@mohasinac/appkit 4.52.4 → 4.53.0

package/dist/_internal/server/jobs/core/searchIndexBuild.js

@@ -0,0 +1,211 @@
+/*
+ * Core: build the public search index artifact.
+ *
+ * ## 🛑 THE READ BUDGET IS WHY THIS JOB HAS THREE MODES
+ *
+ * Firestore bills per document read regardless of `select()`. A full rebuild
+ * every 15 minutes is `96 × 3,730 ≈ 358,000 reads/day` against a 50,000/day
+ * free tier — seven times over. Hourly is still ~89,000. So:
+ *
+ *   idle        manifest not dirty, full not due     1 read       ~90/day
+ *   incremental dirty: `updatedAt >` per source      13 + changed ~200/day
+ *   full        >24h since the last one              3,730        3,730/day
+ *
+ * ≈ 4,000 reads/day, about 8% of the tier. Measured on production: a full
+ * build is 3,750 reads, 3,589 records, 384 KB raw / 48 KB brotli, in 4.1s.
+ *
+ * 🛑 EVERY RUN LOGS ITS MODE AND READ COUNT. If the incremental path ever
+ * breaks and silently falls back to FULL each cadence, that is 358,000
+ * reads/day and a quota wall — and the only way anyone finds out before the
+ * wall is this line. A job that does the wrong thing cheaply is a bug; one
+ * that does it seven times over the tier is an outage.
+ *
+ * ## Why its own scheduled job rather than folding into an existing one
+ *
+ * `countersReconcile` and `productStatsSync` already run near their 540s
+ * ceiling, and a full rebuild failing inside one of them would take category
+ * metrics down with it. `priceIndexRollup`'s header makes the same argument
+ * for staying separate. CLAUDE.md explicitly accepts ~$0.10/month for a new
+ * distinct-cadence Scheduler job rather than routing around it.
+ *
+ * @tag domain:search
+ * @tag layer:server
+ * @tag pattern:job-core
+ * @tag access:server
+ * @tag consumers:searchIndexBuildHandler
+ * @tag sideEffects:firestore,storage
+ */
+import { getAdminStorage } from "../../../../providers/db-firebase/index.js";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { serverLogger } from "../../../../monitoring/server-logger.js";
+import { buildFull, buildIncremental, } from "../../features/search/index-build/build.js";
+import { manifestRef, publishArtifact, publishManifestMirror, readManifest, storagePathFor, } from "../../features/search/index-build/artifact-store.js";
+/** How stale the index may get before a reconciling full pass is forced. */
+const FULL_REBUILD_INTERVAL_MS = 24 * 60 * 60 * 1000;
+function dueForFull(manifest, now) {
+    if (!manifest || !manifest.lastFullAt)
+        return true;
+    const last = Date.parse(manifest.lastFullAt);
+    if (!Number.isFinite(last))
+        return true;
+    return now.getTime() - last >= FULL_REBUILD_INTERVAL_MS;
+}
+/**
+ * Fetch the previous artifact so an incremental pass can patch it.
+ *
+ * Returns null on any failure, which makes the caller fall back to a FULL
+ * build. That is the right degradation: a full build is expensive but
+ * correct, whereas patching an artifact we could not read is not possible at
+ * all.
+ */
+async function readPreviousArtifact(storagePath) {
+    try {
+        const bucket = getAdminStorage().bucket();
+        const [buf] = await bucket.file(storagePath).download();
+        return JSON.parse(buf.toString("utf8"));
+    }
+    catch (err) {
+        const e = normalizeError(err);
+        /*
+         * WARN, not silence. Returning null here is a correct degradation — the
+         * caller falls back to a FULL build, which is expensive but right — and
+         * that is exactly why it needs a log line: a permanently unreadable
+         * previous artifact turns every run into a 3,730-read full build and the
+         * only outward sign is the read count creeping up. The fallback hides the
+         * fault, so the log is the one thing that does not.
+         */
+        serverLogger.warn("search index: previous artifact unreadable, falling back to FULL", {
+            storagePath,
+            message: e.message,
+        });
+        return null;
+    }
+}
+export async function runSearchIndexBuild(ctx) {
+    const { db, logger, now } = ctx;
+    const manifest = await readManifest(db);
+    const wantFull = dueForFull(manifest, now);
+    /*
+     * The idle exit. One read, ~90 times a day. Without it the job would do a
+     * 13-query incremental pass every 15 minutes whether or not anything
+     * changed, which is 1,250 reads/day spent proving nothing happened.
+     */
+    if (!wantFull && manifest && manifest.dirty !== true) {
+        logger.info("search index: idle (not dirty, full not due)", { reads: 1 });
+        return;
+    }
+    const version = (manifest?.version ?? 0) + 1;
+    let result;
+    let mode = "full";
+    if (!wantFull && manifest) {
+        const previous = await readPreviousArtifact(manifest.storagePath);
+        if (previous) {
+            const since = new Date(manifest.builtAt);
+            result = await buildIncremental(db, previous, since, version, now);
+            mode = "incremental";
+        }
+    }
+    if (!result) {
+        result = await buildFull(db, version, now);
+        mode = "full";
+    }
+    const { artifact, stats } = result;
+    const published = await publishArtifact(getAdminStorage().bucket(), artifact);
+    const next = {
+        schema: artifact.schema,
+        version,
+        builtAt: artifact.builtAt,
+        lastFullAt: mode === "full" ? artifact.builtAt : (manifest?.lastFullAt ?? artifact.builtAt),
+        storagePath: published.storagePath,
+        recordCount: artifact.r.length,
+        bytes: published.bytes,
+        perType: stats.perType,
+        /*
+         * Cleared LAST, after the artifact is live — clearing it first would lose
+         * every write that arrived while this build was running.
+         *
+         * 🛑 And NOT cleared at all if any source threw. An incremental pass skips
+         * a failing source by design (the previous values stay, which is correct
+         * and slightly stale), but clearing `dirty` on top of that would mean the
+         * next run exits idle and those types never recover until the daily full
+         * pass — a partial index reported as a clean one. Staying dirty costs one
+         * retry per cadence and is self-healing.
+         *
+         * This mattered immediately: the first incremental run against production
+         * failed on every source with a `where` clause, for a missing composite
+         * index, and without this it would have published a mostly-empty patch
+         * and called it done.
+         */
+        dirty: stats.failed > 0,
+    };
+    await manifestRef(db).set(next, { merge: true });
+    /*
+     * Firestore first (the next build reads it), the public mirror second (the
+     * browser reads it). See `publishManifestMirror` for why a failure here is
+     * logged rather than thrown.
+     */
+    await publishManifestMirror(getAdminStorage().bucket(), next);
+    /*
+     * 🛑 The line that makes a runaway visible. `reads` is the number that has
+     * to stay inside the budget, and `mode` is what explains it.
+     */
+    const line = stats.failed > 0 ? logger.warn : logger.info;
+    line("search index built", {
+        mode,
+        version,
+        reads: stats.reads,
+        // 🛑 Surfaced, not swallowed. A non-zero count means the artifact is
+        // incomplete for those types and the manifest stays dirty for a retry.
+        failedSources: stats.failed,
+        records: artifact.r.length,
+        dropped: stats.dropped,
+        bytes: published.bytes,
+        prunedVersions: published.pruned,
+        durationMs: stats.durationMs,
+    });
+}
+/**
+ * Force a full rebuild, ignoring the manifest's cadence. For a one-off repair
+ * after a schema bump or a reseed.
+ */
+export async function runSearchIndexFullRebuild(ctx) {
+    const { db, logger, now } = ctx;
+    const manifest = await readManifest(db);
+    const version = (manifest?.version ?? 0) + 1;
+    try {
+        const { artifact, stats } = await buildFull(db, version, now);
+        const published = await publishArtifact(getAdminStorage().bucket(), artifact);
+        const next = {
+            schema: artifact.schema,
+            version,
+            builtAt: artifact.builtAt,
+            lastFullAt: artifact.builtAt,
+            storagePath: published.storagePath,
+            recordCount: artifact.r.length,
+            bytes: published.bytes,
+            perType: stats.perType,
+            dirty: false,
+        };
+        await manifestRef(db).set(next, { merge: true });
+        /*
+         * 🛑 The mirror belongs on BOTH paths. This one is the manual repair
+         * entry point — the one somebody reaches for precisely when the index is
+         * wrong — so a rebuild that fixed the artifact and left every browser
+         * pointed at the broken version would be the worst possible outcome of
+         * running it.
+         */
+        await publishManifestMirror(getAdminStorage().bucket(), next);
+        logger.info("search index FULL rebuild complete", {
+            version,
+            reads: stats.reads,
+            records: artifact.r.length,
+            bytes: published.bytes,
+            path: storagePathFor(version),
+        });
+    }
+    catch (err) {
+        const e = normalizeError(err);
+        logger.error("search index FULL rebuild failed", { message: e.message });
+        throw err;
+    }
+}

package/dist/_internal/server/jobs/core/triggerEventRaffle.d.ts

@@ -1,6 +1,38 @@
 /**
  * Core: select a raffle winner for an event using `crypto.randomInt()`. Pool
  * logic keys off the event's `raffleType`.
+ *
+ * ## Three things in here had never worked
+ *
+ * 1. **The pool query could not match any entry created by this app.** It
+ *    asked for `status == "CONFIRMED"` — a real field with a real admin
+ *    workflow (`AdminAllEventEntriesView`'s Confirm / Waitlist / Cancel row
+ *    actions) but with NO writer at creation time. `enterEvent` never set it
+ *    and neither did the seed, so the pool was empty unless an admin had
+ *    hand-confirmed every entry one row at a time — on a raffle seeded with
+ *    1,892 entries. Every draw returned `no_eligible_entries`; the raffle had
+ *    never once been drawable.
+ *
+ *    The predicate is now `reviewStatus == "approved"`: written on every entry
+ *    path, already indexed `(eventId, reviewStatus, submittedAt DESC)`, and
+ *    auto-approved for raffles by `enterEvent`. `status` keeps its RSVP
+ *    meaning and is deliberately NOT the gate — see the note on both fields in
+ *    `constants/field-names.ts`.
+ *
+ * 2. **`drawsPermitted: 1` was not enforced.** The already-drawn check and the
+ *    winner write sat outside any transaction, so two concurrent admin clicks
+ *    both saw no winner and both wrote — two winners for one prize. The
+ *    check-and-write is now inside `runTransaction`, following the sibling
+ *    core `prizeDrawAssignWinner`.
+ *
+ * 3. **The winner was never told.** A winner was recorded and the only way to
+ *    find out was to revisit the event page.
+ *
+ * The `FEATURE_PRIZE_DRAWS` gate that used to open this function was deleted
+ * 2026-10-19 — see the header of `assignSpinPrize.ts`. Its branch here was the
+ * second-worst shaped of the nine: it returned early with **no `reason`**, and
+ * the route decides success by `if (data.reason && !data.raffleWinnerUserId)`,
+ * so a disabled feature answered `200 "Raffle triggered"` with no winner.
  */
 import type { JobContext } from "../runtime/types";
 export interface TriggerEventRaffleInput {
@@ -9,9 +41,12 @@ export interface TriggerEventRaffleInput {
     topN?: number;
 }
 export interface TriggerEventRaffleResult {
+    /** The canonical DOCUMENT ID, even when the caller passed a slug. */
     eventId: string;
     raffleWinnerUserId?: string;
     raffleWinnerDisplayName?: string;
+    /** The prize coupon's CODE, resolved at draw time and recorded on the event. */
+    rafflePrizeCouponCode?: string;
     raffleEntryCount: number;
     alreadyTriggered?: boolean;
     reason?: string;

package/dist/_internal/server/jobs/core/triggerEventRaffle.js

@@ -1,40 +1,121 @@
 /**
  * Core: select a raffle winner for an event using `crypto.randomInt()`. Pool
  * logic keys off the event's `raffleType`.
+ *
+ * ## Three things in here had never worked
+ *
+ * 1. **The pool query could not match any entry created by this app.** It
+ *    asked for `status == "CONFIRMED"` — a real field with a real admin
+ *    workflow (`AdminAllEventEntriesView`'s Confirm / Waitlist / Cancel row
+ *    actions) but with NO writer at creation time. `enterEvent` never set it
+ *    and neither did the seed, so the pool was empty unless an admin had
+ *    hand-confirmed every entry one row at a time — on a raffle seeded with
+ *    1,892 entries. Every draw returned `no_eligible_entries`; the raffle had
+ *    never once been drawable.
+ *
+ *    The predicate is now `reviewStatus == "approved"`: written on every entry
+ *    path, already indexed `(eventId, reviewStatus, submittedAt DESC)`, and
+ *    auto-approved for raffles by `enterEvent`. `status` keeps its RSVP
+ *    meaning and is deliberately NOT the gate — see the note on both fields in
+ *    `constants/field-names.ts`.
+ *
+ * 2. **`drawsPermitted: 1` was not enforced.** The already-drawn check and the
+ *    winner write sat outside any transaction, so two concurrent admin clicks
+ *    both saw no winner and both wrote — two winners for one prize. The
+ *    check-and-write is now inside `runTransaction`, following the sibling
+ *    core `prizeDrawAssignWinner`.
+ *
+ * 3. **The winner was never told.** A winner was recorded and the only way to
+ *    find out was to revisit the event page.
+ *
+ * The `FEATURE_PRIZE_DRAWS` gate that used to open this function was deleted
+ * 2026-10-19 — see the header of `assignSpinPrize.ts`. Its branch here was the
+ * second-worst shaped of the nine: it returned early with **no `reason`**, and
+ * the route decides success by `if (data.reason && !data.raffleWinnerUserId)`,
+ * so a disabled feature answered `200 "Raffle triggered"` with no winner.
  */
 import crypto from "node:crypto";
-import { EVENT_ENTRY_FIELDS } from "../../../../constants/field-names.js";
-const EVENTS_COLLECTION = "events";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
+import { EVENT_ENTRY_FIELDS, EVENT_FIELDS } from "../../../../constants/field-names.js";
+import { EVENT_ENTRY_PII_FIELDS, maskPii } from "../../../../security/index.js";
+import { resolveEventRef } from "./_event-ref.js";
+import { EVENT_DRAW_REASON } from "./event-draw-reasons.js";
+/**
+ * The winner's display name, masked for a PUBLIC announcement.
+ *
+ * `maskPii` rather than `eventEntryRepository.maskedEntry` because the pool
+ * here is typed as a local `EntryDoc`, not a full `EventEntryDocument` — and
+ * `maskPii` takes a plain object, so no cast is needed to use the shared rule.
+ */
+const maskedWinnerName = (data) => maskPii(data, EVENT_ENTRY_PII_FIELDS).userDisplayName;
 const EVENT_ENTRIES_COLLECTION = "eventEntries";
+const COUPONS_COLLECTION = "coupons";
 export async function runTriggerEventRaffle(input, ctx) {
-    if (ctx.env("FEATURE_PRIZE_DRAWS") !== "true") {
-        ctx.logger.info("FEATURE_PRIZE_DRAWS disabled — skipping event raffle");
-        return { eventId: input.eventId, raffleEntryCount: 0 };
-    }
-    const eventRef = ctx.db.collection(EVENTS_COLLECTION).doc(input.eventId);
-    const eventSnap = await eventRef.get();
-    if (!eventSnap.exists) {
+    // Slug-or-id — the admin UI passes a doc id, but this shares its resolver
+    // with the spin core, which is reached from public slug URLs.
+    const resolved = await resolveEventRef(ctx.db, input.eventId);
+    if (!resolved) {
         return {
             eventId: input.eventId,
             raffleEntryCount: 0,
-            reason: "event_not_found",
+            reason: EVENT_DRAW_REASON.EVENT_NOT_FOUND,
         };
     }
-    const event = eventSnap.data();
+    const eventId = resolved.id;
+    const eventRef = resolved.ref;
+    const event = resolved.data;
+    /*
+     * Nothing checked that this event HAS a raffle, so the runner would happily
+     * draw a winner on a poll or a sale and write `raffleWinnerUserId` onto it.
+     * `hasRaffle` is the bolt-on flag; `type === "raffle"` is the dedicated
+     * event type. Either qualifies — a raffle-typed event with the flag unset is
+     * a seeding omission, not a reason to refuse a legitimate draw.
+     */
+    if (event.hasRaffle !== true && event.type !== EVENT_FIELDS.TYPE_VALUES.RAFFLE) {
+        return { eventId, raffleEntryCount: 0, reason: EVENT_DRAW_REASON.NOT_A_RAFFLE };
+    }
+    /*
+     * A draw is permitted on an ACTIVE or ENDED event, and deliberately not on
+     * draft / paused / cancelled. "Ended" is the normal case — a raffle is drawn
+     * after entries close — so gating on `active` alone would refuse every real
+     * draw. Cancelled is the one that matters: drawing a winner for a cancelled
+     * raffle creates an obligation nobody intended.
+     */
+    if (event.status !== EVENT_FIELDS.STATUS_VALUES.ACTIVE &&
+        event.status !== EVENT_FIELDS.STATUS_VALUES.ENDED) {
+        return { eventId, raffleEntryCount: 0, reason: EVENT_DRAW_REASON.NOT_ACTIVE };
+    }
+    // Cheap pre-check so the common "already drawn" case costs no transaction.
+    // The authoritative check is inside the transaction below — this one races.
     if (event.raffleWinnerUserId) {
         return {
-            eventId: input.eventId,
+            eventId,
             raffleEntryCount: 0,
             alreadyTriggered: true,
             raffleWinnerUserId: event.raffleWinnerUserId,
+            reason: EVENT_DRAW_REASON.ALREADY_TRIGGERED,
         };
     }
     const raffleType = input.raffleType ?? event.raffleType ?? "open_raffle";
     const topN = input.topN ?? event.raffleTopN ?? 0;
+    /*
+     * Built OUTSIDE the transaction, on purpose. The pool can be large (a seeded
+     * raffle claims 1,892 entries) and a Firestore transaction holds locks for
+     * everything it reads — so reading the pool inside would make a draw scale
+     * its lock footprint with entrant count. The same split as
+     * `prizeDrawAssignWinner`: read the candidates normally, then do the
+     * check-and-write transactionally.
+     *
+     * 🛑 `reviewStatus == "approved"`, NOT `status == "CONFIRMED"`. See this
+     * file's header. `enterEvent` now auto-approves raffle entries, so a live
+     * entrant lands in this pool without an admin touching anything; a FLAGGED
+     * entry correctly drops out of it.
+     */
     const entriesSnap = await ctx.db
         .collection(EVENT_ENTRIES_COLLECTION)
-        .where(EVENT_ENTRY_FIELDS.EVENT_ID, "==", input.eventId)
-        .where(EVENT_ENTRY_FIELDS.STATUS, "==", EVENT_ENTRY_FIELDS.STATUS_VALUES.CONFIRMED)
+        .where(EVENT_ENTRY_FIELDS.EVENT_ID, "==", eventId)
+        .where(EVENT_ENTRY_FIELDS.REVIEW_STATUS, "==", EVENT_ENTRY_FIELDS.REVIEW_STATUS_VALUES.APPROVED)
         .get();
     let pool = entriesSnap.docs.map((d) => ({
         id: d.id,
@@ -60,32 +141,133 @@ export async function runTriggerEventRaffle(input, ctx) {
     }
     if (pool.length === 0) {
         return {
-            eventId: input.eventId,
+            eventId,
             raffleEntryCount: 0,
-            reason: "no_eligible_entries",
+            reason: EVENT_DRAW_REASON.NO_ELIGIBLE_ENTRIES,
         };
     }
-    const winnerIdx = crypto.randomInt(0, pool.length);
-    const winner = pool[winnerIdx];
-    await eventRef.update({
-        raffleWinnerUserId: winner.data.userId,
-        raffleWinnerDisplayName: winner.data.userDisplayName ?? "",
-        raffleWinnerEntryId: winner.id,
-        raffleTriggeredAt: ctx.now,
-        raffleEntryCount: entriesSnap.size,
-        raffleGithubFunctionUrl: `${ctx.env("PROOF_OF_FAIRNESS_BASE_URL") ?? ""}/raffles/${input.eventId}.json`,
-        updatedAt: ctx.now,
+    /*
+     * Resolve the prize coupon's CODE before the transaction and record it on the
+     * event alongside the winner.
+     *
+     * `rafflePrizeCouponId` was write-only: accepted by the admin create/update
+     * routes, declared in `EVENT_FIELDS`, rendered by the winner page — and never
+     * read by this runner. Recording the code here makes the prize durable
+     * against a later edit of the event's coupon, the same reason
+     * `assignSpinPrize` stores `spinPrizeCouponCode` on the entry rather than
+     * re-deriving it. Resolution is best-effort: a missing coupon must not cost
+     * somebody their win.
+     */
+    let rafflePrizeCouponCode;
+    if (event.rafflePrizeCouponId) {
+        const coupSnap = await ctx.db
+            .collection(COUPONS_COLLECTION)
+            .doc(event.rafflePrizeCouponId)
+            .get();
+        if (coupSnap.exists) {
+            rafflePrizeCouponCode = coupSnap.data().code;
+        }
+        else {
+            ctx.logger.warn("Raffle prize couponId does not resolve to a coupon", {
+                eventId,
+                couponId: event.rafflePrizeCouponId,
+            });
+        }
+    }
+    /*
+     * 🛑 The one-draw invariant. Re-read the event INSIDE the transaction.
+     *
+     * The pre-check above reads outside it, so two admins clicking at the same
+     * moment both pass it. Firestore aborts and retries a transaction whose read
+     * set changed, so whichever commits second sees the first winner here and
+     * bails. Two winners for one prize is the failure the tester's own case
+     * calls the most serious on this page, and it was fully reachable.
+     */
+    const drawn = await ctx.db.runTransaction(async (tx) => {
+        const fresh = await tx.get(eventRef);
+        const freshData = (fresh.data() ?? {});
+        if (freshData.raffleWinnerUserId) {
+            return {
+                alreadyTriggered: true,
+                raffleWinnerUserId: freshData.raffleWinnerUserId,
+            };
+        }
+        const winner = pool[crypto.randomInt(0, pool.length)];
+        const maskedName = maskedWinnerName(winner.data) ?? "";
+        tx.update(eventRef, {
+            [EVENT_FIELDS.RAFFLE_WINNER_USER_ID]: winner.data.userId,
+            /*
+             * 🛑 MASKED, not raw. `userDisplayName` is an `EVENT_ENTRY_PII_FIELDS`
+             * member, so an entry read returns ciphertext — and this writes onto the
+             * EVENT document, where the field is neither encrypted nor decrypted, and
+             * is then shown PUBLICLY as the raffle winner. Masked rather than revealed
+             * because a public winner announcement is exactly the surface that should
+             * read "R*** K***".
+             */
+            [EVENT_FIELDS.RAFFLE_WINNER_DISPLAY_NAME]: maskedName,
+            [EVENT_FIELDS.RAFFLE_WINNER_ENTRY_ID]: winner.id,
+            [EVENT_FIELDS.RAFFLE_TRIGGERED_AT]: ctx.now,
+            [EVENT_FIELDS.RAFFLE_ENTRY_COUNT]: entriesSnap.size,
+            ...(rafflePrizeCouponCode ? { rafflePrizeCouponCode } : {}),
+            [EVENT_FIELDS.RAFFLE_GITHUB_FUNCTION_URL]: `${ctx.env("PROOF_OF_FAIRNESS_BASE_URL") ?? ""}/raffles/${eventId}.json`,
+            [EVENT_FIELDS.UPDATED_AT]: ctx.now,
+        });
+        return {
+            alreadyTriggered: false,
+            winnerId: winner.id,
+            userId: winner.data.userId,
+            maskedName,
+        };
     });
+    if (drawn.alreadyTriggered) {
+        return {
+            eventId,
+            raffleEntryCount: 0,
+            alreadyTriggered: true,
+            raffleWinnerUserId: drawn.raffleWinnerUserId,
+            reason: EVENT_DRAW_REASON.ALREADY_TRIGGERED,
+        };
+    }
     ctx.logger.info("Event raffle triggered", {
-        eventId: input.eventId,
+        eventId,
         raffleType,
         poolSize: pool.length,
-        winnerId: winner.id,
+        winnerId: drawn.winnerId,
     });
+    /*
+     * Tell the winner. Best-effort and AFTER the commit: a notification that
+     * fails must not roll back a recorded draw (the draw is irreversible and
+     * re-running it would pick a different winner), and a send inside the
+     * transaction would be retried on every abort. Same shape as
+     * `prizeDrawAssignWinner`.
+     */
+    if (drawn.userId) {
+        try {
+            await sendNotification({
+                userId: drawn.userId,
+                type: "prize_won",
+                priority: "high",
+                title: "You won the raffle!",
+                message: rafflePrizeCouponCode
+                    ? `You've been drawn as the winner. Your prize coupon code is ${rafflePrizeCouponCode}.`
+                    : "You've been drawn as the winner — open the event to see your prize.",
+                relatedId: eventId,
+                relatedType: "event",
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.warn("Raffle winner notification failed", {
+                eventId,
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
     return {
-        eventId: input.eventId,
-        raffleWinnerUserId: winner.data.userId,
-        raffleWinnerDisplayName: winner.data.userDisplayName,
+        eventId,
+        raffleWinnerUserId: drawn.userId,
+        raffleWinnerDisplayName: drawn.maskedName,
+        rafflePrizeCouponCode,
         raffleEntryCount: entriesSnap.size,
     };
 }

package/dist/_internal/server/jobs/core/weeklyPayoutEligibility.js

@@ -8,10 +8,7 @@ import { getDefaultCurrency } from "../../../../core/index.js";
 import { computePayoutDeduction } from "../../../shared/fees/calculator.js";
 import { ordersTaxableValue } from "../../../shared/checkout/order-math.js";
 export async function runWeeklyPayoutEligibility(ctx) {
-    if (ctx.env("FEATURE_PAYOUTS") !== "true") {
-        ctx.logger.info("FEATURE_PAYOUTS disabled — skipping weekly payout eligibility");
-        return { payoutsCreated: 0, ordersProcessed: 0, payoutIds: [] };
-    }
+    // `FEATURE_PAYOUTS` gate deleted 2026-10-19 — see `autoPayoutEligibility.ts`.
     ctx.logger.info("Starting weekly payout eligibility sweep");
     const siteSettings = await siteSettingsRepository.getSingleton();
     const commissions = siteSettings.commissions;
@@ -48,10 +45,19 @@ export async function runWeeklyPayoutEligibility(ctx) {
          * one pay different amounts for the same orders. */
         const grossAmount = ordersTaxableValue(orders.map((o) => o.data));
         const { platformFee, gatewayFee, gstOnFee, netAmount } = computePayoutDeduction(grossAmount, commissions);
+        /*
+         * 🛑 REVEALED before building a payout — see the identical note in
+         * `autoPayoutEligibility.ts`. `findById` is ciphertext-by-default and
+         * `createPayout` encrypts `sellerEmail`/`upiId` again, so the stored
+         * values went in double-encrypted and permanently unreadable, and the
+         * HMAC'd `sellerEmailIndex` could never match a real lookup.
+         */
+        const sellerPlain = userRepository.revealUser(seller);
         const payoutInput = {
             storeId,
-            sellerName: (seller.displayName ?? seller.email ?? store.ownerId),
-            sellerEmail: (seller.email ?? ""),
+            // `displayName` is plaintext by D1; the email fallback must be revealed.
+            sellerName: (seller.displayName ?? sellerPlain.email ?? store.ownerId),
+            sellerEmail: sellerPlain.email ?? "",
             orderIds: orders.map((o) => o.id),
             amount: netAmount,
             grossAmount,
@@ -63,20 +69,20 @@ export async function runWeeklyPayoutEligibility(ctx) {
             gstRate: commissions.gstPercent / 100,
             currency: defaultCurrency,
             status: "pending",
-            paymentMethod: seller.payoutDetails?.method === "upi" ? "upi" : "bank_transfer",
-            upiId: seller.payoutDetails?.method === "upi" ? seller.payoutDetails.upiId : undefined,
-            bankAccount: seller.payoutDetails?.method === "bank_transfer" && seller.payoutDetails.bankAccount
+            paymentMethod: sellerPlain.payoutDetails?.method === "upi" ? "upi" : "bank_transfer",
+            upiId: sellerPlain.payoutDetails?.method === "upi" ? sellerPlain.payoutDetails.upiId : undefined,
+            bankAccount: sellerPlain.payoutDetails?.method === "bank_transfer" && sellerPlain.payoutDetails.bankAccount
                 ? {
-                    accountHolderName: seller.payoutDetails.bankAccount.accountHolderName,
-                    accountNumberMasked: seller.payoutDetails.bankAccount.accountNumberMasked,
-                    ifscCode: seller.payoutDetails.bankAccount.ifscCode,
-                    bankName: seller.payoutDetails.bankAccount.bankName,
+                    accountHolderName: sellerPlain.payoutDetails.bankAccount.accountHolderName,
+                    accountNumberMasked: sellerPlain.payoutDetails.bankAccount.accountNumberMasked,
+                    ifscCode: sellerPlain.payoutDetails.bankAccount.ifscCode,
+                    bankName: sellerPlain.payoutDetails.bankAccount.bankName,
                 }
                 : undefined,
             notes: `Automated weekly payout — ${orders.length} delivered order(s)`,
             requestedAt: new Date(),
         };
-        const { id: payoutId } = await payoutRepository.create(payoutInput);
+        const { id: payoutId } = await payoutRepository.createPayout(payoutInput);
         for (let i = 0; i < orders.length; i += BATCH_LIMIT) {
             const slice = orders.slice(i, i + BATCH_LIMIT);
             const batch = ctx.db.batch();

package/dist/_internal/server/jobs/handlers/assignSpinPrize.d.ts

@@ -1,3 +1,11 @@
 import type { CallableHandler } from "../runtime/types";
 import { type AssignSpinPrizeInput, type AssignSpinPrizeResult } from "../core/assignSpinPrize";
+/**
+ * Statuses come from `reasonToHttp`, shared with `POST /api/events/[id]/spin`.
+ *
+ * This used to be a hand-written if-chain, and it disagreed with the route it
+ * mirrors: `identity_required` was 400 here and 401 there, and there was no
+ * `feature_disabled` branch at all, so that reason fell through as a SUCCESS.
+ * Two entry points, one handler, two behaviours — Root Cause #85.
+ */
 export declare const assignSpinPrizeHandler: CallableHandler<AssignSpinPrizeInput, AssignSpinPrizeResult>;

package/dist/_internal/server/jobs/handlers/assignSpinPrize.js

@@ -1,25 +1,25 @@
 import { runAssignSpinPrize, } from "../core/assignSpinPrize.js";
-function httpError(message, status) {
+import { reasonToHttp } from "../core/event-draw-reasons.js";
+function httpError(message, status, code) {
     const err = new Error(message);
     err.httpStatus = status;
+    err.code = code;
     return err;
 }
+/**
+ * Statuses come from `reasonToHttp`, shared with `POST /api/events/[id]/spin`.
+ *
+ * This used to be a hand-written if-chain, and it disagreed with the route it
+ * mirrors: `identity_required` was 400 here and 401 there, and there was no
+ * `feature_disabled` branch at all, so that reason fell through as a SUCCESS.
+ * Two entry points, one handler, two behaviours — Root Cause #85.
+ */
 export const assignSpinPrizeHandler = async (input, ctx) => {
     const result = await runAssignSpinPrize(input, ctx);
-    if (result.reason === "event_not_found") {
-        throw httpError("Event not found", 404);
-    }
-    if (result.reason === "identity_required") {
-        throw httpError("No user or guest identity provided", 400);
-    }
-    if (result.reason === "login_required") {
-        throw httpError("You must be logged in to spin this wheel", 401);
-    }
-    if (result.reason === "outside_spin_window") {
-        throw httpError("This spin wheel is not open right now", 403);
-    }
-    if (result.reason === "no_prizes_configured") {
-        throw httpError("No spin prizes configured for this event", 422);
+    // Mirrors the route's own success test: a reason with no prize is a refusal.
+    if (result.reason && !result.spinPrizeId) {
+        const { status, code, message } = reasonToHttp(result.reason);
+        throw httpError(message, status, code);
     }
     return result;
 };