@mohasinac/appkit 4.52.4 → 4.53.0

package/dist/features/events/actions/event-actions.js

@@ -12,11 +12,11 @@ import { eventEntryRepository } from "../repository/event-entry.repository.js";
 import { ERROR_MESSAGES, AuthorizationError, ValidationError, NotFoundError, } from "../../../errors/index.js";
 import { resolveDate } from "../../../utils/index.js";
 import { hashGuestIdentity } from "../../../security/rate-limit.js";
+import { RAFFLE_MAX_ENTRIES_PER_USER } from "../../../_internal/shared/features/events/config.js";
 const ERR_EVENT_NOT_FOUND = "Event not found";
 import { coerceMediaField, getMediaUrl } from "../../../utils/index.js";
 import { finalizeStagedMediaField, finalizeStagedMediaObject, finalizeStagedMediaObjectArray, } from "../../media/finalize.js";
 import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility.js";
-import { maskName } from "../../../security/pii-mask.js";
 // --- Admin: Create Event --------------------------------------------------
 export async function createEvent(adminId, input) {
     const finalizedCoverUrl = await finalizeStagedMediaField(getMediaUrl(input.coverImage) ??
@@ -193,6 +193,11 @@ export async function getEventSpinResults(eventId, limit = 10) {
         return [];
     const prizeTitleById = new Map((event.spinPrizes ?? []).map((p) => [p.id, p.label]));
     const entries = await eventEntryRepository.getRecentSpinResults(event.id, limit);
+    /*
+     * Spin results are shown publicly, so the entrant name is MASKED — and it
+     * has to be masked by `maskedEntry`, which decrypts first. `maskName` on the
+     * stored value answers "Anonymous" for every row by design.
+     */
     return entries.map((entry) => ({
         id: entry.id,
         /*
@@ -211,7 +216,15 @@ export async function getEventSpinResults(eventId, limit = 10) {
          * on for its own label. A caller's OWN spins are served unmasked by
          * `getUserSpinResultsForEvent` — masking is for other people's.
          */
-        userDisplayName: entry.userId ? maskName(entry.userDisplayName) : undefined,
+        /*
+           * `maskedEntry`, not `maskName` on the stored value. `maskName`
+           * refuses ciphertext by design and answers "Anonymous", so this
+           * public list showed every entrant as Anonymous. `maskedEntry`
+           * decrypts first, then masks.
+           */
+        userDisplayName: entry.userId
+            ? eventEntryRepository.maskedEntry(entry).userDisplayName
+            : undefined,
         isGuest: !entry.userId,
         spinPrizeId: entry.spinPrizeId,
         spinPrizeTitle: entry.spinPrizeId ? prizeTitleById.get(entry.spinPrizeId) : undefined,
@@ -238,13 +251,35 @@ export async function getUserSpinResultsForEvent(eventId, userId) {
     const entries = await eventEntryRepository.getUserSpinResults(event.id, userId);
     return entries.map((entry) => ({
         id: entry.id,
-        userDisplayName: entry.userDisplayName,
+        userDisplayName: eventEntryRepository.maskedEntry(entry).userDisplayName,
         isGuest: false,
         spinPrizeId: entry.spinPrizeId,
         spinPrizeTitle: entry.spinPrizeId ? prizeTitleById.get(entry.spinPrizeId) : undefined,
+        // Safe here and ONLY here — `userId` comes from a verified session, so
+        // this is the caller's own prize. The public feed must not carry it.
+        spinPrizeCouponCode: entry.spinPrizeCouponCode ?? undefined,
         spinWonAt: entry.spinWonAt ? new Date(entry.spinWonAt).toISOString() : undefined,
     }));
 }
+/**
+ * Has this signed-in user already entered this event?
+ *
+ * Exists so the participate page can render a raffle's already-entered state on
+ * FIRST PAINT. The form tracked it in `useState(0)`, which a reload reset — so
+ * a returning entrant saw an inviting empty form, submitted, and was refused.
+ * A refusal the page could have predicted is a worse experience than a form
+ * that says so up front.
+ *
+ * Reuses `hasUserEntered` (one `(eventId, userId)` equality pair, an index that
+ * is already proven by `countUserEntries`) rather than counting, because the
+ * limit is one — see `RAFFLE_MAX_ENTRIES_PER_USER`.
+ */
+export async function hasUserEnteredEvent(eventId, userId) {
+    const event = await eventRepository.findByIdOrSlug(eventId);
+    if (!event)
+        return false;
+    return eventEntryRepository.hasUserEntered(event.id, userId);
+}
 /**
  * Per-option vote tally for a poll event — replaces the voter-ranked
  * leaderboard for event.type === "poll", where ranking "who happened to
@@ -398,6 +433,33 @@ export async function enterEvent(eventId, input, user, request) {
             throw new ValidationError(ERROR_MESSAGES.EVENT.ALREADY_ENTERED);
         }
     }
+    /*
+     * 🛑 The same hole, one event type over: a signed-in user could enter the
+     * SAME RAFFLE as many times as they liked, and every entry joined the
+     * winner pool.
+     *
+     * Guests were deduped by hashed IP, surveys enforced `maxEntriesPerUser`,
+     * polls got the guard documented above — and raffle, the one type where a
+     * duplicate entry is a direct and quantifiable unfairness, had none. The
+     * client-side guard was inert in two independent ways: `submissionCount` is
+     * `useState(0)` that is never hydrated from the server, so a reload resets
+     * it; and `maxEntriesPerUser` was not passed to `EventRaffleEntryForm` at
+     * all, so it defaulted to 1 while nothing enforced it.
+     *
+     * The limit is `RAFFLE_MAX_ENTRIES_PER_USER`, shared with the form that
+     * renders "you've used all N entry slots" — there is no raffle config to
+     * consult (`maxEntriesPerUser` lives on `SurveyConfig` only), and two
+     * mirrored literals is how the UI came to claim a limit nothing enforced.
+     *
+     * Reuses the same `countUserEntries` as the survey and poll paths, so the
+     * read cost and the `(eventId, userId)` index it needs are already proven.
+     */
+    if (user && event.type === "raffle") {
+        const priorEntries = await eventEntryRepository.countUserEntries(resolvedEventId, user.uid);
+        if (priorEntries >= RAFFLE_MAX_ENTRIES_PER_USER) {
+            throw new ValidationError(ERROR_MESSAGES.EVENT.ALREADY_ENTERED);
+        }
+    }
     if (event.type === "poll" && event.pollConfig) {
         const validOptionIds = event.pollConfig.options.map((o) => o.id);
         const votes = input.pollVotes ?? [];
@@ -421,8 +483,25 @@ export async function enterEvent(eventId, input, user, request) {
             }
         }
     }
+    /*
+     * 🛑 `raffle` was absent here, and that is what kept the raffle draw broken
+     * even after its pool query was fixed.
+     *
+     * `runTriggerEventRaffle` builds its pool from `reviewStatus == "approved"`.
+     * With raffle missing from this list every live entry was written `pending`,
+     * so a freshly-entered raffle still drew from an empty pool — the fix to the
+     * query alone would have changed nothing a user could see.
+     *
+     * A raffle entry is a name and an optional message. There is no submitted
+     * content to moderate, which is why it belongs with `poll` and `feedback`
+     * rather than behind `survey`'s `entryReviewRequired` opt-in. An admin can
+     * still FLAG an individual entry, and flagging correctly drops it from the
+     * pool — that is the moderation path, not a standing review queue of every
+     * entrant.
+     */
     const autoApprove = event.type === "poll" ||
         event.type === "feedback" ||
+        event.type === "raffle" ||
         (event.type === "survey" &&
             !event.surveyConfig?.entryReviewRequired);
     const reviewStatus = autoApprove ? "approved" : "pending";

package/dist/features/events/api/[id]/route.js

@@ -47,7 +47,7 @@ export async function GET(_request, context) {
             event.pollConfig?.resultsVisibility === "always") {
             const allEntries = await entriesRepo.findAll({
                 filters: `eventId==${id}`,
-                perPage: 1000,
+                pageSize: 1000,
             });
             const voteCounts = {};
             for (const entry of allEntries.data) {
@@ -70,7 +70,7 @@ export async function GET(_request, context) {
                 filters: `eventId==${id},reviewStatus==approved`,
                 sort: "points",
                 order: "desc",
-                perPage: 10,
+                pageSize: 10,
             });
             leaderboard = leaderboardResult.data.map((entry) => {
                 const { userId: _userId, userEmail: _userEmail, ...rest } = entry;

package/dist/features/events/components/AdminEventEditorView.js

@@ -3,11 +3,14 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { normalizeError } from "../../../errors/normalize.js";
 import { useApiMutation } from "@mohasinac/appkit/client";
 import React, { useEffect } from "react";
+import { useTranslations } from "next-intl";
 import { useQuery } from "@tanstack/react-query";
 import { Alert, Button, Div, Grid, Heading, Input, Label, RichTextEditor, Row, Select, Stack, StackedViewShell, TagInput, Text, Textarea, Toggle, } from "../../../ui/index.js";
 import { FormShellContext, useFormShellState, applyZodIssues, FormErrorSummary } from "../../../ui/forms/index.js";
 import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 import { ALL_EVENT_TYPES, EVENT_TYPE_LABELS } from "../types/index.js";
 import { SectionForm, useSectionFormNav } from "../../shell/index.js";
 import { eventDraftSchema } from "../schemas/event-form.js";
@@ -214,13 +217,16 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
     const [slugManual, setSlugManual] = React.useState(false);
     const [saveMessage, setSaveMessage] = React.useState(null);
     const [triggerMessage, setTriggerMessage] = React.useState(null);
+    // Root translator (no namespace) — `toUserMessage` passes fully-qualified
+    // `errors.codes.*` keys and resolves them itself. Same precedent as
+    // `PlaceBidFormClient` and `SpinWheelView`.
+    const t = useTranslations();
     const [raffleWinnerName, setRaffleWinnerName] = React.useState("");
     const [raffleEntryCount, setRaffleEntryCount] = React.useState(null);
     const [raffleGithubUrl, setRaffleGithubUrl] = React.useState("");
     const { shellCtx, setFieldError, validate } = useFormShellState(eventDraftSchema);
     useEffect(() => {
         validate(draft);
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [draft, validate]);
     const update = React.useCallback((partial) => {
         setDraft((prev) => ({ ...prev, ...partial }));
@@ -338,7 +344,20 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
                 setRaffleEntryCount(data.raffleEntryCount);
         },
         onError: (err) => {
-            setTriggerMessage(err instanceof Error ? err.message : "Trigger failed");
+            /*
+             * 🛑 `err.message` was printed straight into the panel — the shape Root
+             * Cause #86 is about, and the ternary was inverted besides: the authored
+             * sentence only showed when the value was NOT an Error, i.e. almost
+             * never, so the normal case rendered raw server text to an admin.
+             *
+             * The route now returns a stable `code` for every refusal, so the copy
+             * resolves through `errors.codes.*`. The one that matters is
+             * `RAFFLE_ALREADY_DRAWN` — "a winner has already been drawn" is a
+             * completely different instruction from the old generic failure, and it
+             * is what a second click gets now that the draw is transactional.
+             */
+            const e = normalizeError(err);
+            setTriggerMessage(toUserMessage(e.code, t, { fallback: "Could not draw a winner." }));
         },
     });
     const isLoading = saveMutation.isPending || eventQuery.isLoading;
@@ -392,7 +411,7 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
                 const isRaffleType = values.type === "raffle" || values.type === "spin_wheel";
                 const showRaffleConfig = isRaffleType || values.hasRaffle;
                 const isSpinMode = values.type === "spin_wheel" || values.raffleType === "spin_wheel";
-                return (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Raffle & Spin Wheel" }), !isRaffleType && (_jsx(Toggle, { checked: values.hasRaffle, onChange: (v) => onChange({ hasRaffle: v }), label: "Attach a raffle to this event" })), !isRaffleType && !values.hasRaffle && (_jsx(Text, { size: "sm", color: "muted", children: "Enable the toggle above to attach a raffle draw to this event. Not applicable for this event type by default." })), showRaffleConfig && (_jsxs(Stack, { gap: "md", rounded: "xl", border: "default", padding: "md", children: [_jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(Select, { label: "Raffle type", value: values.type === "spin_wheel" ? "spin_wheel" : values.raffleType, options: RAFFLE_TYPE_OPTIONS, onChange: (e) => onChange({ raffleType: e.target.value }), disabled: values.type === "spin_wheel" }), _jsx(Input, { label: "Top N (for top-N raffle types)", type: "number", value: values.raffleTopN, onChange: (e) => onChange({ raffleTopN: e.target.value }), placeholder: "10" })] }), _jsx(Input, { label: "Prize description", value: values.rafflePrize, onChange: (e) => onChange({ rafflePrize: e.target.value }), placeholder: "\u20B92,000 store credit + exclusive Pikachu sticker" }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Coupon for winner (optional)" }), _jsx(CouponInlineSelect, { scope: "admin", value: values.rafflePrizeCouponId, onChange: (id) => onChange({ rafflePrizeCouponId: id ?? "" }), placeholder: "Search coupons\u2026", allowCreate: false })] }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Prize products (optional)" }), _jsx(ProductInlineSelect, { scope: "admin", multiple: true, value: values.rafflePrizeProductIds, onChange: (ids) => onChange({ rafflePrizeProductIds: ids }), placeholder: "Search products to feature as prizes\u2026" }), _jsx(Text, { size: "xs", color: "muted", className: "mt-1", children: "Products shown to winners or displayed as the prize showcase." })] }), isSpinMode && _jsx(SpinPrizesEditor, { values: values, onChange: onChange }), isEdit && (_jsxs(Stack, { gap: "xs", rounded: "lg", padding: "sm", className: CLS_RAFFLE_PANEL, children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", className: CLS_RAFFLE_HEADING, children: raffleWinnerName ? `Winner: ${raffleWinnerName}` : "Raffle not yet triggered" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", onClick: () => triggerRaffleMutation.mutate(), disabled: triggerRaffleMutation.isPending || Boolean(raffleWinnerName), children: triggerRaffleMutation.isPending ? "Triggering…" : raffleWinnerName ? "Already triggered" : "Trigger Raffle Now" })] }), raffleEntryCount !== null && _jsxs(Text, { size: "xs", className: CLS_RAFFLE_BODY, children: ["Pool size: ", raffleEntryCount] }), raffleGithubUrl && _jsxs(Text, { size: "xs", className: `break-all ${CLS_RAFFLE_BODY}`, children: ["Fairness proof: ", raffleGithubUrl] }), triggerMessage && _jsx(Text, { size: "xs", className: CLS_RAFFLE_HEADING, children: triggerMessage })] }))] }))] }));
+                return (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Raffle & Spin Wheel" }), !isRaffleType && (_jsx(Toggle, { checked: values.hasRaffle, onChange: (v) => onChange({ hasRaffle: v }), label: "Attach a raffle to this event" })), !isRaffleType && !values.hasRaffle && (_jsx(Text, { size: "sm", color: "muted", children: "Enable the toggle above to attach a raffle draw to this event. Not applicable for this event type by default." })), showRaffleConfig && (_jsxs(Stack, { gap: "md", rounded: "xl", border: "default", padding: "md", children: [_jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(Select, { label: "Raffle type", value: values.type === "spin_wheel" ? "spin_wheel" : values.raffleType, options: RAFFLE_TYPE_OPTIONS, onChange: (e) => onChange({ raffleType: e.target.value }), disabled: values.type === "spin_wheel" }), _jsx(Input, { label: "Top N (for top-N raffle types)", type: "number", value: values.raffleTopN, onChange: (e) => onChange({ raffleTopN: e.target.value }), placeholder: "10" })] }), _jsx(Input, { label: "Prize description", value: values.rafflePrize, onChange: (e) => onChange({ rafflePrize: e.target.value }), placeholder: "\u20B92,000 store credit + exclusive Pikachu sticker" }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Coupon for winner (optional)" }), _jsx(CouponInlineSelect, { scope: "admin", value: values.rafflePrizeCouponId, onChange: (id) => onChange({ rafflePrizeCouponId: id ?? "" }), placeholder: "Search coupons\u2026", allowCreate: false })] }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Prize products (optional)" }), _jsx(ProductInlineSelect, { scope: "admin", multiple: true, value: values.rafflePrizeProductIds, onChange: (ids) => onChange({ rafflePrizeProductIds: ids }), placeholder: "Search products to feature as prizes\u2026" }), _jsx(Text, { size: "xs", color: "muted", className: "mt-1", children: "Products shown to winners or displayed as the prize showcase." })] }), isSpinMode && _jsx(SpinPrizesEditor, { values: values, onChange: onChange }), isEdit && (_jsxs(Stack, { gap: "xs", rounded: "lg", padding: "sm", className: CLS_RAFFLE_PANEL, children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", className: CLS_RAFFLE_HEADING, children: raffleWinnerName ? `Winner: ${raffleWinnerName}` : "Raffle not yet triggered" }), _jsx(Button, { type: "button", action: ACTIONS.EVENT["draw-raffle-winner"], size: "sm", onClick: () => triggerRaffleMutation.mutate(), disabled: triggerRaffleMutation.isPending || Boolean(raffleWinnerName), children: triggerRaffleMutation.isPending ? "Triggering…" : raffleWinnerName ? "Already triggered" : "Trigger Raffle Now" })] }), raffleEntryCount !== null && _jsxs(Text, { size: "xs", className: CLS_RAFFLE_BODY, children: ["Pool size: ", raffleEntryCount] }), raffleGithubUrl && _jsxs(Text, { size: "xs", className: `break-all ${CLS_RAFFLE_BODY}`, children: ["Fairness proof: ", raffleGithubUrl] }), triggerMessage && _jsx(Text, { size: "xs", className: CLS_RAFFLE_HEADING, children: triggerMessage })] }))] }))] }));
             },
         },
     ];

package/dist/features/events/components/AdminEventsView.js

@@ -10,7 +10,8 @@ import { ALL_EVENT_TYPES, EVENT_TYPE_LABELS } from "../types/index.js";
 import { toRecordArray, toRelativeDate, toStringValue, } from "../../admin/hooks/useAdminListingData.js";
 import { DataListingView } from "../../admin/components/DataListingView.js";
 import { AdminEventEditorView } from "./AdminEventEditorView.js";
-import { ADMIN_BULK_ACTIONS, ROW_ACTION_META } from "../../products/constants/action-defs.js";
+import { ADMIN_BULK_ACTIONS, ROW_ACTION_ID, ROW_ACTION_META } from "../../products/constants/action-defs.js";
+import { apiClient } from "../../../http/index.js";
 /**
  * Derived from the `EventType` union (2026-08-24).
  *
@@ -74,13 +75,36 @@ export function AdminEventsView({ children, ...props }) {
             label: "Add Event",
             onClick: ({ openCreatePanel }) => openCreatePanel(),
         },
-        // Rule #7: bulk-action array sourced from the ADMIN_BULK_ACTIONS preset.
-        buildBulkActions: (selection) => ADMIN_BULK_ACTIONS.events.map((id) => ({
-            id,
-            label: ROW_ACTION_META[id].label,
-            destructive: ROW_ACTION_META[id].destructive,
-            onClick: () => selection.clearSelection(),
-        })),
+        /*
+         * Rule #7: bulk-action array sourced from the ADMIN_BULK_ACTIONS preset.
+         *
+         * 🛑 This used to map every preset id to `onClick: () => clearSelection()`
+         * — so the bulk bar rendered a red "Delete" that selected rows, asked
+         * nothing, deleted nothing, and then cleared the checkboxes, which reads
+         * exactly like a successful delete until the list refreshes. A destructive
+         * control that silently no-ops is worse than an absent one (Rule #8).
+         *
+         * Wired self-contained against `DELETE /api/admin/events/[id]`, following
+         * `AdminBundlesView`; the `.filter` keeps `AdminFaqsView`'s discipline that
+         * an unwired preset id is OMITTED rather than shown inert, so the next id
+         * added to the preset cannot reintroduce this.
+         */
+        buildBulkActions: (selection) => {
+            const handlers = {
+                [ROW_ACTION_ID.DELETE]: async () => {
+                    await Promise.all(selection.selectedIds.map((id) => apiClient.delete(ADMIN_ENDPOINTS.EVENT_BY_ID(id))));
+                    selection.clearSelection();
+                },
+            };
+            return ADMIN_BULK_ACTIONS.events
+                .filter((id) => handlers[id])
+                .map((id) => ({
+                id,
+                label: ROW_ACTION_META[id].label,
+                destructive: ROW_ACTION_META[id].destructive,
+                onClick: handlers[id],
+            }));
+        },
         renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsxs(_Fragment, { children: [_jsx(FilterChipGroup, { label: "Status", tabs: ADMIN_EVENT_STATUS_TABS, value: pendingFilters.status ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, status: id })) }), _jsx(FilterChipGroup, { label: "Type", tabs: TYPE_OPTIONS, value: pendingFilters.type ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, type: id })) })] })),
         renderEditor: ({ editId, closePanel }) => (_jsx(AdminEventEditorView, { eventId: editId ?? undefined, onSaved: closePanel, embedded: true })),
         resolveEditorTitle: ({ isCreate }) => (isCreate ? "Add Event" : "Edit Event"),

package/dist/features/events/components/EventRafflesSection.d.ts

@@ -4,6 +4,39 @@ export interface EventRafflesSectionProps {
 }
 /**
  * Renders a live-raffle/spin-wheel strip on the homepage.
- * W1-38 (2026-05-23): fetches events with hasRaffle=true and renders the EventCard grid.
+ *
+ * ## It was showing the wrong events, and nothing could tell
+ *
+ * The filter was `hasRaffle == "true"` — and **`hasRaffle` is not in
+ * `EventRepository.SIEVE_FIELDS`**. `sieve.ts` sets `throwExceptions: false`,
+ * so an unallowlisted field does not raise: `findField` returns undefined and
+ * the clause is **silently discarded** (Root Cause #62, EMITTED_BUT_UNFILTERABLE).
+ *
+ * So this did not return zero rows and it did not disappear. It ran
+ * `status == active` sorted `-startsAt` and rendered **the six most
+ * recently-started active events of ANY type** — sales, polls, feedback forms —
+ * under a heading reading "Live Raffles & Spin Wheels". Every card was a real,
+ * live event, which is exactly why it never looked broken.
+ *
+ * ## Why `type`, and why one query
+ *
+ * `config.raffleType` is already `"raffle" | "spin_wheel" | "all"` — the config
+ * has always spoken the `type` vocabulary and already answers "both belong
+ * here", so the title is truthful and `type` is the honest field to match.
+ * `type` IS in `SIEVE_FIELDS` and is indexed `(type, status, startsAt DESC)`,
+ * so this needs no new composite index.
+ *
+ * 🛑 The `"all"` case is a PIPE-joined value, not `sieveMultiEq`. Sieve parses
+ * `type==a|b` as one OR-group, and the Firebase adapter upgrades a same-field
+ * OR-group of equalities into a single Firestore `in` query. `sieveMultiEq`
+ * comma-joins instead, and a comma is an AND: `type==raffle,type==spin_wheel`
+ * is two equalities on one field, which no document can satisfy (Root
+ * Cause #59).
+ *
+ * Accepted limitation, deliberately: `hasRaffle` is an optional bolt-on that
+ * *could* sit on a `sale` event, and such an event would not appear here. No
+ * seeded event is shaped that way — all three `hasRaffle: true` rows are
+ * already `type: "raffle"` — and a sale with a side raffle belongs in the sale
+ * strip. If that changes, the fix is a second clause, not a wider title.
  */
 export declare function EventRafflesSection({ config, }: EventRafflesSectionProps): Promise<import("react").JSX.Element | null>;

package/dist/features/events/components/EventRafflesSection.js

@@ -12,18 +12,67 @@ import { Container, Grid, Heading, Section, Stack, Text } from "../../../ui/inde
 import { eventRepository } from "../repository/events.repository.js";
 import { EventCard } from "./EventCard.js";
 import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility.js";
+import { EVENT_FIELDS } from "../../../constants/field-names.js";
+/*
+ * `config.raffleType`'s two concrete values happen to equal the two
+ * `EventType` members this strip spans. Sourced from `EVENT_FIELDS.TYPE_VALUES`
+ * rather than written as literals so a rename of either type is a compile
+ * error here instead of a clause that matches nothing.
+ */
+const EVENT_TYPE_RAFFLE = EVENT_FIELDS.TYPE_VALUES.RAFFLE;
+const EVENT_TYPE_SPIN_WHEEL = EVENT_FIELDS.TYPE_VALUES.SPIN_WHEEL;
 /**
  * Renders a live-raffle/spin-wheel strip on the homepage.
- * W1-38 (2026-05-23): fetches events with hasRaffle=true and renders the EventCard grid.
+ *
+ * ## It was showing the wrong events, and nothing could tell
+ *
+ * The filter was `hasRaffle == "true"` — and **`hasRaffle` is not in
+ * `EventRepository.SIEVE_FIELDS`**. `sieve.ts` sets `throwExceptions: false`,
+ * so an unallowlisted field does not raise: `findField` returns undefined and
+ * the clause is **silently discarded** (Root Cause #62, EMITTED_BUT_UNFILTERABLE).
+ *
+ * So this did not return zero rows and it did not disappear. It ran
+ * `status == active` sorted `-startsAt` and rendered **the six most
+ * recently-started active events of ANY type** — sales, polls, feedback forms —
+ * under a heading reading "Live Raffles & Spin Wheels". Every card was a real,
+ * live event, which is exactly why it never looked broken.
+ *
+ * ## Why `type`, and why one query
+ *
+ * `config.raffleType` is already `"raffle" | "spin_wheel" | "all"` — the config
+ * has always spoken the `type` vocabulary and already answers "both belong
+ * here", so the title is truthful and `type` is the honest field to match.
+ * `type` IS in `SIEVE_FIELDS` and is indexed `(type, status, startsAt DESC)`,
+ * so this needs no new composite index.
+ *
+ * 🛑 The `"all"` case is a PIPE-joined value, not `sieveMultiEq`. Sieve parses
+ * `type==a|b` as one OR-group, and the Firebase adapter upgrades a same-field
+ * OR-group of equalities into a single Firestore `in` query. `sieveMultiEq`
+ * comma-joins instead, and a comma is an AND: `type==raffle,type==spin_wheel`
+ * is two equalities on one field, which no document can satisfy (Root
+ * Cause #59).
+ *
+ * Accepted limitation, deliberately: `hasRaffle` is an optional bolt-on that
+ * *could* sit on a `sale` event, and such an event would not appear here. No
+ * seeded event is shaped that way — all three `hasRaffle: true` rows are
+ * already `type: "raffle"` — and a sale with a side raffle belongs in the sale
+ * strip. If that changes, the fix is a second clause, not a wider title.
  */
 export async function EventRafflesSection({ config, }) {
     const title = config.title ?? "Live Raffles & Spin Wheels";
     const subtitle = config.subtitle ?? "Participate in community events and win prizes";
-    const limit = 6;
+    // `maxItems` was declared in the config, set by the seed, and ignored here in
+    // favour of a hardcoded 6 (`audit-homepage-config-coverage` passed only
+    // because the component *mentions* `config`).
+    const limit = config.maxItems && config.maxItems > 0 ? config.maxItems : 6;
+    const raffleType = config.raffleType ?? "all";
+    const typeClause = raffleType === "all"
+        ? sieveFilter(EVENT_FIELDS.TYPE, SIEVE_OP.EQ, `${EVENT_TYPE_RAFFLE}|${EVENT_TYPE_SPIN_WHEEL}`)
+        : sieveFilter(EVENT_FIELDS.TYPE, SIEVE_OP.EQ, raffleType);
     let events = [];
     try {
         const result = await eventRepository.list({
-            filters: sieveAnd(sieveFilter("hasRaffle", SIEVE_OP.EQ, "true"), sieveFilter("status", SIEVE_OP.EQ, "active")),
+            filters: sieveAnd(typeClause, sieveFilter(EVENT_FIELDS.STATUS, SIEVE_OP.EQ, EVENT_FIELDS.STATUS_VALUES.ACTIVE)),
             sorts: sortBy("startsAt", "DESC"),
             pageSize: limit,
         });

package/dist/features/events/components/SpinWheelView.d.ts

@@ -1,7 +1,7 @@
-import type { SpinPrize } from "../types";
+import type { DisplaySpinPrize } from "../types";
 export interface SpinWheelViewProps {
     eventId: string;
-    prizes: SpinPrize[];
+    prizes: DisplaySpinPrize[];
     alreadyUsed?: boolean;
     initialPrizeId?: string;
     initialCouponCode?: string;

package/dist/features/events/components/SpinWheelView.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useCallback, useMemo, useState } from "react";
+import { useTranslations } from "next-intl";
 import { Button, ClaimCouponButton, Div, Heading, LoginRequiredModal, Row, Span, Stack, Text, useToast } from "../../../ui/index.js";
 import { isAuthError } from "../../../utils/auth-error.js";
 import { normalizeError } from "../../../errors/normalize.js";
@@ -32,6 +33,10 @@ export function SpinWheelView({ eventId, prizes, alreadyUsed, initialPrizeId, in
     const [error, setError] = useState(null);
     const [showLoginModal, setShowLoginModal] = useState(false);
     const { showToast } = useToast();
+    // Root translator (no namespace) — `toUserMessage` passes fully-qualified
+    // `errors.codes.*` keys and resolves them itself, so a missing key degrades
+    // to generic copy rather than throwing MISSING_MESSAGE at render time.
+    const t = useTranslations();
     const now = Date.now();
     const startMs = windowStart ? new Date(windowStart).getTime() : null;
     const endMs = windowEnd ? new Date(windowEnd).getTime() : null;
@@ -51,6 +56,12 @@ export function SpinWheelView({ eventId, prizes, alreadyUsed, initialPrizeId, in
                     setResultCoupon(result.spinPrizeCouponCode);
                 }
                 else {
+                    /*
+                     * A 2xx with no prize. The server now refuses with a real status and
+                     * code for every reason it knows (`reasonToHttp`), so reaching here
+                     * means the response was shaped unexpectedly rather than refused —
+                     * the generic fallback is the honest answer.
+                     */
                     setError(l.errorFallback);
                 }
             }, ANIMATION_MS);
@@ -62,13 +73,39 @@ export function SpinWheelView({ eventId, prizes, alreadyUsed, initialPrizeId, in
                 setShowLoginModal(true);
             }
             else {
-                setError(l.errorFallback);
-                showToast(toUserMessage(e.code, undefined, { fallback: l.errorFallback }), "error");
+                /*
+                 * 🛑 Show the SERVER'S reason, not one sentence for all of them.
+                 *
+                 * Both lines below used to be `l.errorFallback` — "Spin failed. Please
+                 * try again." — so a closed window, an exhausted per-user cap, a
+                 * misconfigured wheel and a genuine fault were indistinguishable, and
+                 * the retry that sentence invites could never succeed for most of them.
+                 *
+                 * `t` is the ROOT, unnamespaced translator: `toUserMessage` resolves
+                 * absolute `errors.codes.*` keys, which a namespaced translator cannot
+                 * reach. Omitting it (as this did) makes `toUserMessage` return the
+                 * fallback unconditionally — so the per-reason copy existed in
+                 * `messages/en.json` and was unreachable. Same reasoning as
+                 * `PlaceBidFormClient`.
+                 *
+                 * This only resolves because `onSpin` now throws an `ApiError` carrying
+                 * the response's `code` and `status`; while it threw a native `Error`,
+                 * `normalizeError` produced no code and `isAuthError` saw no status, so
+                 * a 401 never opened the login modal either.
+                 */
+                const message = toUserMessage(e.code, t, { fallback: l.errorFallback });
+                setError(message);
+                showToast(message, "error");
             }
         }
-    }, [disabled, eventId, l.errorFallback, onSpin, showToast]);
+    }, [disabled, eventId, l.errorFallback, onSpin, showToast, t]);
+    /*
+     * Looked up in the FULL prize list, not `activePrizes`. A prize deactivated
+     * after somebody won it would otherwise render neither the prize box nor an
+     * error — the win simply vanished from the page.
+     */
     const wonPrize = resultPrizeId
-        ? activePrizes.find((p) => p.id === resultPrizeId)
+        ? prizes.find((p) => p.id === resultPrizeId)
         : undefined;
     return (_jsxs(Stack, { gap: "md", children: [_jsx(LoginRequiredModal, { isOpen: showLoginModal, onClose: () => setShowLoginModal(false), message: "You need to be signed in to spin the wheel. Please log in or create an account to continue." }), _jsxs(Heading, { level: 2, size: "xl", weight: "semibold", color: "primary", children: ["\uD83C\uDFA1 ", l.heading] }), _jsxs(Div, { className: CLS_WHEEL, "aria-label": "Spin wheel", children: [_jsx(Row, { className: "absolute inset-0", align: "center", justify: "center", style: {
                             animation: spinning

package/dist/features/events/repository/event-entry.repository.d.ts

@@ -1,10 +1,22 @@
 import type { FirebaseSieveFields, FirebaseSieveResult, SieveModel } from "../../../providers/db-firebase";
 import { BaseRepository } from "../../../providers/db-firebase";
-import { type EventEntryCreateInput, type EventEntryDocument } from "../schemas";
+import { type EventEntryCreateInput, type EventEntryDocument, type EventEntryPlain } from "../schemas";
 declare class EventEntryRepository extends BaseRepository<EventEntryDocument> {
     static readonly SIEVE_FIELDS: FirebaseSieveFields;
     constructor();
-    protected mapDoc<D = EventEntryDocument>(snap: import("../../../providers/db-firebase").DocumentSnapshot): D;
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealEntry(doc: EventEntryDocument): EventEntryPlain;
+    /** As `revealEntry`, for a list read. */
+    revealEntrys(docs: readonly EventEntryDocument[]): EventEntryPlain[];
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedEntry(doc: EventEntryDocument): EventEntryPlain;
+    /** As `maskedEntry`, for a list read. */
+    maskedEntrys(docs: readonly EventEntryDocument[]): EventEntryPlain[];
     listForEvent(eventId: string, model: SieveModel): Promise<FirebaseSieveResult<EventEntryDocument>>;
     listForUser(userId: string, model: SieveModel): Promise<FirebaseSieveResult<EventEntryDocument>>;
     /**

package/dist/features/events/repository/event-entry.repository.js

@@ -2,7 +2,7 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { serverLogger } from "../../../monitoring/index.js";
 import { BaseRepository, prepareForFirestore, parseSieveDateValue, } from "../../../providers/db-firebase/index.js";
-import { decryptPiiFields, encryptPiiFields, EVENT_ENTRY_PII_FIELDS, } from "../../../security/index.js";
+import { encryptPiiFields, maskPii, revealPii, EVENT_ENTRY_PII_FIELDS, } from "../../../security/index.js";
 import { EVENT_ENTRIES_COLLECTION, EVENT_ENTRY_FIELDS, } from "../schemas/index.js";
 /** Extracted from getExportReport's poll branch to stay under the max nesting depth. */
 function formatPollResultLines(pollOptions, countByOption, total) {
@@ -20,11 +20,38 @@ class EventEntryRepository extends BaseRepository {
     constructor() {
         super(EVENT_ENTRIES_COLLECTION);
     }
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return decryptPiiFields(raw, [
-            ...EVENT_ENTRY_PII_FIELDS,
-        ]);
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `EventEntryDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealEntry(doc) {
+        return revealPii(doc, EVENT_ENTRY_PII_FIELDS);
+    }
+    /** As `revealEntry`, for a list read. */
+    revealEntrys(docs) {
+        return docs.map((d) => this.revealEntry(d));
+    }
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedEntry(doc) {
+        return maskPii(doc, EVENT_ENTRY_PII_FIELDS);
+    }
+    /** As `maskedEntry`, for a list read. */
+    maskedEntrys(docs) {
+        return docs.map((d) => this.maskedEntry(d));
     }
     async listForEvent(eventId, model) {
         return this.sieveQuery(model, EventEntryRepository.SIEVE_FIELDS, {
@@ -150,7 +177,14 @@ class EventEntryRepository extends BaseRepository {
             // Aggregate per user: sum all approved entry points
             const byUser = new Map();
             for (const doc of snapshot.docs) {
-                const raw = decryptPiiFields({ id: doc.id, ...doc.data() }, [...EVENT_ENTRY_PII_FIELDS]);
+                /*
+                 * MASKED, not decrypted. This builds a public LEADERBOARD, so it needs
+                 * a name to show and has no business holding the real one — the rows
+                 * go straight into a response. `maskPii` decrypts and then masks, which
+                 * is required here: `maskName` refuses ciphertext by design, so masking
+                 * the stored value directly would render every competitor "Anonymous".
+                 */
+                const raw = maskPii({ id: doc.id, ...doc.data() }, EVENT_ENTRY_PII_FIELDS);
                 if (!raw.userId)
                     continue;
                 const existing = byUser.get(raw.userId);

package/dist/features/events/schemas/firestore.d.ts

@@ -6,6 +6,7 @@ import type { JsonValue } from "@mohasinac/appkit";
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { EventType, EventStatus, EntryReviewStatus, SaleConfig, OfferConfig, PollConfig, SurveyConfig, FeedbackConfig, RaffleType, SpinPrize } from "../types";
 import type { LotteryConfig } from "../../lottery/types";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export declare const EVENTS_COLLECTION: "events";
 export declare const EVENT_ENTRIES_COLLECTION: "eventEntries";
 export interface EventDocument extends BaseDocument {
@@ -68,12 +69,24 @@ export interface EventDocument extends BaseDocument {
     };
     createdBy: string;
 }
+/**
+ * `EventEntryDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type EventEntryPlain = Plaintext<EventEntryDocument>;
 export type EventEntryDocument = {
     id: string;
     eventId: string;
     userId?: string;
-    userDisplayName?: string;
-    userEmail?: string;
+    createdAt?: Date;
+    updatedAt?: Date;
+    userDisplayName?: Encrypted<string>;
+    userEmail?: Encrypted<string>;
     pollVotes?: string[];
     pollComment?: string;
     formResponses?: Record<string, JsonValue>;
@@ -91,7 +104,7 @@ export type EventEntryDocument = {
     spinPrizeId?: string;
     spinPrizeCouponCode?: string | null;
     spinWonAt?: Date;
-    ipAddress?: string;
+    ipAddress?: Encrypted<string>;
     /**
      * HMAC-SHA256 blind index of a guest (non-logged-in) participant's IP,
      * scoped per event — `hmacBlindIndex(eventId + ":" + rawIp)`. Set only
@@ -182,7 +195,7 @@ export declare const EVENT_ENTRY_FIELDS: {
 };
 export type EventCreateInput = Omit<EventDocument, "id" | "createdAt" | "updatedAt" | "stats">;
 export type EventUpdateInput = Partial<Omit<EventDocument, "id" | "createdAt" | "createdBy">>;
-export type EventEntryCreateInput = Omit<EventEntryDocument, "id" | "submittedAt">;
+export type EventEntryCreateInput = Omit<EventEntryPlain, "id" | "submittedAt">;
 export declare const eventQueryHelpers: {
     readonly active: () => readonly ["status", "==", EventStatus];
     readonly byType: (type: EventType) => readonly ["type", "==", EventType];