v2.3.6: Split order payments, rich text descriptions & sidebar

In Mercur v2.3.6, split orders finally get payments of their own, so refunds and cancellations work through the stock Medusa routes. Product descriptions get a rich text editor, and the sidebar collapses to an icon rail. Medusa is bumped to 2.21.2, and the workspace moves to zod 4, plus a long list of new extension points and fixes.

What's New

Split order payments

When a cart's payment is captured, it is now split: every seller order gets its own payment collection with a captured payment for its share, pointing at the same charge. Refunding and canceling a split order work through the stock Medusa routes and workflows, capped at the order's share. Canceling before capture leaves the authorization for the cart's other orders. Orders captured before this release are not split retroactively.

Rich text descriptions

Product descriptions can mix formatted text and images. RichTextEditor and the RichText renderer ship in @mercurjs/dashboard-shared and are used across product create, edit, and detail in both panels. Descriptions are sanitized on write and on the storefront; existing plain-text descriptions keep working, and there is no migration.

Sidebar

The sidebar collapses to an icon rail with tooltips instead of disappearing, and useSidebar / useCollapsedSidebar let a page drive it. _navigation.ts gains a groups API, so you can declare groups and assign items to them in both the main and settings sidebars.

Registration and invitations

A plugin can add fields to the vendor register and invite forms and act on them on the server: createSellerAccountWorkflow gets a validate hook, and acceptMemberInviteWorkflow gets validate and memberInviteAccepted, with additional_data accepted on invite acceptance. Plugin vendor routes exporting AUTHENTICATE = false now skip vendor auth.

Admin & Vendor Panel

• Added tabs on the admin store detail page via stores.detail.tabs.*, with a label on defineWidgetConfig.
• Added topbar.before and topbar.after widget zones in both panels.
• Added a per-card locations.list.item widget zone on the locations list.
• Made custom-fields list filters able to replace or remove built-in filters.

Core

• Added paymentCaptured and paymentRefunded hooks on the capture and refund workflows, plus returnReceived and commissionLinesUpserted.
• Added a payoutCreated hook on createPayoutWorkflow.
• Added a fulfillmentDelivered hook on markOrderFulfillmentAsDeliveredWorkflow.
• Made offer inventory items inherit the variant's shipping and customs attributes.

What's Changed

Admin & Vendor Panel

• Removed the built-in notifications bell (breaking) – Notifications is no longer exported from @mercurjs/admin or @mercurjs/vendor, and the Cmd/Ctrl+N shortcut is gone. Register your own widget on the new topbar.after zone instead.
• Moved both panels to bearer-token sign-in (breaking) – the cookie session is dropped, so everyone is logged out once after upgrading. Custom page clients should send getAuthHeaders() from @mercurjs/admin / @mercurjs/vendor instead of credentials: 'include'.
• Routed admin product delete through the change pipeline (breaking) – DELETE /admin/products/:id now returns an error when the product has a pending product change.

Core

• Bumped Medusa to 2.21.2 and moved the workspace to zod 4 (breaking) – every @medusajs/* pin moves to 2.21.2, and in your own validators, single-argument z.record(value) must become z.record(key, value).
• Made deleting a product soft-delete its seller offers.
• Gave PayoutAccount.data a default – run migrations before upgrading.

What's Fixed

Admin & Vendor Panel

• Kept admin and vendor logins independent when both panels share one API host.
• Restored dropped placeholders and Trans tags in admin and vendor locales.
• Stopped showing a published, allowlisted product to its creator once it is restricted to other stores.
• Forwarded order list filters to the API.
• Used the outline star for the vendor reviews sidebar item.
• Kept order group seller_count and total independent of list filters, and made sorting by display_id work.

Core

• Returned the existing order group when a cart is completed again, instead of placing duplicate orders.
• Preserved other sellers' prices when one seller updates an offer price.
• Restored Medusa middleware on product routes Mercur does not override, fixing 500s on variant batch, options, and product-variant routes.
• Applied Medusa patches on import, so blocks imported in medusa-config.ts see the patched workflows.
• Returned a proper 400 instead of a 500 when a payout account is created without data.

Storefront

• Detected Medusa's Stripe card provider.
• Self-hosted the Funnel Display font.

Other

• Scaffolded new projects from the template of the pinned release tag, so create-mercur-app no longer produces projects that fail to boot.
• Resolved the local CLI directly for codegen, removing the slow npx on every boot in monorepos.
• Resolved the repository root dynamically in the dev scripts.
• Bumped sanitize-html to 2.17.7.