Shipped status includes or links to tracking information

Marking an order 'shipped' with no tracking information means the customer cannot follow their package, support staff cannot look up the shipment when a delivery dispute arises, and the shipment email (if it exists) contains nothing actionable. A 'your order has shipped' notification with no tracking number is effectively a lie by omission — it closes the customer's window of action while giving them nothing to work with. This gap also cascades into the OWASP A01 risk surface if the tracking update endpoint accepts shipping confirmation without validating that the actor has captured required fulfillment data.

Add trackingNumber, trackingCarrier, and shippedAt fields to the order schema in prisma/schema.prisma, then require them in lib/orders/shipping.ts when marking an order shipped.

// lib/orders/shipping.ts
export async function markOrderShipped(
  orderId: string,
  trackingNumber: string,
  carrier: string,
  actorId: string
) {
  if (!trackingNumber) throw new Error('Tracking number required to mark order shipped')
  await transitionOrder(orderId, 'shipped', actorId)
  await db.orders.update({
    where: { id: orderId },
    data: { trackingNumber, trackingCarrier: carrier, shippedAt: new Date() },
  })
}