@mohasinac/appkit 4.42.1 → 4.42.2

package/dist/features/tester/seed-data/tester-checklist-seed-data.js

@@ -18,6 +18,7 @@
  * @tag sideEffects:none
  */
 import { assignDefaultPhases } from "../utils/phases";
+import { happyPathPages } from "./_happy-path";
 import { moneyFlowsPages } from "./_money-flows";
 import { AUTHORED_CASES } from "./authored";
 const ADMIN_TESTING_GROUP_LABEL = "Admin (Testing)";
@@ -100,6 +101,18 @@ function group(groupKey, groupLabel, pages, opts) {
  * group and is not globally unique across groups.
  */
 const rawTesterChecklistItems = [
+    /*
+     * 🛑 FIRST ON PURPOSE. The happy path is the core commerce flow — browse a
+     * category, reach a brand and a store, open a standard product, buy it, pay
+     * for it, watch the seller fulfil and the admin verify.
+     *
+     * It leads the catalogue because a run that is interrupted, rate-limited or
+     * abandoned half way should have covered "can anyone buy anything" before it
+     * covered SEO metadata. Ordering is enforced by HAPPY_PATH_FIRST in
+     * ../utils/phases, not by this position — array position alone would be
+     * silently undone by the round-robin phase assignment below.
+     */
+    ...group("happy-path", "Happy Path (core flows)", happyPathPages),
     ...group("account-auth", "Account & Auth", [
         {
             pageKey: "signup-login",
@@ -313,9 +326,21 @@ const rawTesterChecklistItems = [
                     href: "/products",
                 },
                 {
+                    /*
+                     * 🛑 The KEY still says "toggle" and must stay that way: it is the
+                     * document id (`${testerId}__${checklistItemId}`), so renaming it
+                     * orphans every recorded response. The LABEL and DESCRIPTION are not
+                     * part of the id and were still describing the removed control.
+                     *
+                     * The showSold/showEnded/showClosed pills were replaced by the
+                     * three-tab availability bar, and the three fixtures named here
+                     * ("Test Collectible — Sold Out" et al) went with the tester-sandbox
+                     * catalogue. A tester reads the label FIRST, so a stale one sends them
+                     * hunting before the steps ever get a chance to correct them.
+                     */
                     key: "show-sold-toggle-reveals-items",
-                    label: "The \"Show sold\" / \"Show ended\" / \"Show closed\" toggle on Products/Auctions/Prize Draws listing pages is off by default (hiding sold-out/ended/closed items) and reveals them when switched on",
-                    description: "Verify against the seeded fixtures: \"Test Collectible — Sold Out\" (standard, hidden until \"Show sold\" is on), \"Test Auction — Already Won\" (hidden until \"Show ended\" is on), \"Test Prize Draw — Already Closed\" (hidden until \"Show closed\" is on). All three should be genuinely absent by default, not just from an unrelated broken query.",
+                    label: "The availability tab bar hides sold-out, ended and closed items by default, and the middle tab reveals them",
+                    description: "Verify against the seeded fixtures: \"Beyblade X BX-34 Dran Buster (Sold Out)\" on /products, \"Beyblade Burst B-128 Spriggan Requiem (Ended — Bought Out)\" on /auctions, and \"Metal Fight Mystery Draw — Ended (Revealed)\" on /prize-draws. Each must be genuinely absent on 'Available' and present on the middle tab — not merely missing because an unrelated query broke. Only the middle label varies by type: 'Sold & Ended' on /products, 'Ended' on both /auctions and /prize-draws.",
                     href: "/products",
                 },
                 {
@@ -621,12 +646,23 @@ const rawTesterChecklistItems = [
                     label: "Prize-draw collage tiles stack the image ABOVE the title/value caption at full card width — the image is never squashed beside the text at half width",
                     href: "/prize-draws/prizedraw-beyblade-mystery-box",
                 },
-                {
-                    key: "concern-card-icon-above-label",
-                    label: "Category concern cards show their icon ABOVE the label, not beside it",
-                    description: "This is a deliberate visual change: the card always asked for a vertical layout but had been rendering side-by-side. Confirm the stacked layout looks right rather than assuming the old side-by-side was intended.",
-                    href: "/categories",
-                },
+                /*
+                 * REMOVED 2026-09-28 — concern-card-icon-above-label.
+                 *
+                 * `ConcernCard` is rendered only by `ConcernGrid`, and `ConcernGrid` has
+                 * NO consumer anywhere in src/ or appkit/src/. Both are exported from
+                 * appkit's public index, which is why they look alive from a grep of the
+                 * barrel. Nothing puts them on a page.
+                 *
+                 * The case's href said /categories and its overlay startPage said /, and
+                 * the component renders on neither — so it could only ever be answered
+                 * "could not test", forever, on every run. A permanently un-passable case
+                 * is worse than no case: it occupies a batch slot, and a `null` verdict
+                 * reads as a coverage gap rather than as a catalogue defect.
+                 *
+                 * The dead component itself is recorded in docs/TEST-RUN-3-OUTOFSCOPE.md.
+                 * Restore this case if ConcernGrid is ever mounted.
+                 */
                 {
                     key: "media-picker-existing-grid",
                     label: "In any media field, \"Choose existing\" shows each file as a square thumbnail with the filename underneath — not thumbnail-beside-filename with a shrunken image",
@@ -2625,6 +2661,12 @@ const rawTesterChecklistItems = [
                     description: "Proves the category actually persisted to Firestore rather than only existing in the form's local state.",
                     href: "/store/products/new",
                 },
+                {
+                    key: "deep-category-chain-derived",
+                    label: "A product filed against a DEEP category is written with its full ancestor chain, so it appears on every ancestor's page and not just the leaf's",
+                    description: "BEFORE: the chain was maintained by hand in the seed, so a form-created listing got a one-element array and was invisible on every ancestor page. AFTER (2026-09-14): ProductRepository.deriveTaxonomy() derives it on create and update. Latent by construction — every seeded product already has the chain, so only a listing created through the UI can catch a regression.",
+                    href: "/store/products/new",
+                },
                 {
                     key: "seller-category-inline-create-duplicate-rejected",
                     label: "Creating a category with a name that already exists shows a readable \"already exists\" error, not a generic failure or a silent no-op",
@@ -3004,6 +3046,18 @@ const rawTesterChecklistItems = [
             pageLabel: "Event detail — participate, leaderboard, winner, spin results",
             href: "/events",
             cases: [
+                {
+                    key: "spin-results-subroute",
+                    label: "The public 'Last 10 Spin Results' feed masks every participant's display name",
+                    description: "Re-scoped 2026-09-29. This case used to assert the route listed 'this account's own spins'; it does not and never did — getSpinResultsCached takes only the event id and returns the ten most recent spins across ALL users, so a buyer who had never spun was shown three strangers' prizes with no empty state. The page now has two sections and this case covers the PUBLIC one. What it checks is the masking: a public event page was publishing real winners' full display names beside the prize each won, which is the same shape as the bidder-name leak on public bid history (Root Cause #50). The account-scoped claim moved to my-spins-scoped-to-viewer.",
+                    href: "/events/event-daily-beyblade-pull-wheel/spin-results",
+                },
+                {
+                    key: "my-spins-scoped-to-viewer",
+                    label: "'Your Spins' shows only the signed-in caller's own spins, with an empty state about YOU",
+                    description: "The account-scoped half of the old spin-results case, now a section of its own above the public feed. The bug it guards against is specific: when the viewer-scoped block did not exist, someone who had never spun saw the public feed's rows and had no way to tell that none of them were theirs. So the empty state must name the viewer ('You have not spun on this event yet.') rather than the event ('No spins yet'), which would be false while the feed below is full. Signed out it must prompt to sign in, never show anyone else's results.",
+                    href: "/events/event-daily-beyblade-pull-wheel/spin-results",
+                },
                 { key: "detail-tabs-match-event-type", label: "An event's tabs match its TYPE — a poll shows no spin results, a sale shows no leaderboard" },
                 { key: "participate-records-an-entry", label: "Participating records an entry that is still there after a reload" },
                 { key: "participate-twice-is-refused", label: "Participating a second time is refused with a reason, not silently duplicated" },
@@ -3058,6 +3112,12 @@ const rawTesterChecklistItems = [
             pageLabel: "Blog",
             href: "/blog",
             cases: [
+                {
+                    key: "blog-search-filters-the-list",
+                    label: "The blog listing's search box actually filters, and the filtered result survives a reload",
+                    description: "BEFORE: BlogIndexPageView never read q while /api/blog did, and listPublished had no search parameter at all -- so the SSR first paint was the unfiltered list, and a public listing hook sets staleTime Infinity once given SSR data, freezing it. AFTER: listPublished takes the same push-down. Needs a nonsense control: a real term returns plausible cards either way.",
+                    href: "/blog",
+                },
                 { key: "read-post", label: "Reading a blog post renders correctly (images, formatting)" },
                 { key: "blog-listing", label: "Blog listing page shows all published posts" },
                 { key: "blog-cover-image-display", label: "A blog post's cover image displays on both its listing card and its detail page" },
@@ -3218,6 +3278,12 @@ const rawTesterChecklistItems = [
             pageLabel: "FAQ & Help",
             href: "/faqs",
             cases: [
+                {
+                    key: "faq-search-filters-and-survives-reload",
+                    label: "The FAQ search box filters the questions, the term round-trips through ?q=, and a nonsense term shows an empty state rather than the full list",
+                    description: "No case covered /faqs search, on the one page whose documented near-miss WAS search appearing empty -- it renders zero questions at 2.5s and 62 at 6s, so a count taken early is confidently wrong. Needs both a nonsense control and an explicit wait.",
+                    href: "/faqs",
+                },
                 { key: "faq-bottom-borders", label: "FAQ question rows show a clear bottom-border divider on the homepage and the FAQs page", href: "/faqs" },
                 { key: "faq-mobile-count", label: "Homepage FAQ section shows a good number of questions on mobile, not just 1-2", href: "/" },
                 { key: "tabs-mobile-dropdown", label: "Tabs on category/brand/product/event detail pages collapse into a colored dropdown on mobile once there are more than 5 tabs" },
@@ -3507,11 +3573,11 @@ const rawTesterChecklistItems = [
                     roles: ["guest", "admin"],
                     startPage: "/contact",
                     steps: [
-                        "Open the public contact page as a signed-out visitor.",
+                        "Open the public contact page as a signed-out visitor. 🛑 THIS CASE LISTS roles [guest, admin] AND THE HARNESS RESOLVES THAT TO ADMIN — admin wins whenever present — so the batch opens SIGNED IN. Copy tester/.tester-runs/session-guest.json (an empty storage state, by design) over session.json and CLOSE THE BROWSER first; the MCP reads it only at context creation.",
                         "Fill in name, email, subject and a message of at least 10 characters.",
                         "Submit the form.",
-                        "Log in as admin and open /admin/contact.",
-                        "Check the inbox of whatever address used to receive support mail.",
+                        "Swap to tester/.tester-runs/session-admin.json, closing the browser again, then open /admin/contact.",
+                        "Prove NO email was sent: node tester/scripts/check-inbox.mjs --since <a timestamp captured before the submission> --subject \"contact\" --expect-none. There is no support address to open — EMAIL_SUPPORT was never configured in any runtime, which is half of why this path was removed — so 'check the inbox' had nowhere to go. --expect-none waits the full window and succeeds only on silence; without it, nothing-arrived is unprovable.",
                     ],
                     inputs: {
                         name: "Tester Probe",
@@ -3539,6 +3605,8 @@ const rawTesterChecklistItems = [
                     expectedUiState: "The form shows a failure message, not the success confirmation.",
                     endResult: "Nothing appears in /admin/contact for that attempt, and the visitor knows to try again.",
                     href: "/admin/contact",
+                    requiresHumanChannel: true,
+                    humanChannelReason: "Needs the contactSubmissions write forced to fail — a Firestore rules change or a deploy-time fault injection. A browser cannot cause it, so a tester answers null and says so rather than spending turns trying. Kept in the catalogue because it guards the sharpest edge in the change: with the email gone, that write is the ONLY record a customer wrote in, and a save that fails while the form still says thank you loses the message silently.",
                 },
                 {
                     key: "contact-digest-mailto-reply",
@@ -3548,7 +3616,8 @@ const rawTesterChecklistItems = [
                     startPage: "/admin/contact",
                     steps: [
                         "Submit a contact message from the public form.",
-                        "As admin, trigger the daily digest.",
+                        // audit-hardcoded-api-routes-ok: no button exists; the tester pastes this URL into a console by hand.
+                        "As admin, trigger the daily digest: run fetch('/api/admin/daily-digest/trigger',{method:'POST'}) from the browser console. There is no button for it — Site Settings only carries a toggle to enable the schedule — and this is the same instruction the other digest case uses.",
                         "Open the digest and find the message under Contact messages.",
                         "Click its Reply link.",
                     ],
@@ -4902,6 +4971,12 @@ const rawTesterChecklistItems = [
             pageLabel: "Prize Draws / Lotteries",
             href: "/admin/prize-draws",
             cases: [
+                {
+                    key: "lottery-edit-preserves-bookings",
+                    label: "Editing a lottery's prizes leaves its bookings intact -- booked slots stay booked, against the same buyers",
+                    description: "BEFORE: the editor sent isBooked:false and weight:0 for every slot and dropped the buyer fields, and the event PATCH was passthrough -- so the first save of a live lottery freed every purchased slot and erased who bought them, with a 200 and no error. AFTER: the write shape cannot express booking state at all, and the merge reattaches by slotNumber rather than array index. Uses the seeded 25-slot lottery, five of them booked.",
+                    href: "/admin/lotteries",
+                },
                 { key: "prizedraw-create", label: "Admin can create a prize-draw listing, choosing instant or scheduled reveal mode and a 1–15 day duration", href: "/admin/prize-draws" },
                 { key: "prizedraw-reveal-winner", label: "Winners are assigned automatically via crypto.randomInt (on payment confirmation for instant mode, or at expiry/sellout for scheduled mode) — never by a manual admin click" },
                 { key: "prizedraw-scam-guard", label: "A prize draw with active entries cannot be unpublished, archived, or deleted, and an already-won item's details cannot be edited" },
@@ -4928,11 +5003,25 @@ const rawTesterChecklistItems = [
         {
             pageKey: "classifieds-digitalcodes-live",
             pageLabel: "Classifieds, Digital Codes & Live Listings",
-            href: "/admin/classified",
+            /*
+             * 🛑 /admin/products, not /admin/classified. The three per-type admin
+             * pages exist and are real, but they are browse-only wrappers over the
+             * shared listing-type config — no row actions, no Approve/Reject, no
+             * Quick edit. Moderation lives on /admin/products alone, so an href
+             * pointing at the per-type page sends the tester to a surface where
+             * the thing being tested cannot be done.
+             */
+            href: "/admin/products",
             cases: [
-                { key: "classified-create-moderate", label: "Admin can create and moderate classified listings", href: "/admin/classified" },
-                { key: "digitalcode-create-moderate", label: "Admin can create and moderate digital-code listings", href: "/admin/digital-codes" },
-                { key: "live-create-moderate", label: "Admin can create and moderate live-item listings", href: "/admin/live" },
+                { key: "classified-create-moderate", label: "Admin can create and moderate classified listings", href: "/admin/products" },
+                { key: "digitalcode-create-moderate", label: "Admin can create and moderate digital-code listings", href: "/admin/products" },
+                { key: "live-create-moderate", label: "Admin can create and moderate live-item listings", href: "/admin/products" },
+                {
+                    key: "reject-status-has-no-chip",
+                    label: "After the Reject row action, the listing is still findable by an admin — some status chip returns it",
+                    description: "BEFORE: Reject writes { status: \"rejected\" }, and ProductStatus is draft|published|in_review|archived — no such value. The PATCH schema types status as a bare z.string(), so it persists unvalidated, and the row then matches none of the four status chips: an admin can reach it only under All. AFTER: a rejected listing is isolatable by a status filter. The public half already works — every public query filters on published, so the listing does disappear, which is why this went unnoticed.",
+                    href: "/admin/products",
+                },
             ],
         },
         {
@@ -5585,7 +5674,7 @@ const rawTesterChecklistItems = [
                 {
                     key: "product-created-with-deep-category-visible-at-root",
                     label: "A product created through the form against a deep category appears on that category's ROOT page too",
-                    description: "🛑 KNOWN GAP, not a regression: nothing on the write side appends ancestors today, so a listing filed at tier 3 gets a one-element chain and is invisible on every ancestor page. Record what actually happens rather than assuming either answer.",
+                    description: "BEFORE: nothing on the write side appended ancestors, so a listing filed deep got a one-element chain and was invisible on every ancestor page. AFTER (2026-09-14): ProductRepository.deriveTaxonomy() derives the chain on create and update, so all three pages list it. Latent by construction — every seeded product already carries a correct chain, so only a product created through a form can catch a regression.",
                     href: "/admin/products",
                 },
                 {
@@ -5602,13 +5691,14 @@ const rawTesterChecklistItems = [
                 },
                 {
                     key: "category-type-not-guessable",
-                    label: "The category editor makes the row's kind explicit — a normal listing category, a brand, a sub-listing group or a bundle — rather than leaving it to be guessed",
+                    label: "A row's kind is set by WHICH admin surface authored it, and the surfaces stay disjoint — a brand never appears in the category tree, and vice versa",
+                    description: "Brands, bundles, sub-listing groups and ordinary categories share one collection, discriminated by categoryType. The admin category form has no kind dropdown and correctly should not: /admin/brands filters and writes categoryType==brand while /admin/categories writes an ordinary category. This tests that separation rather than the absent control. (Key kept — renaming orphans responses.)",
                     href: "/admin/categories",
                 },
                 {
                     key: "delete-category-with-children-refused",
-                    label: "Deleting a category that still has children or products is refused with a reason naming what depends on it",
-                    description: "A delete that succeeds and orphans its subtree is unrecoverable. Refusing it, with the count, is the correct outcome.",
+                    label: "Deleting a category CASCADES to its parent — its children re-parent to the grandparent and its products are re-filed there with rebuilt ancestor chains",
+                    description: "BEFORE: a flat 409 refusal whenever the category had subcategories. AFTER: the delete cascades. Products are re-filed through the repository, so each one's chain is rebuilt from its new leaf; the order is load-bearing because a product must move while the document still exists. The failure to watch for is a product left pointing at the deleted row. (Key kept despite the stale 'refused' wording — renaming it would orphan every response recorded against it.)",
                     href: "/admin/categories",
                 },
             ],
@@ -5654,7 +5744,13 @@ const rawTesterChecklistItems = [
             pageLabel: "Bans, Unbans & Trust",
             href: "/admin/users",
             cases: [
-                { key: "soft-ban-blocks-signin", label: "Soft-banning a user prevents them signing in and tells them why", href: "/admin/users" },
+                {
+                    key: "soft-ban-blocks-signin",
+                    /* Key kept — renaming it orphans every verdict recorded against it. */
+                    label: "A soft ban blocks the ONE action it names and leaves sign-in working; a hard ban refuses sign-in. Both tell the person why",
+                    description: "The label used to read \"Soft-banning a user prevents them signing in\", which is false: a soft ban appends to user.softBans[] as a per-action restriction (place_bids, write_reviews, …) and /api/auth/login refuses only on the Auth record being disabled, which is what a HARD ban sets. A tester following the old label would have reported working behaviour as a defect.",
+                    href: "/admin/users",
+                },
                 { key: "soft-ban-requires-reason", label: "A ban cannot be applied without a reason, and that reason reaches the banned user", href: "/admin/users" },
                 {
                     key: "unban-restores-access",
@@ -5971,6 +6067,12 @@ const rawTesterChecklistItems = [
                     label: "The buyer's own bid page does NOT reveal other bidders",
                     description: "Open the same bid at /admin/bids/{id}/view and at /user/bids/{id}/view. The buyer view must not show the other bidder's identity. One `viewer` argument decides this, in one place — if the buyer view leaks a name, that argument is being ignored somewhere.",
                 },
+                {
+                    key: "detail-page-seller-sees-bidder",
+                    label: "A seller opening a bid on their own auction sees who placed it, and the modal and the full page agree",
+                    description: "buildBidDetailFields(bid, viewer) has four callers and the seller leg had no case. Its only viewer-dependent row is Bidder, added when the viewer is not the buyer, so this is the other side of the identity case: the buyer must NOT see a competitor, and the seller MUST see who is bidding on their own auction.",
+                    href: "/store/bids",
+                },
             ],
         },
         {

package/dist/features/tester/utils/phases.d.ts

@@ -22,6 +22,23 @@ export interface TesterPhaseAssignable {
 /** Target item count per phase — real phase sizes vary a little around this
  * since a page's items are never split across two phases. */
 export declare const DEFAULT_TESTER_PHASE_SIZE = 25;
+/**
+ * Groups that take the earliest phases, ahead of the round-robin.
+ *
+ * 🛑 THE ROUND-ROBIN BELOW IS RIGHT FOR EVERYTHING ELSE AND WRONG FOR THIS.
+ * Interleaving exists so an early stop costs a proportional slice of every
+ * group rather than the whole tail — a fair outcome when no group matters more
+ * than another. But `happy-path` is not one group among fourteen: it is the
+ * question "can anyone buy anything on this site", and a run that covered 7% of
+ * it alongside 7% of SEO metadata has answered nothing.
+ *
+ * So these groups are packed FIRST, in their own catalogue order, and the
+ * round-robin then runs over the remainder exactly as before.
+ *
+ * Adding a group here is a real cost: every group after it loses its early
+ * proportional slice. Two entries is the intended size of this list.
+ */
+export declare const PRIORITY_GROUPS: readonly string[];
 /**
  * Returns a same-length array of 1-based phase numbers, one per input item,
  * computed by greedily packing whole pages (consecutive runs of the same

package/dist/features/tester/utils/phases.js

@@ -18,6 +18,23 @@
 /** Target item count per phase — real phase sizes vary a little around this
  * since a page's items are never split across two phases. */
 export const DEFAULT_TESTER_PHASE_SIZE = 25;
+/**
+ * Groups that take the earliest phases, ahead of the round-robin.
+ *
+ * 🛑 THE ROUND-ROBIN BELOW IS RIGHT FOR EVERYTHING ELSE AND WRONG FOR THIS.
+ * Interleaving exists so an early stop costs a proportional slice of every
+ * group rather than the whole tail — a fair outcome when no group matters more
+ * than another. But `happy-path` is not one group among fourteen: it is the
+ * question "can anyone buy anything on this site", and a run that covered 7% of
+ * it alongside 7% of SEO metadata has answered nothing.
+ *
+ * So these groups are packed FIRST, in their own catalogue order, and the
+ * round-robin then runs over the remainder exactly as before.
+ *
+ * Adding a group here is a real cost: every group after it loses its early
+ * proportional slice. Two entries is the intended size of this list.
+ */
+export const PRIORITY_GROUPS = ["happy-path"];
 /**
  * Returns a same-length array of 1-based phase numbers, one per input item,
  * computed by greedily packing whole pages (consecutive runs of the same
@@ -73,7 +90,18 @@ export function assignDefaultPhases(itemsInCatalogOrder, targetPhaseSize = DEFAU
             byGroup.set(g, []);
         byGroup.get(g).push(pageId);
     }
+    /*
+     * Priority groups first, whole, in catalogue order — then the round-robin over
+     * everything else. See PRIORITY_GROUPS for why this one group is exempt from
+     * the interleaving the rest depends on.
+     */
+    const interleaved = [];
+    for (const g of PRIORITY_GROUPS) {
+        for (const pageId of byGroup.get(g) ?? [])
+            interleaved.push(pageId);
+    }
     const groupsLargestFirst = [...byGroup.entries()]
+        .filter(([g]) => !PRIORITY_GROUPS.includes(g))
         .map(([g, pages]) => ({
         g,
         pages,
@@ -82,8 +110,7 @@ export function assignDefaultPhases(itemsInCatalogOrder, targetPhaseSize = DEFAU
         .sort((a, b) => b.cases - a.cases || a.g.localeCompare(b.g))
         .map((e) => e.g);
     const cursor = new Map(groupsLargestFirst.map((g) => [g, 0]));
-    const interleaved = [];
-    let remaining = pageOrder.length;
+    let remaining = pageOrder.length - interleaved.length;
     while (remaining > 0) {
         for (const g of groupsLargestFirst) {
             const i = cursor.get(g);

package/dist/index.d.ts

@@ -1766,6 +1766,7 @@ export { eventIdGET } from "./features/events/server";
 export { getEventLeaderboard } from "./features/events/server";
 export { getEventPollResults } from "./features/events/server";
 export { getEventSpinResults } from "./features/events/server";
+export { getUserSpinResultsForEvent } from "./features/events/server";
 export { getBugHunterLeaderboard } from "./features/tester/server";
 export { getPublicEventById } from "./features/events/server";
 export { listPublicEvents } from "./features/events/server";

package/dist/index.js

@@ -3339,6 +3339,8 @@ export { getEventPollResults } from "./features/events/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getEventSpinResults - Last N winning spins for a spin_wheel event, most recent first.
 export { getEventSpinResults } from "./features/events/server";
+// getUserSpinResultsForEvent - The CALLER'S OWN spins for an event, unmasked. Companion to the masked public feed above.
+export { getUserSpinResultsForEvent } from "./features/events/server";
 // [SERVER-ONLY]-Server-only â€" uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getBugHunterLeaderboard - Ranks testers by confirmed-bug count.
 export { getBugHunterLeaderboard } from "./features/tester/server";

package/dist/seo/json-ld.d.ts

@@ -36,6 +36,29 @@ export interface ProductJsonLdInput {
     auctionEndDate?: Date;
     /** Canonical discriminator (SB1-G Phase 4). */
     listingType?: ListingType;
+    /**
+     * The path this listing actually lives at, e.g. `/auctions/{slug}`.
+     *
+     * 🛑 Both builders hardcoded `/products/${slug}`, so an auction's own
+     * structured data advertised its offer — and its `url` — at a path that
+     * belongs to a different listing type. Measured live: the block on
+     * `/auctions/auction-beyblade-metal-lightning-l-drago` carried
+     * `offers.url: ".../products/auction-beyblade-metal-lightning-l-drago"`,
+     * and that URL served a full standard product page with Buy Now and Add to
+     * Cart and no bid controls at all. So the one consumer that reads this field
+     * — a crawler — was sent to the wrong page, and told it was canonical there.
+     *
+     * Six of the nine listing types have their own detail route (Root Cause
+     * #48), so `/products/{slug}` is a wrong default for two thirds of them.
+     *
+     * Defaults to `/products/${slug}` when omitted, which is correct for
+     * `standard`, `art` and `stickers` — the three that genuinely live there —
+     * and keeps every existing caller behaving exactly as before. The caller
+     * knows its own route; resolving it here would mean importing the listing-type
+     * registry into `seo/`, which must stay reachable from server-only metadata
+     * paths without widening its import graph (Root Cause #76).
+     */
+    detailPath?: string;
     /**
      * Denormalised rating, straight off `ProductDocument.avgRating` /
      * `.reviewCount` — so emitting it costs **zero** extra Firestore reads.

package/dist/seo/json-ld.js

@@ -85,7 +85,7 @@ export function gatedPriceWebPageJsonLd(path) {
     };
 }
 export function productJsonLd(product) {
-    const url = `${SITE_URL}/products/${product.slug}`;
+    const url = `${SITE_URL}${product.detailPath ?? `/products/${product.slug}`}`;
     // Absolutise, then de-duplicate: `mainImage` is very often also `images[0]`,
     // which produced the same URL twice in the emitted array.
     const images = [
@@ -246,7 +246,8 @@ export function searchBoxJsonLd(opts) {
     };
 }
 export function auctionJsonLd(auction) {
-    const url = `${SITE_URL}/products/${auction.slug}`;
+    // An auction lives at /auctions/{slug} — see `detailPath`'s note.
+    const url = `${SITE_URL}${auction.detailPath ?? `/auctions/${auction.slug}`}`;
     const base = productJsonLd(auction);
     return {
         ...base,

package/dist/server.d.ts

@@ -266,6 +266,7 @@ export { getEventLeaderboard } from "./features/events/server";
 export { getEventPollResults } from "./features/events/server";
 export type { PollResultEntry, SpinResultEntry } from "./features/events/index";
 export { getEventSpinResults } from "./features/events/server";
+export { getUserSpinResultsForEvent } from "./features/events/server";
 export { getBugHunterLeaderboard } from "./features/tester/server";
 export { getPublicEventById } from "./features/events/server";
 export { listPublicEvents } from "./features/events/server";

package/dist/server.js

@@ -777,6 +777,8 @@ export { getEventPollResults } from "./features/events/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getEventSpinResults - Last N winning spins for a spin_wheel event, most recent first.
 export { getEventSpinResults } from "./features/events/server";
+// getUserSpinResultsForEvent - The CALLER'S OWN spins for an event, unmasked. Companion to the masked public feed above.
+export { getUserSpinResultsForEvent } from "./features/events/server";
 // [SERVER-ONLY]-Server-only — uses Node.js, Next.js server internals, or third-party server SDKs (auth, email, payment, shipping).
 // getBugHunterLeaderboard - Ranks testers by confirmed-bug count.
 export { getBugHunterLeaderboard } from "./features/tester/server";