v2.13.2

> ⚠️ Warning: v2.13.2 introduces a regression that causes req.queryConfig to include entity: undefined, which can break routes that spread req.queryConfig into query.graph() (e.g., query.graph({entity: "some_entity", ...req.queryConfig })), resulting in a Service with alias "undefined" was not found error. Please upgrade to v2.13.3, which fixes this issue. See #14815 for details.

## Highlights

 ### Fix credit line computation on order cancellation and refunding

 When cancelling an order with multiple payments (some cancelled or pending), the credit line amount was being incorrectly computed based on all payment amounts, regardless of status. This could result in large negative pending differences. The computation now only considers captured amounts, ensuring accurate credit line totals. 

[#14670](https://github.com/medusajs/medusa/pull/14670)

When refunding an order's payments, the credit line amount was being incorrectly computed based on all payments, regardless of the outcome of their corresponding refund. The computation now only takes into account successful refunds.

[#14781](https://github.com/medusajs/medusa/pull/14781)

### Filter orders by total amount (view configuration FF enabled) and define max file upload size

Provided the View Configurations feature flag is enabled, the order table now allows filtering orders by their `total` amount by mapping the value to the underlying `order_summary` field.

[#14146](https://github.com/medusajs/medusa/pull/14146)

We previously introduced a 1MB limit on file uploads. To attend to different use cases, this release introduces the ability to configure this limit through the `medusa-config` file. This can be configured as shown below:

```js
// medusa-config.ts
  import { defineConfig } from "@medusajs/framework/utils"

  export default defineConfig({
    admin: {
      // Set max upload size to 10MB
      maxUploadFileSize: 10 * 1024 * 1024,

      // Or disable the limit entirely
      // maxUploadFileSize: Infinity,
    },
    // ... other config
  })

```

[#14720](https://github.com/medusajs/medusa/pull/14720)

 ### Show all plugin settings routes in the dashboard

Up until now, only the first plugin's settings routes have appeared in the admin dashboard. If multiple plugins register settings pages, only one would show. All plugin settings route children are now correctly merged and displayed. 

[#14461](https://github.com/medusajs/medusa/pull/14461)

### Fix create-medusa-app storefront installation when using pnpm

When installing Medusa with `pnpm` and enabling the Next.js Starter Storefront, an error was raised mentioning `pnpm` is not available. This release includes dynamic resolution of the package manager set in `package.json` to match the one being used by the user.

[#14681](https://github.com/medusajs/medusa/pull/14681)

### Test files no longer break `medusa develop`

  Previously, having test files (`.spec.ts`, `.test.ts`) inside `src/workflows`, `src/subscribers`, or `src/jobs` directories would cause `jest is not defined` errors when running `medusa develop`. The resource auto-loader now excludes test files and `__tests__/` directories, so they can be placed alongside the source code without issues.

[#14292](https://github.com/medusajs/medusa/pull/14292)

### Stripe Payment provider improvements

Previously, if a refund was performed in the Stripe dashboard directly, when trying to create the corresponding Medusa refund, the Stripe provider would throw an error. We know handle this scenario gracefully.

[14746](https://github.com/medusajs/medusa/pull/14746)

Deleting a customer in Stripe is a permanent action, and if the `createPaymentSessionWorkflow` failed, this action was performed as part of a compensation function, trapping the customer in a loop when trying to create the account holder in subsequent attempts. We now avoid compensating the `createPaymentAccountHolderStep` inside the workflow.

[14112](https://github.com/medusajs/medusa/pull/14112)

### Translations no longer crash on primitive arrays

If an entity had a JSONB column containing an array of primitive values (e.g., `["foo", "bar"]`), the translation utility would crash with a `TypeError` when attempting to treat strings as translatable entities. This is now handled gracefully. 

[#14565](https://github.com/medusajs/medusa/pull/14565)

  ## Features
  * feat(medusa): filter query fields (RBAC field filtering) by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14588
  * feat: add forbidden error 403 by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14665
  * feat: Allow passing `session_token` to S3 credentials when using an access key by @sradevski in https://github.com/medusajs/medusa/pull/14778
  * feat: Add dynamodb packages as dependencies by @sradevski in https://github.com/medusajs/medusa/pull/14721
  * feat: Introduce filtering by orders total on the Admin UI by @adevinwild in https://github.com/medusajs/medusa/pull/14146
  * feat(admin): add configurable maximum file upload size by @arjusmoon860 in #14720 
  * feat(medusa,types): add metadata field to AdminUpsertStockLocationAddress and validators by @bouazzaayyoub in #14557

  ## Bugs
  * fix(framework): exclude test files from resource auto-loading by @florianhv in https://github.com/medusajs/medusa/pull/14292
  * fix(orchestration): `continueOnPermanentFailure` when timeout by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14719
  * fix(core-flows): only consider captures amounts for credit line amount computation by @NicolasGorga in https://github.com/medusajs/medusa/pull/14670
  * fix(dashboard): settingsRoutes list error (all plugin settings routes now visible) by @chuxi in https://github.com/medusajs/medusa/pull/14461
  * fix(dashboard): pass product ID explicitly to edit option form by @marlinjai in https://github.com/medusajs/medusa/pull/14631
  * fix(dashboard): Added the `__BASE__` prefix to the datatable row on click by @adevinwild in https://github.com/medusajs/medusa/pull/14118
  * fix(dashboard): fix toggleable number cell set value by @NicolasGorga in https://github.com/medusajs/medusa/pull/14619
  * fix(dashboard): fix view configurations order filters by @NicolasGorga in https://github.com/medusajs/medusa/pull/14620
  * fix(admin): Fix table cell stacking in RTL languages by @iharshyadav in https://github.com/medusajs/medusa/pull/14568
  * fix(utils): Translations crash on primitive arrays by @Mohammed-AlSharafi in https://github.com/medusajs/medusa/pull/14565
  * fix(types): fix item type for shipping option price calculation by @shahednasser in https://github.com/medusajs/medusa/pull/14725
  * fix(types): make images of product variant optional by @shahednasser in https://github.com/medusajs/medusa/pull/14689
  * fix(js-sdk): fix return type of `listAddresses` by @shahednasser in https://github.com/medusajs/medusa/pull/14712
  * fix(icons): default `viewBox` by @fPolic in https://github.com/medusajs/medusa/pull/14700
  * fix(create-medusa-app): fix installations with storefronts for pnpm by @shahednasser in https://github.com/medusajs/medusa/pull/14681
  * fix(cart): add `completed_at` to `FilterableCartProps` interface by @webgodo in https://github.com/medusajs/medusa/pull/14658
  * fix(medusa-cli): verbose log level event name typo by @nenadfilipovic-builtt in https://github.com/medusajs/medusa/pull/14669
  * fix: correct `provirder` typo to `provider` across files by @Anexus5919 in https://github.com/medusajs/medusa/pull/14614
  * fix: add `marked_shipped_by` to create order shipment by @Fadyy22 in https://github.com/medusajs/medusa/pull/14660
  * fix(core-flows): credit only successful refunds upon order cancellation by @NicolasGorga in https://github.com/medusajs/medusa/pull/14781
  * fix(ui): stale filters when selecting a view by @adevinwild in https://github.com/medusajs/medusa/pull/14160
  * fix(dashboard): Initialize complete price structure for variants in price list edit by @docloulou in https://github.com/medusajs/medusa/pull/14273
  * fix(core-flows,order): avoid returning recreated credit lines due to version bumping as new credit lines in
  createOrderCreditLinesWorkflow by @NicolasGorga in https://github.com/medusajs/medusa/pull/14715
  * fix(payment-stripe): handle refunds happening outside of Medusa by @NicolasGorga in https://github.com/medusajs/medusa/pull/14746
  * fix(payment-stripe): Prevent the Stripe payment provider to delete Stripe customers by @adevinwild in https://github.com/medusajs/medusa/pull/14112
  * fix(dashboard): handle undefined payment_collections in order table calculations by @bqst in https://github.com/medusajs/medusa/pull/14523
  * fix(admin): use is_tax_inclusive as column id in store add-currencies form by @webgodo in #14677 
  * fix(medusa): resolve user_id from user linked to secret key on draft order edit with api-key auth by @NicolasGorga in #14053

  ## Documentation
  * docs: added support in Cloud for Next.js 16 by @shahednasser in https://github.com/medusajs/medusa/pull/14729
  * docs: add missing section on custom validation for admin custom auth by @shahednasser in https://github.com/medusajs/medusa/pull/14682
  * docs: add constraint for loops in workflows by @shahednasser in https://github.com/medusajs/medusa/pull/14639
  * docs: add tanstack start solid to supported storefront framework in Cloud by @shahednasser in https://github.com/medusajs/medusa/pull/14649
  * docs: fix Dockerfile COPY command for `.yarn/releases` directory by @alexander-wolf in https://github.com/medusajs/medusa/pull/14710
  * docs: update API reference for the loyalty plugin by @shahednasser in https://github.com/medusajs/medusa/pull/14750
  * docs: added information about Claude Code storefront plugin by @shahednasser in https://github.com/medusajs/medusa/pull/14685
  * docs: add ai assistant to homepage by @shahednasser in https://github.com/medusajs/medusa/pull/14624
  * docs: Bloom documentation by @shahednasser in multiple PRs
  * docs: fix typo in Notification Module documentation by @mouaz-allahham in https://github.com/medusajs/medusa/pull/14666
  * docs: fix so table data updates on pagination by @420coupe in https://github.com/medusajs/medusa/pull/14644
  * docs: fix command for creating Medusa app with pnpm in configuration guide by @shahednasser in https://github.com/medusajs/medusa/pull/14684
  * docs: disable explain this page if ai feature is disabled by @shahednasser in https://github.com/medusajs/medusa/pull/14783
  * docs: disable AI assistant in bloom docs by @shahednasser in https://github.com/medusajs/medusa/pull/14779
  * docs: new additions to bloom docs by @shahednasser in https://github.com/medusajs/medusa/pull/14777
  * docs: fix navbar active state by @shahednasser in https://github.com/medusajs/medusa/pull/14760
  * docs: expand links section on homepage by @shahednasser in https://github.com/medusajs/medusa/pull/14751
  * docs: send md event instantly by @shahednasser in https://github.com/medusajs/medusa/pull/14744
  * docs: only track event for markdown headers by @shahednasser in https://github.com/medusajs/medusa/pull/14743
  * docs: track markdown page visits by @shahednasser in https://github.com/medusajs/medusa/pull/14741
  * docs: fix AI assistant callout not sticky by @shahednasser in https://github.com/medusajs/medusa/pull/14734
  * docs: content fixes to homepage by @shahednasser in https://github.com/medusajs/medusa/pull/14696
  * docs: fixes to homepage by @shahednasser in https://github.com/medusajs/medusa/pull/14694
  * docs: fix to ai assistant chat by @shahednasser in https://github.com/medusajs/medusa/pull/14691
  * docs: fix command for installing skills by @shahednasser in https://github.com/medusajs/medusa/pull/14687
  * docs: fix updating schemas in generated OAS by @shahednasser in https://github.com/medusajs/medusa/pull/14662
  * docs: fix list products api route response by @shahednasser in https://github.com/medusajs/medusa/pull/14657
  * docs: fix scrolling inside subcategories in the sidebar by @shahednasser in https://github.com/medusajs/medusa/pull/14656
  * docs: fix description of ID param in order-edit routes by @shahednasser in https://github.com/medusajs/medusa/pull/14647
  * docs: update next.js and react by @shahednasser in https://github.com/medusajs/medusa/pull/14646
  * docs: updated instructions for claude-code plugins by @shahednasser in https://github.com/medusajs/medusa/pull/14638
  * Update page.mdx, change run --rm to exec for npm by @adapole in #14786 
  * docs: fix import for use toast by @svintsoff78 in #14427

  ## Chores
  * chore(medusa): super admin user and rbac invite link by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14642
  * chore(medusa): admin list policies by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14663
  * chore(medusa): add role users endpoint by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14676
  * chore: assign user roles by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14695
  * chore: missing rbac role policy by @carlos-r-l-rodrigues in https://github.com/medusajs/medusa/pull/14701
  * chore: create announcement in Cloud for new releases by @shahednasser in https://github.com/medusajs/medusa/pull/14699
  * chore: expand fetch order tests by @fPolic in https://github.com/medusajs/medusa/pull/14651
  * chore: fix TSDocs for JS SDK order edit methods by @shahednasser in https://github.com/medusajs/medusa/pull/14648
  * chore(docs): Generated + Updated UI Reference (automated) by @github-actions[bot] in https://github.com/medusajs/medusa/pull/14634
  * chore(docs): Update version in documentation (automated) by @github-actions[bot] in https://github.com/medusajs/medusa/pull/14633
  * chore(core-flows): Add original item totals for cart refresh by @pepijn-vanvlaanderen in
  https://github.com/medusajs/medusa/pull/14539
  * chore(core-flows): include stock_location in validation context for flat rate shipping options by @NicolasGorga in
  https://github.com/medusajs/medusa/pull/14749
  * chore(dashboard): Add i18n support for promotion template titles and descriptions by @mokivan in #14780
  * chore(core-flows): expose product weight as fallback for shipping calculations by @picardplaisimond in #14773

  **Full Changelog**: https://github.com/medusajs/medusa/compare/v2.13.1...v2.13.2