payload = await apiClient.get(endpoint);
+            setRates(payload?.rates ?? []);
+        }
+        catch (err) {
+            /*
+             * Surfaced, never swallowed into an empty table. An empty rate list and
+             * a failed read look identical, and the first reads as "we charge
+             * nothing" (Root Cause #59/#72 — undefined must never render as zero).
+             *
+             * 🛑 A FIXED string, never `normalized.message`. The server's own text
+             * is how a Node `MODULE_NOT_FOUND` with a require stack ended up inside
+             * "Place your bid" (Root Cause #86) — and `mapToHttpError` scrubs 5xx
+             * messages in production anyway, so the raw value is either useless or
+             * dangerous. `normalizeError` still runs: it is what keeps `unknown`
+             * out of the catch body.
+             */
+            void normalizeError(err);
+            setLoadError("Could not load the rate table. Try again.");
+            setRates([]);
+        }
+    }, [endpoint]);
+    useEffect(() => {
+        void load();
+    }, [load]);
+    const byTier = useMemo(() => {
+        const groups = new Map();
+        for (const tier of RATE_TIER_ORDER)
+            groups.set(tier, []);
+        for (const rate of rates ?? [])
+            groups.get(rate.tier)?.push(rate);
+        return groups;
+    }, [rates]);
+    const openEditor = useCallback((rate) => {
+        setEditing(rate);
+        setDraftValue(rate.value === null ? "" : String(rate.value));
+        setDraftReason("");
+    }, []);
+    const submit = useCallback(async (setFieldError) => {
+        if (!editing)
+            return;
+        const parsed = Number(draftValue);
+        if (!Number.isFinite(parsed)) {
+            setFieldError("newValue", "Enter a number.");
+            return;
+        }
+        setSaving(true);
+        try {
+            await apiClient.post(endpoint, {
+                path: editing.path,
+                newValue: parsed,
+                ...(draftReason.trim() ? { reason: draftReason.trim() } : {}),
+            });
+            showToast(`${editing.label} updated.`, "success");
+            setEditing(null);
+            await load();
+        }
+        catch (err) {
+            void normalizeError(err);
+            /*
+             * 🛑 `toUserMessage`, never the server's own message — and no
+             * `?? normalized.message` fallback either. That fallback IS the bug:
+             * `toUserMessage` already terminates at `errors.codes.UNKNOWN`, so
+             * adding a raw-text branch for the unmapped case reintroduces exactly
+             * what Root Cause #86 describes — a require stack rendered inside a
+             * modal. The first draft of this file had it.
+             */
+            const code = err?.code;
+            setFieldError("newValue", toUserMessage(code ?? "UNKNOWN"));
+        }
+        finally {
+            setSaving(false);
+        }
+    }, [draftReason, draftValue, editing, endpoint, load, showToast]);
+    return (_jsxs(Stack, { gap: "loose", children: [_jsxs(Stack, { gap: "dense", children: [_jsx(Heading, { level: 1, children: "Pricing" }), _jsx(Text, { color: "muted", children: "Every rate the platform charges, what kind of number it is, and when it last moved. Changes take effect from the moment they are saved and never restate past orders." })] }), loadError ? (_jsxs(Stack, { surface: "danger-surface", padding: "md", rounded: "lg", gap: "dense", children: [_jsx(Text, { weight: "semibold", children: "The rate table could not be loaded." }), _jsx(Text, { size: "sm", children: loadError }), _jsx(Row, { children: _jsx(Button, { variant: "secondary", onClick: () => void load(), children: "Try again" }) })] })) : null, RATE_TIER_ORDER.map((tier) => {
+                const rows = byTier.get(tier) ?? [];
+                /*
+                 * The statutory section renders with NO rows and that is the point —
+                 * it tells a reader the tier exists and where it is set. Hiding an
+                 * empty section would make statutory rates look like something this
+                 * platform does not have.
+                 */
+                if (rows.length === 0 && tier !== "statutory")
+                    return null;
+                return (_jsxs(Stack, { gap: "comfortable", children: [_jsxs(Stack, { gap: "dense", children: [_jsxs(Row, { gap: "dense", align: "center", children: [_jsx(Heading, { level: 2, children: TIER_LABEL[tier] }), _jsx(Badge, { variant: TIER_TONE[tier], children: rows.length || "set elsewhere" })] }), _jsx(Text, { size: "sm", color: "muted", children: TIER_BLURB[tier] })] }), rows.map((rate) => (_jsxs(Row, { surface: "card", padding: "card", rounded: "lg", gap: "comfortable", align: "start", justify: "between", children: [_jsxs(Stack, { gap: "dense", children: [_jsxs(Row, { gap: "dense", align: "center", children: [_jsx(Text, { weight: "semibold", children: rate.label }), rate.sellerOnly ? _jsx(Badge, { variant: "default", children: "Seller-facing" }) : null] }), _jsx(Text, { size: "sm", color: "muted", children: rate.description }), rate.lastChange ? (_jsxs(Text, { size: "xs", color: "muted", children: [formatRate(rate.lastChange.previousValue, rate.unit), " \u2192", " ", formatRate(rate.lastChange.newValue, rate.unit), " on", " ", formatWhen(rate.lastChange.effectiveFrom), rate.lastChange.changedByName ? ` by ${rate.lastChange.changedByName}` : "", rate.lastChange.reason ? ` — ${rate.lastChange.reason}` : ""] })) : (_jsx(Text, { size: "xs", color: "muted", children: "No recorded change \u2014 this is the value it was configured with." }))] }), _jsxs(Row, { gap: "comfortable", align: "center", children: [_jsx(Text, { weight: "bold", numeric: true, children: formatRate(rate.value, rate.unit) }), _jsx(Button, { variant: "secondary", size: "sm", disabled: !rate.editable, onClick: () => openEditor(rate), children: "Change" })] })] }, rate.path)))] }, tier));
+            }), _jsx(Modal, { isOpen: editing !== null, onClose: () => setEditing(null), title: editing ? `Change ${editing.label}` : "Change rate", children: editing ? (_jsx(Form, { onSubmit: (e) => e.preventDefault(), children: ({ setFieldError, clearErrors }) => (_jsxs(Stack, { gap: "comfortable", children: [_jsx(FormErrorSummary, {}), _jsx(Text, { size: "sm", color: "muted", children: editing.description }), _jsx(FieldInput, { name: "newValue", label: `New value (${editing.unit})`, required: true, value: draftValue, onChange: setDraftValue }), _jsx(FieldTextarea, { name: "reason", label: editing.tier === "policy" ? "Reason (required)" : "Reason (optional)", value: draftReason, onChange: setDraftReason }), _jsx(Text, { size: "xs", color: "muted", children: "This takes effect now. Orders, invoices and payouts already recorded keep the rate they were charged at \u2014 nothing is restated." }), _jsxs(Row, { gap: "dense", justify: "end", children: [_jsx(Button, { variant: "ghost", onClick: () => setEditing(null), children: "Cancel" }), _jsx(Button, { action: ACTIONS.ADMIN["update-pricing"], isLoading: saving, onClick: () => {
+                                            clearErrors();
+                                            void submit(setFieldError);
+                                        } })] })] })) })) : null })] }));
+}

package/dist/features/products/schemas/firestore.d.ts

@@ -603,6 +603,31 @@ export interface ProductDocument extends BaseDocument {
     howToUse?: string[];
     allowOffers?: boolean;
     minOfferPercent?: number;
+    /**
+     * The seller permits a COORDINATED purchase on this listing.
+     *
+     * ## 🛑 A coordinated purchase is a SPECIALISED OFFER, not a listing type
+     *
+     * Owner, 2026-10-22: *"it is not a variant, it is similar to an offer, which
+     * the seller enables on the listing, then the customer can coordinate on it,
+     * it is a specialized offer."*
+     *
+     * That framing REMOVES work rather than adding it, and the removals are the
+     * part worth knowing — otherwise somebody rebuilds them:
+     *
+     * | Looks like it needs | Actually |
+     * |---|---|
+     * | a 7th `OrderSourceContext` variant | **nothing** — it is `offer-accepted`, and the provenance card already renders that branch |
+     * | an `orderType` tab | **nothing** — the Offer-wins tab already covers it |
+     * | a commit/settlement path | the offer lifecycle, with its chain fields, `checkoutDeadline` and lapse sweep |
+     * | a new money term | **none** — `unitPriceFor` already honours `lockedPrice`, so tax, payout base, refund ceiling and the invoice all follow |
+     *
+     * So this flag is deliberately shaped exactly like `allowOffers` above: same
+     * optional boolean, same seller control, same projection list. A listing
+     * with `allowOffers: false` and this `true` is coherent — the seller takes
+     * no solo offers but will consider a group — and nothing needs to forbid it.
+     */
+    allowCoordination?: boolean;
     customFields?: CustomField[];
     customSections?: CustomSection[];
     sublistingCategoryId?: string;
@@ -837,7 +862,7 @@ export declare const ProductStatusValues: {
 export declare const PRODUCT_COLLECTION: "products";
 export declare const PRODUCT_INDEXED_FIELDS: readonly ["storeId", "status", "category", "categoryIds", "featured", "listingType", "isPromoted", "isOnSale", "isSold", "searchTxt", "createdAt", "barcodeId", "physicalLocation.zone"];
 export declare const DEFAULT_PRODUCT_DATA: Partial<ProductDocument>;
-export declare const PRODUCT_PUBLIC_FIELDS: readonly ["allowOffers", "minOfferPercent", "id", "title", "description", "category", "categoryIds", "categoryIdNames", "subcategory", "brand", "price", "originalPrice", "currency", "stockQuantity", "availableQuantity", "images", "status", "storeName", "featured", "tags", "specifications", "features", "shippingInfo", "returnPolicy", "finalSale", "isLot", "lotSize", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "views7d", "views30d", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "listingType", "auctionEndDate", "startingBid", "currentBid", "bidCount", "reservePrice", "buyNowPrice", "minBidIncrement", "autoExtendable", "auctionExtensionMinutes", "auctionShippingPaidBy", "bidsHaveStarted", "grading", "card", "classified", "digitalCode", "liveItem", "catalogProductId", "preOrderDeliveryDate", "preOrderDepositPercent", "preOrderDepositAmount", "preOrderMaxQuantity", "preOrderCurrentCount", "preOrderProductionStatus", "preOrderCancellable", "condition", "insurance", "insuranceCost", "shippingPaidBy", "isPromoted", "isOnSale", "isSold", "madeToOrder", "sourceStickerSheetId", "sourceStickerPartOrdinal", "slug", "seoTitle", "seoDescription", "seoKeywords", "viewCount", "customFields", "customSections", "sublistingCategoryId", "groupId", "isGroupParent", "groupParentSlug", "groupChildSlugs", "groupTitle", "groupMinMembers", "groupMaxMembers", "groupMaxUnitsPerMember", "groupRequiredMemberIds", "groupDiscountPercent", "createdAt"];
+export declare const PRODUCT_PUBLIC_FIELDS: readonly ["allowOffers", "minOfferPercent", "allowCoordination", "id", "title", "description", "category", "categoryIds", "categoryIdNames", "subcategory", "brand", "price", "originalPrice", "currency", "stockQuantity", "availableQuantity", "images", "status", "storeName", "featured", "tags", "specifications", "features", "shippingInfo", "returnPolicy", "finalSale", "isLot", "lotSize", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "views7d", "views30d", "unitLabel", "partGlossaryId", "colourway", "mouldVariant", "assembledFrom", "listingType", "auctionEndDate", "startingBid", "currentBid", "bidCount", "reservePrice", "buyNowPrice", "minBidIncrement", "autoExtendable", "auctionExtensionMinutes", "auctionShippingPaidBy", "bidsHaveStarted", "grading", "card", "classified", "digitalCode", "liveItem", "catalogProductId", "preOrderDeliveryDate", "preOrderDepositPercent", "preOrderDepositAmount", "preOrderMaxQuantity", "preOrderCurrentCount", "preOrderProductionStatus", "preOrderCancellable", "condition", "insurance", "insuranceCost", "shippingPaidBy", "isPromoted", "isOnSale", "isSold", "madeToOrder", "sourceStickerSheetId", "sourceStickerPartOrdinal", "slug", "seoTitle", "seoDescription", "seoKeywords", "viewCount", "customFields", "customSections", "sublistingCategoryId", "groupId", "isGroupParent", "groupParentSlug", "groupChildSlugs", "groupTitle", "groupMinMembers", "groupMaxMembers", "groupMaxUnitsPerMember", "groupRequiredMemberIds", "groupDiscountPercent", "createdAt"];
 export declare const PRODUCT_UPDATABLE_FIELDS: readonly ["title", "description", "category", "categoryIds", "subcategory", "brand", "price", "originalPrice", "stockQuantity", "images", "status", "tags", "specifications", "features", "shippingInfo", "returnPolicy", "finalSale", "isLot", "lotSize", "physicalLocation", "sku", "pickupAddressId", "condition", "insurance", "shippingPaidBy", "autoExtendable", "auctionExtensionMinutes", "auctionShippingPaidBy", "reservePrice", "buyNowPrice", "minBidIncrement", "bidsHaveStarted", "grading", "card", "classified", "digitalCode", "liveItem", "catalogProductId", "listingType", "preOrderDeliveryDate", "preOrderDepositPercent", "preOrderDepositAmount", "preOrderMaxQuantity", "preOrderProductionStatus", "preOrderCancellable", "isOnSale", "isSold", "madeToOrder", "sourceStickerSheetId", "sourceStickerPartOrdinal", "allowShipBeforeEmiComplete", "gstRate", "hsnCode", "authenticity", "printMeta", "seoTitle", "seoDescription", "seoKeywords", "customFields", "customSections", "sublistingCategoryId", "groupId", "isGroupParent", "groupParentSlug", "groupChildSlugs", "groupTitle", "groupMinMembers", "groupMaxMembers", "groupMaxUnitsPerMember", "groupRequiredMemberIds", "groupDiscountPercent", "barcodeId"];
 export type ProductCreateInput = Omit<ProductDocument, "id" | "createdAt" | "updatedAt" | "availableQuantity" | "bidCount" | "currentBid" | "auctionOriginalEndDate">;
 export type ProductUpdateInput = Partial<Pick<ProductDocument, (typeof PRODUCT_UPDATABLE_FIELDS)[number]>>;

package/dist/features/products/schemas/firestore.js

@@ -142,6 +142,8 @@ export const PRODUCT_PUBLIC_FIELDS = [
     // the moment something starts projecting through it.
     "allowOffers",
     "minOfferPercent",
+    /* Same reasoning as `allowOffers`: the card renders a pill from it. */
+    "allowCoordination",
     "id",
     "title",
     "description",

package/dist/features/products/schemas/index.d.ts

@@ -449,10 +449,10 @@ export declare const productItemSchema: z.ZodObject<{
         wonByOrderId?: string | undefined;
     }[] | undefined;
     prizeGithubFileUrl?: string | undefined;
+    attributes?: Record<string, string> | undefined;
     inStock?: boolean | undefined;
     sellerAvatar?: string | undefined;
     stockCount?: number | undefined;
-    attributes?: Record<string, string> | undefined;
 }, {
     status: "published" | "draft" | "in_review" | "archived";
     id: string;
@@ -589,10 +589,10 @@ export declare const productItemSchema: z.ZodObject<{
         wonByOrderId?: string | undefined;
     }[] | undefined;
     prizeGithubFileUrl?: string | undefined;
+    attributes?: Record<string, string> | undefined;
     inStock?: boolean | undefined;
     sellerAvatar?: string | undefined;
     stockCount?: number | undefined;
-    attributes?: Record<string, string> | undefined;
 }>;
 /** Base Zod schema for list-query parameters. */
 export declare const productListParamsSchema: z.ZodObject<{

package/dist/features/reviews/repository/reviews.repository.d.ts

@@ -52,6 +52,20 @@ declare class ReviewRepository extends BaseRepository<ReviewDocument> {
     findApprovedByStore(storeId: string, limit?: number): Promise<ReviewDocument[]>;
     findByUser(userId: string): Promise<ReviewDocument[]>;
     findApprovedByUser(userId: string): Promise<ReviewDocument[]>;
+    /**
+     * How many reviews this account has WRITTEN.
+     *
+     * Deliberately every status and both reviewer roles — it counts the same set
+     * `GET /api/user/reviews` lists by default (`findByUser`), so the number in
+     * the sidebar and the rows on the page it links to agree by construction. A
+     * count that quietly excluded pending reviews would read as the author's
+     * work having vanished.
+     *
+     * An aggregation, not `findByUser(...).length`: that sibling downloads every
+     * review the account has ever written to learn how many there are, and the
+     * caller here runs on every session profile fetch.
+     */
+    countByUser(userId: string): Promise<number>;
     findPending(): Promise<ReviewDocument[]>;
     findByStatus(status: ReviewStatus): Promise<ReviewDocument[]>;
     /**

package/dist/features/reviews/repository/reviews.repository.js

@@ -175,6 +175,22 @@ class ReviewRepository extends BaseRepository {
             .get();
         return snapshot.docs.map((doc) => this.mapDoc(doc));
     }
+    /**
+     * How many reviews this account has WRITTEN.
+     *
+     * Deliberately every status and both reviewer roles — it counts the same set
+     * `GET /api/user/reviews` lists by default (`findByUser`), so the number in
+     * the sidebar and the rows on the page it links to agree by construction. A
+     * count that quietly excluded pending reviews would read as the author's
+     * work having vanished.
+     *
+     * An aggregation, not `findByUser(...).length`: that sibling downloads every
+     * review the account has ever written to learn how many there are, and the
+     * caller here runs on every session profile fetch.
+     */
+    async countByUser(userId) {
+        return getFirestoreCount(this.getCollection().where(REVIEW_FIELDS.USER_ID, "==", userId));
+    }
     async findPending() {
         return this.findBy(REVIEW_FIELDS.STATUS, "pending");
     }

package/dist/features/scams/repository/scammer.repository.js

@@ -142,7 +142,8 @@ class ScammerRepository extends BaseRepository {
                 reason: ctx?.reason,
                 note: ctx?.note,
                 // A scammer profile is built entirely from identifying details, and
-                // `encryptPiiFields` never descends into arrays.
+                // `encryptPiiFields` covers a field only where it is NAMED. It CAN
+                // reach into an array via `array[].key`, but a bare key does not.
                 piiFields: SCAMMER_HISTORY_PII_FIELDS,
             });
             const data = prepareForFirestore(withEntry ?? { ...input, updatedAt: new Date() });

package/dist/features/scams/schemas/firestore.d.ts

@@ -403,6 +403,7 @@ export declare const SCAMMER_TRACKED_FIELDS: readonly ["status", "verifiedBy", "
 /**
  * PII on this document, for `withHistory`'s scrub. A scammer profile is built
  * ENTIRELY out of identifying details, so this list is long on purpose —
- * `encryptPiiFields` never descends into arrays, and history is an array.
+ * `encryptPiiFields` covers only NAMED paths, and nobody is going to declare
+ * `statusHistory[].changes.<key>` for every field that might land there.
  */
 export declare const SCAMMER_HISTORY_PII_FIELDS: readonly ["name", "displayName", "email", "phone", "phoneNumber", "upiId", "bankAccount", "accountNumber", "reporterEmail", "reporterName"];

package/dist/features/scams/schemas/firestore.js

@@ -248,7 +248,8 @@ export const SCAMMER_TRACKED_FIELDS = [
 /**
  * PII on this document, for `withHistory`'s scrub. A scammer profile is built
  * ENTIRELY out of identifying details, so this list is long on purpose —
- * `encryptPiiFields` never descends into arrays, and history is an array.
+ * `encryptPiiFields` covers only NAMED paths, and nobody is going to declare
+ * `statusHistory[].changes.<key>` for every field that might land there.
  */
 export const SCAMMER_HISTORY_PII_FIELDS = [
     "name",

package/dist/features/seller/actions/offer-actions.js

@@ -7,6 +7,9 @@
 import { serverLogger } from "../../../monitoring/index.js";
 import { offerRepository } from "../repository/offer.repository.js";
 import { productRepository } from "../../products/repository/products.repository.js";
+import { categoriesRepository } from "../../categories/repository/categories.repository.js";
+import { resolveParcel } from "../../../_internal/shared/features/shipping/parcel.js";
+import { checkDestinations, assertAllServiceable, } from "../../../_internal/server/features/shipping/book-split.js";
 import { ProductStatusValues } from "../../products/schemas/index.js";
 import { sendNotification } from "../../admin/actions/notification-actions.js";
 import { userRepository } from "../../auth/repository/user.repository.js";
@@ -184,6 +187,59 @@ export async function respondToOffer(userId, input) {
         throw new ValidationError(ERROR_MESSAGES.OFFER.EXPIRED);
     let updated;
     if (action === "accept") {
+        /*
+         * ── S5a: a coordinated offer must be SHIPPABLE before it is binding ──
+         *
+         * Accepting locks a price and starts the buyer's checkout deadline, so it
+         * is the last moment at which "the courier cannot reach one of these
+         * addresses" costs nobody anything. After it, the coordinator has paid
+         * and the only remedies left are a refund and an apology.
+         *
+         * 🛑 Deliberately NOT at booking time, which is the obvious place and the
+         * wrong one: by then the money is taken, and a four-destination order
+         * that fails on the fourth has three parcels the carrier already accepted
+         * and no rollback. `assertAllServiceable` still guards the booking path —
+         * this is the check that keeps it from ever being reached in that state.
+         *
+         * 🛑 Costs NOTHING on an ordinary offer. `coordination` is absent on
+         * every non-coordinated one, so this whole block is skipped — a check
+         * that charges every seller for a feature most never use is how Rule #6's
+         * round-trip budget gets spent by accident.
+         *
+         * 🛑 The weight comes from `resolveParcel`, NOT from a literal. That
+         * module's whole argument is that an item weight systematically
+         * under-estimates a packed box (a bey is ~30 g loose and ~300 g boxed),
+         * and a hard-coded `1` here would be a fourth, worse tier beside the
+         * three it defines. The shipment tier is deliberately absent — nothing is
+         * packed yet at accept time, which is exactly the case tier two and three
+         * exist for.
+         *
+         * 🛑 **No resolvable weight SKIPS the check** rather than guessing one.
+         * The carrier is being asked "can you reach this pincode with a parcel of
+         * this size", so an invented weight asks a question about a parcel that
+         * does not exist and may refuse a destination that is perfectly
+         * reachable. Not checking is honest; the booking path still has
+         * `assertAllServiceable`, and a listing with no weight at any tier has a
+         * data problem this is not the place to report.
+         */
+        const members = offer.coordination?.members ?? [];
+        if (members.length > 0) {
+            const offerProduct = await productRepository.findById(offer.productId);
+            /*
+             * 🛑 `categorySlugs[0]` is the LEAF, and `findById` is the right lookup
+             * for it. Products carry the full ancestor chain `[leaf, …, root]` and
+             * categories are pure slugs (`id === slug`), so this is one get rather
+             * than the `where("slug","==")` query `findBySlugAndType` would run —
+             * and the leaf is the tier whose packed default is actually about this
+             * kind of item. A root's default would be the average of the catalogue.
+             */
+            const leafSlug = offerProduct?.categorySlugs?.[0];
+            const leaf = leafSlug ? await categoriesRepository.findById(leafSlug) : null;
+            const parcel = resolveParcel(null, offerProduct, leaf?.productDefaults ?? null);
+            if (parcel) {
+                assertAllServiceable(await checkDestinations(members, parcel.weightG / 1000));
+            }
+        }
         updated = await offerRepository.accept(offerId, offer.offerAmount, sellerNote, new Date(Date.now() + OFFER_CHECKOUT_WINDOW_MS));
     }
     else if (action === "decline") {

package/dist/features/seller/actions/seller-actions.d.ts

@@ -181,7 +181,7 @@ export declare function listSellerPayouts(userId: string, params?: {
     page?: number;
     pageSize?: number;
 }): Promise<{
-    items: import("../../payments").PayoutDocument[];
+    items: import("../../payments").StorePayoutDocument[];
     total: number;
     page: number;
     pageSize: number;

package/dist/features/seller/actions/seller-actions.js

@@ -299,6 +299,8 @@ export async function requestPayout(userId, userName, userEmail, input) {
     if (earnings.netAmount <= 0 || earnings.eligibleOrders.length === 0)
         throw new ValidationError("No eligible earnings available for payout.");
     const payout = await payoutRepository.createPayout({
+        /* A seller requesting their own earnings — a liability settlement. */
+        payeeType: "store",
         storeId: userId,
         sellerName: userName,
         sellerEmail: userEmail,
@@ -391,6 +393,8 @@ export async function bulkSellerOrder(userId, userRole, userDisplayName, userEma
     // The store-funded points, both ends — see the preview path above.
     ordersPointsBorneByStore(eligible));
     const payoutDoc = await payoutRepository.createPayout({
+        /* A seller requesting their own earnings — a liability settlement. */
+        payeeType: "store",
         storeId: userId,
         sellerName: userDisplayName,
         sellerEmail: userEmail,

package/dist/features/seller/components/DispatchForm.d.ts

@@ -0,0 +1,11 @@
+import React from "react";
+export declare function DispatchForm({ orderId, 
+/** Already dispatched? Then there is nothing to book and nothing to record. */
+trackingNumber, 
+/** Set by `bookShipment`; a booked parcel must not be re-booked. */
+platformBooked, onDispatched, }: {
+    orderId: string;
+    trackingNumber?: string;
+    platformBooked?: boolean;
+    onDispatched: () => void;
+}): React.JSX.Element;

package/dist/features/seller/components/DispatchForm.js

@@ -0,0 +1,190 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/*
+ * WHY: Bug 0e — a seller could not express "book this through us". The write
+ *      shape said `method: z.literal("custom")`, so there was no option to
+ *      offer; `platformBookedShipment`, which `order-math.ts` gates shipping
+ *      reimbursement on, had ZERO writers.
+ *
+ *      The schema now carries a discriminated union and the server does the
+ *      booking. This is the control that reaches it.
+ *
+ * WHAT: One dispatch panel with two branches — post it yourself, or book a
+ *       pickup on the platform's carrier account.
+ *
+ * EXPORTS: DispatchForm
+ *
+ * @tag domain:seller,orders,shipping
+ * @tag layer:component
+ * @tag pattern:form
+ * @tag access:client
+ * @tag consumers:SellerOrderDetailPanel
+ * @tag sideEffects:network
+ */
+import React, { useState } from "react";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { SELLER_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { apiClient, ApiClientError } from "../../../http/index.js";
+import { useApiMutation } from "../../../client/api/useApiMutation.js";
+import { useQuery } from "@tanstack/react-query";
+import { normalizeError } from "../../../errors/normalize.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
+import { Button } from "../../../ui/components/Button.js";
+import { Div } from "../../../ui/components/Div.js";
+import { Row } from "../../../ui/components/Layout.js";
+import { Stack } from "../../../ui/components/Layout.js";
+import { Text } from "../../../ui/components/Typography.js";
+import { Form } from "../../../ui/components/Form.js";
+import { FieldInput } from "../../../ui/forms/FieldInput.js";
+import { FieldSelect } from "../../../ui/forms/FieldSelect.js";
+import { shipOrderSchema } from "../schemas/order-forms.js";
+import { applyZodIssues, rootLevelMessages } from "../../../ui/forms/apply-zod-issues.js";
+/**
+ * Box presets, in centimetres and kilograms.
+ *
+ * 🛑 A PRESET rather than four number inputs, and that is the whole UX
+ * argument: a seller packing a Beyblade does not know the parcel's
+ * dimensions, and a carrier rejects a wrong one with an opaque error at
+ * pickup time rather than at booking time. Four free fields produce four
+ * chances to guess. "Custom" exists for the genuinely odd parcel.
+ */
+const BOX_PRESETS = [
+    { id: "small", label: "Small — single top (0.3 kg)", weight: 0.3, length: 20, width: 15, height: 10 },
+    { id: "medium", label: "Medium — a few items (1 kg)", weight: 1, length: 30, width: 25, height: 15 },
+    { id: "large", label: "Large — stadium or bundle (3 kg)", weight: 3, length: 45, width: 35, height: 25 },
+];
+export function DispatchForm({ orderId, 
+/** Already dispatched? Then there is nothing to book and nothing to record. */
+trackingNumber, 
+/** Set by `bookShipment`; a booked parcel must not be re-booked. */
+platformBooked, onDispatched, }) {
+    const [method, setMethod] = useState("custom");
+    const [carrier, setCarrier] = useState("");
+    const [tracking, setTracking] = useState("");
+    const [trackingUrl, setTrackingUrl] = useState("");
+    const [pickupId, setPickupId] = useState("");
+    const [boxId, setBoxId] = useState(BOX_PRESETS[1].id);
+    const [error, setError] = useState(null);
+    /*
+     * 🛑 Fetched ONLY when the platform branch is open. The custom branch is
+     * the common case and needs no address at all, so loading this on mount
+     * would be a request on every order panel open for a field most sellers
+     * never reach (Rule #6).
+     */
+    /*
+     * 🛑 `toUserMessage(code)` on failure, never the server's own `error`
+     * string — an unmapped code would print server internals into the panel,
+     * which is literally how a Node `MODULE_NOT_FOUND` with a require stack
+     * reached a buyer-facing modal (Root Cause #86). `ApiClientError` carries
+     * the stable code, so the mapping survives the move off raw `fetch`.
+     */
+    /*
+     * 🛑 A REF, because `setFieldError` comes from `<Form>`'s render-prop and
+     * therefore does not exist in component scope where the mutation is
+     * declared. The mutation needs a STABLE sink — passing the render-prop
+     * helper directly is impossible, and re-creating the mutation per render to
+     * close over it would reset its pending state mid-request.
+     *
+     * It is assigned inside the render-prop below, so by the time any submit
+     * can fire it is populated. The `?.` is not defensive decoration: the first
+     * render completes before `<Form>` calls its child.
+     */
+    const fieldErrorSink = React.useRef(null);
+    const shipMutation = useApiMutation({
+        /*
+         * 🛑 Passed so the server's own per-field `issues` land on the fields
+         * they name. The route parses the same `shipOrderSchema` this form does,
+         * so a rejection it produces that the client parse did not is real news
+         * — a carrier the courier does not recognise, a pickup address that
+         * stopped being serviceable — and collapsing that into one generic
+         * sentence hides which input to fix.
+         */
+        setFieldError: (field, message) => fieldErrorSink.current?.(field, message),
+        mutationFn: (payload) => apiClient.post(SELLER_ENDPOINTS.ORDER_SHIP(orderId), payload),
+        onSuccess: () => onDispatched(),
+        onError: (err) => {
+            void normalizeError(err);
+            setError(toUserMessage(err instanceof ApiClientError ? err.code : undefined));
+        },
+    });
+    /*
+     * 🛑 `enabled` is what keeps this request off the common path. The custom
+     * branch needs no address at all, so loading pickups on mount would fire a
+     * request on every order panel a seller opens for a field most of them
+     * never reach (Rule #6). `useQuery` also dedupes and caches it, which the
+     * hand-rolled effect could not — it refetched on every branch toggle.
+     */
+    const pickupsQuery = useQuery({
+        queryKey: ["store", "addresses", "pickup"],
+        enabled: method === "platform",
+        queryFn: () => apiClient.get(SELLER_ENDPOINTS.STORE_ADDRESSES),
+    });
+    const pickups = Array.isArray(pickupsQuery.data?.items)
+        ? pickupsQuery.data.items
+        : [];
+    /*
+     * 🛑 A FAILED request and an empty list must not render the same. An empty
+     * dropdown reads as "this store has no pickup addresses" — a fact about the
+     * store — when it may be a network error, and the two need different
+     * actions from the seller.
+     */
+    const pickupsFailed = pickupsQuery.isError;
+    React.useEffect(() => {
+        if (pickups.length === 1 && !pickupId)
+            setPickupId(pickups[0].id);
+    }, [pickups, pickupId]);
+    if (trackingNumber) {
+        return (_jsxs(Stack, { gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatched" }), _jsx(Text, { size: "xs", color: "muted", children: platformBooked
+                        ? `Booked through LetItRip · ${trackingNumber}`
+                        : `Posted by you · ${trackingNumber}` })] }));
+    }
+    const submit = async (
+    /* The `<Form>` render-prop's own signature — `applyZodIssues` clears a
+     * field by passing `null`, so a `string`-only sink is not assignable. */
+    setFieldError, clearErrors) => {
+        clearErrors();
+        setError(null);
+        const box = BOX_PRESETS.find((b) => b.id === boxId) ?? BOX_PRESETS[1];
+        const payload = method === "platform"
+            ? {
+                method: "platform",
+                pickupAddressId: pickupId,
+                dimensions: {
+                    weight: box.weight,
+                    length: box.length,
+                    width: box.width,
+                    height: box.height,
+                },
+            }
+            : {
+                method: "custom",
+                shippingCarrier: carrier.trim(),
+                trackingNumber: tracking.trim(),
+                trackingUrl: trackingUrl.trim(),
+            };
+        /*
+         * Parsed against the SAME schema the route and the action use, so the
+         * branch's required fields are stated once. `applyZodIssues` can only
+         * attach path-bearing issues, so root-level refinements are surfaced
+         * separately or a refused save shows nothing at all.
+         */
+        const parsed = shipOrderSchema.safeParse(payload);
+        if (!parsed.success) {
+            applyZodIssues(parsed.error.issues, setFieldError);
+            const root = rootLevelMessages(parsed.error.issues);
+            if (root.length > 0)
+                setError(root.join(" "));
+            return;
+        }
+        shipMutation.mutate(parsed.data);
+    };
+    return (_jsxs(Stack, { gap: "3", children: [_jsx(Text, { size: "sm", weight: "medium", children: "Dispatch" }), _jsxs(Row, { gap: "sm", children: [_jsx(Button, { size: "sm", variant: method === "custom" ? "primary" : "outline", "aria-pressed": method === "custom", onClick: () => setMethod("custom"), children: "I posted it" }), _jsx(Button, { size: "sm", variant: method === "platform" ? "primary" : "outline", "aria-pressed": method === "platform", onClick: () => setMethod("platform"), children: "Book through LetItRip" })] }), _jsx(Form, { onSubmit: (e) => e.preventDefault(), children: ({ setFieldError, clearErrors }) => {
+                    fieldErrorSink.current = setFieldError;
+                    return (_jsxs(Stack, { gap: "3", children: [method === "custom" ? (_jsxs(_Fragment, { children: [_jsx(FieldInput, { name: "shippingCarrier", label: "Carrier", required: true, value: carrier, onChange: setCarrier }), _jsx(FieldInput, { name: "trackingNumber", label: "Tracking number", required: true, value: tracking, onChange: setTracking }), _jsx(FieldInput, { name: "trackingUrl", label: "Tracking URL", required: true, type: "url", value: trackingUrl, onChange: setTrackingUrl })] })) : (_jsxs(_Fragment, { children: [pickupsFailed ? (_jsx(Text, { size: "xs", color: "error", role: "alert", children: "Could not load your pickup addresses. Reopen this panel to try again." })) : pickups.length === 0 ? (_jsx(Text, { size: "xs", color: "muted", children: "Loading your pickup addresses\u2026" })) : (_jsx(FieldSelect, { name: "pickupAddressId", label: "Collect from", required: true, value: pickupId, onChange: setPickupId, options: pickups.map((p) => ({
+                                            value: p.id,
+                                            label: [p.label, p.city, p.postalCode].filter(Boolean).join(" · ") || p.id,
+                                        })) })), _jsx(FieldSelect, { name: "box", label: "Parcel size", required: true, value: boxId, onChange: setBoxId, options: BOX_PRESETS.map((b) => ({ value: b.id, label: b.label })) }), _jsx(Text, { size: "xs", color: "muted", children: "The courier is booked on the platform's account and the tracking id comes back from them \u2014 you do not enter one." })] })), error && (_jsx(Div, { textSize: "xs", className: "border border-error/20", color: "error", surface: "danger-surface", padding: "inlineSm", rounded: "lg", role: "alert", children: error })), _jsx(Button, { type: "submit", action: method === "platform"
+                                    ? ACTIONS.STORE["dispatch-platform"]
+                                    : ACTIONS.STORE["dispatch-custom"], isLoading: shipMutation.isPending, onClick: () => void submit(setFieldError, clearErrors) })] }));
+                } })] }));
+}