@mohasinac/appkit 4.52.5 → 4.53.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.52.5",
-  "head": "7b24e76346651ca12f0a941e0d1ca87bb173a242",
+  "version": "4.53.0",
+  "head": "78e72eb24243b0ee3afea21614fbbadee45d2b51",
   "branch": "main",
-  "dirty": true,
-  "builtAt": "2026-10-16T16:23:26.992Z"
+  "dirty": false,
+  "builtAt": "2026-10-19T12:44:44.499Z"
 }

package/dist/_internal/client/features/sticker-trace/canvas-codec.d.ts

@@ -0,0 +1,2 @@
+import type { ImageCodec } from "../../../shared/features/sticker-trace/codec";
+export declare const canvasCodec: ImageCodec;

package/dist/_internal/client/features/sticker-trace/canvas-codec.js

@@ -0,0 +1,148 @@
+"use client";
+/*
+ * One message, three throw sites. A 2d context is only ever null when the
+ * browser refuses the canvas outright (memory pressure, or a hardened
+ * environment), so all three mean the same thing and should read the same.
+ */
+const NO_CONTEXT = "OffscreenCanvas 2d context unavailable";
+/** RGBA out of a canvas, in exactly the layout DecodedRaster promises. */
+function toRaster(bitmap, dpi) {
+    const canvas = new OffscreenCanvas(bitmap.width, bitmap.height);
+    const ctx = canvas.getContext("2d", { willReadFrequently: true });
+    if (!ctx)
+        throw new Error(NO_CONTEXT);
+    ctx.drawImage(bitmap, 0, 0);
+    const data = ctx.getImageData(0, 0, bitmap.width, bitmap.height).data;
+    bitmap.close();
+    return {
+        width: canvas.width,
+        height: canvas.height,
+        data: new Uint8Array(data.buffer),
+        ...(dpi !== undefined ? { dpi } : {}),
+    };
+}
+async function encode(canvas, format) {
+    const type = format === "webp" ? "image/webp" : "image/png";
+    const blob = await canvas.convertToBlob({ type, ...(format === "webp" ? { quality: 0.82 } : {}) });
+    return { bytes: new Uint8Array(await blob.arrayBuffer()), contentType: type };
+}
+function canvasOf(raster) {
+    const canvas = new OffscreenCanvas(raster.width, raster.height);
+    const ctx = canvas.getContext("2d");
+    if (!ctx)
+        throw new Error(NO_CONTEXT);
+    ctx.putImageData(new ImageData(new Uint8ClampedArray(raster.data), raster.width, raster.height), 0, 0);
+    return canvas;
+}
+export const canvasCodec = {
+    /**
+     * 🛑 `declaredDpi` is ALWAYS absent here, and that is the one real asymmetry
+     * with the sharp codec.
+     *
+     * sharp reads the file's density header; a browser exposes no such API, and
+     * parsing EXIF/pHYs by hand would be a second metadata implementation whose
+     * disagreements with sharp nobody would notice. So the browser reports
+     * dimensions only — which costs nothing, because the operator confirms dpi
+     * anyway (five of the nine reference scans declare 72 or 96, an encoder
+     * default rather than a measurement) and a sheet with no trustworthy dpi
+     * already renders `bboxMm: null` rather than a fabricated figure.
+     *
+     * Also NOT header-only, unlike sharp's: `createImageBitmap` decodes. A
+     * browser cannot read a header without decoding, so this is dimensions at
+     * the cost of a decode — acceptable for one file the user just picked, and
+     * the reason the server probe exists for the upload path.
+     */
+    async probe(source) {
+        const bitmap = await createImageBitmap(new Blob([source]));
+        const result = { width: bitmap.width, height: bitmap.height };
+        bitmap.close();
+        return result;
+    },
+    async decode(source, opts) {
+        const blob = new Blob([source]);
+        // Probe dimensions first so the resize preserves aspect ratio and never
+        // ENLARGES — upscaling would invent sub-pixel detail the ridge detector
+        // would then find cut lines in.
+        const probe = await createImageBitmap(blob);
+        const longEdge = Math.max(probe.width, probe.height);
+        probe.close();
+        if (longEdge <= opts.maxLongEdge) {
+            return toRaster(await createImageBitmap(blob));
+        }
+        const k = opts.maxLongEdge / longEdge;
+        return toRaster(await createImageBitmap(blob, {
+            resizeWidth: Math.max(1, Math.round(probe.width * k)),
+            resizeHeight: Math.max(1, Math.round(probe.height * k)),
+            resizeQuality: "high",
+        }));
+    },
+    /**
+     * No resize — a tile is already bounded by the caller, and the `max` tier
+     * tiles precisely so it can read native pixels.
+     */
+    async decodeTile(source, tile) {
+        return toRaster(await createImageBitmap(new Blob([source]), {
+            sx: tile.x,
+            sy: tile.y,
+            sw: tile.width,
+            sh: tile.height,
+        }));
+    },
+    async encodePng(raster) {
+        return encode(canvasOf(raster), "png");
+    },
+    async encodePngRegion(source, region, alpha) {
+        const expected = region.width * region.height;
+        if (alpha.length !== expected) {
+            // Loud, matching the sharp codec: a silent mismatch yields a part with a
+            // plausible outline and the wrong transparency, invisible until it is cut.
+            throw new Error(`alpha mask is ${alpha.length} px, expected ${expected} for ${region.width}x${region.height}`);
+        }
+        const raster = await this.decodeTile(source, region);
+        const px = raster.data;
+        for (let i = 0; i < expected; i++)
+            px[i * 4 + 3] = alpha[i];
+        return encode(canvasOf({ width: region.width, height: region.height, data: px }), "png");
+    },
+    async encodePreview(source, opts) {
+        const raster = await this.decode(source, { maxLongEdge: opts.maxLongEdge });
+        return encode(canvasOf(raster), opts.format);
+    },
+    /**
+     * Uniform-cell grid, identical in layout to the sharp codec's — the frames
+     * map is a contract the review UI reads, so the two must agree on geometry
+     * even though they agree on nothing about how they draw.
+     */
+    async encodeAtlas(tiles, opts) {
+        if (tiles.length === 0) {
+            // A zero-part run is a real outcome; a valid 1x1 beats throwing.
+            return {
+                image: await encode(new OffscreenCanvas(1, 1), "png"),
+                frames: {},
+            };
+        }
+        const cols = Math.ceil(Math.sqrt(tiles.length));
+        const rows = Math.ceil(tiles.length / cols);
+        const cell = Math.max(1, Math.min(Math.floor(opts.maxLongEdge / cols), ...tiles.map((t) => Math.max(t.raster.width, t.raster.height))));
+        const canvas = new OffscreenCanvas(cols * cell, rows * cell);
+        const ctx = canvas.getContext("2d");
+        if (!ctx)
+            throw new Error(NO_CONTEXT);
+        const frames = {};
+        for (let i = 0; i < tiles.length; i++) {
+            const t = tiles[i];
+            const left = (i % cols) * cell;
+            const top = Math.floor(i / cols) * cell;
+            // `fit: inside` equivalent — preserve aspect, never enlarge.
+            const k = Math.min(cell / t.raster.width, cell / t.raster.height, 1);
+            const w = Math.max(1, Math.round(t.raster.width * k));
+            const h = Math.max(1, Math.round(t.raster.height * k));
+            ctx.drawImage(canvasOf(t.raster), left, top, w, h);
+            // The frame is the tile's ACTUAL size, not the cell: a wide sticker does
+            // not fill a square cell, and a client slicing by `cell` would include
+            // its neighbours' padding.
+            frames[t.ordinal] = { x: left, y: top, width: w, height: h };
+        }
+        return { image: await encode(canvas, "png"), frames };
+    },
+};

package/dist/_internal/server/features/auctions/actions.js

@@ -31,7 +31,7 @@ export async function placeBidAction(input) {
         // marking included. It cost a full-collection query and an exception per
         // bid placed, and the real `setWinningBid(bid.id, …)` below already marks
         // every other bid for this product as outbid.)
-        const bid = await bidRepository.create({
+        const bid = await bidRepository.createBid({
             productId: auctionId,
             productTitle: product.title ?? auctionId,
             userId: user.uid,

package/dist/_internal/server/features/categories/data.js

@@ -63,11 +63,27 @@ export const getCategoryTree = cache(async (rootId) => {
 });
 /** Flat category list for sitemap generation. */
 export const listSitemapCategories = cache(async () => {
-    return categoriesRepository
-        .list({ filters: "isActive==true", sorts: "-updatedAt", page: 1, pageSize: CATEGORIES_SITEMAP_LIMIT })
-        .then((r) => {
-        const docs = r.data ?? [];
-        return docs.map(({ slug, updatedAt }) => ({ slug, updatedAt }));
-    })
-        .catch(() => []);
+    /*
+     * 🛑 `safeRead`, not `.catch(() => [])`. This function feeds the SITEMAP,
+     * so a swallowed Firestore failure publishes an empty category sitemap to
+     * crawlers and nothing anywhere says why — the single worst place in the
+     * app for a failure that reads as "there is no data". Root Cause #81 is
+     * what a quietly wrong sitemap costs.
+     *
+     * The fallback is still `[]` (a sitemap must render), but the degradation
+     * is now a `DEGRADED_READ` row instead of silence. The file already used
+     * `safeRead` a few lines up; this site was simply missed.
+     */
+    const r = await safeRead(() => categoriesRepository.list({
+        filters: "isActive==true",
+        sorts: "-updatedAt",
+        page: 1,
+        pageSize: CATEGORIES_SITEMAP_LIMIT,
+    }), {
+        route: "sitemap",
+        key: "categories.listSitemapCategories",
+        fallback: null,
+    });
+    const docs = r?.data ?? [];
+    return docs.map(({ slug, updatedAt }) => ({ slug, updatedAt }));
 });

package/dist/_internal/server/features/checkout/actions.js

@@ -618,7 +618,7 @@ async function createOrderForGroup(group, orderType, ctx) {
     // create-vs-create axis of Root Cause #39, and these two functions have
     // already drifted once before (add-on fees, Root Cause #65).
     const sourceContext = await buildOrderSourceContext(firstItem, firstProduct, orderType);
-    const order = await unitOfWork.orders.create({
+    const order = await unitOfWork.orders.createOrder({
         productId: firstItem.productId,
         productTitle: firstItem.productTitle,
         userId: uid,
@@ -1478,7 +1478,7 @@ async function createPhonePeGroupOrder(group, orderType, ctx) {
     // create-vs-create axis of Root Cause #39, and these two functions have
     // already drifted once before (add-on fees, Root Cause #65).
     const sourceContext = await buildOrderSourceContext(firstItem, group[0].product, orderType);
-    const order = await unitOfWork.orders.create({
+    const order = await unitOfWork.orders.createOrder({
         productId: firstItem.productId,
         productTitle: firstItem.productTitle,
         userId: uid,
@@ -1654,8 +1654,15 @@ export async function verifyAndPlacePhonePeOrderAction(input) {
     let userEmail = input.userEmail;
     if (userName === undefined || userEmail === undefined) {
         const userDoc = await userRepository.findById(uid);
+        /*
+         * 🛑 Revealed: `createOrder` encrypts `userEmail`, so handing it the
+         * ciphertext this read returns would double-encrypt it and make the
+         * buyer's address on the order undecryptable. `displayName` is not PII and
+         * needs no reveal.
+         */
+        const userPlain = userDoc ? userRepository.revealUser(userDoc) : null;
         userName = userName ?? userDoc?.displayName ?? "Customer";
-        userEmail = userEmail ?? userDoc?.email ?? "";
+        userEmail = userEmail ?? userPlain?.email ?? "";
     }
     const addressId = input.addressId ?? intent?.addressId;
     const notes = input.notes ?? intent?.notes;

package/dist/_internal/server/features/checkout/data.d.ts

@@ -1,4 +1,19 @@
 import type { AddressDocument } from "../../../../features/account/schemas/index";
+/**
+ * Flatten an address into the one-line string stored on
+ * `OrderDocument.shippingAddress` and printed on invoices and labels.
+ *
+ * 🛑 Reveals INSIDE the function, deliberately, rather than asking its two
+ * callers to.
+ *
+ * `AddressDocument` is ciphertext-by-default, and `shippingAddress` is NOT a
+ * PII field — so joining the stored values froze three `enc:v1:` blobs into one
+ * string that is no longer a valid envelope and can never be decrypted. It is
+ * then printed on every invoice, shipping label and order-confirmation email.
+ *
+ * Doing it here rather than at `actions.ts:1279` and `:2506` is the point: a
+ * third caller gets it right by construction instead of by remembering.
+ */
 export declare function formatShippingAddress(a: AddressDocument): string;
 export interface CheckoutOrderResult {
     orderIds: string[];

package/dist/_internal/server/features/checkout/data.js

@@ -1,8 +1,25 @@
+import { ADDRESS_PII_FIELDS, revealPii } from "../../../../security/index.js";
+/**
+ * Flatten an address into the one-line string stored on
+ * `OrderDocument.shippingAddress` and printed on invoices and labels.
+ *
+ * 🛑 Reveals INSIDE the function, deliberately, rather than asking its two
+ * callers to.
+ *
+ * `AddressDocument` is ciphertext-by-default, and `shippingAddress` is NOT a
+ * PII field — so joining the stored values froze three `enc:v1:` blobs into one
+ * string that is no longer a valid envelope and can never be decrypted. It is
+ * then printed on every invoice, shipping label and order-confirmation email.
+ *
+ * Doing it here rather than at `actions.ts:1279` and `:2506` is the point: a
+ * third caller gets it right by construction instead of by remembering.
+ */
 export function formatShippingAddress(a) {
+    const plain = revealPii(a, ADDRESS_PII_FIELDS);
     const parts = [
-        a.fullName,
-        a.addressLine1,
-        a.addressLine2,
+        plain.fullName,
+        plain.addressLine1,
+        plain.addressLine2,
         a.landmark,
         a.city,
         a.state,

package/dist/_internal/server/features/lottery/actions.js

@@ -117,7 +117,15 @@ export async function submitLotteryPullAction(input) {
             });
             return { assignedSlot: chosen, userLotteryNumber: nextNumber };
         });
-        // Create the entry document outside the transaction (acceptable — slot is already booked)
+        /*
+         * Create the entry document outside the transaction (acceptable — slot is
+         * already booked).
+         *
+         * Typed `LotteryEntryPlain`: this is PLAINTEXT from the session and the
+         * request body, and `createEntry` encrypts it. The document type now says
+         * `Encrypted<string>`, so annotating this `LotteryEntryDocument` is a
+         * compile error — correctly, because the values here are not ciphertext.
+         */
         const entryData = {
             sourceType: data.sourceType,
             ...(data.sourceType === "event" ? { eventId: sourceId } : { productId: sourceId }),

package/dist/_internal/server/features/lottery/og.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Lottery OG image renderer.
+ *
+ * ## Why this did not exist
+ *
+ * `lottery/[id]` was the single entry in `verify-og-coverage`'s
+ * `OG_KNOWN_GAPS` — the one public dynamic detail page shipping without an
+ * `opengraph-image.tsx`, carried as a baseline since 2026-05-23 with the note
+ * "OG image follows in a follow-up". Metadata already resolved
+ * (`buildLotteryMetadata`), so a shared link rendered a title and whatever the
+ * event's cover image happened to be, with none of the branded card every
+ * other listing type gets.
+ *
+ * ## 🛑 No money, and no per-slot prices
+ *
+ * An OG image is a public image URL with its contents burned into the pixels:
+ * no sign-in gate reaches it and no paywall markup describes it, which is why
+ * all eight money-bearing renderers were stripped (Root Cause #93). A lottery
+ * is the sharpest case in the codebase — `toClientLotteryConfig` is an
+ * allow-list that exists specifically to keep `price` and `weight` off every
+ * slot — so this renderer takes the CLIENT shape and reads only what that
+ * allow-list already permits: the slot count, and how many are still free.
+ *
+ * "6 of 200 slots left" is a fact about availability rather than a disclosed
+ * amount, and it is the half of the card that earns the click — exactly the
+ * line `renderPrizeDrawOg` draws for "Free entry".
+ */
+import type { ReactElement } from "react";
+import type { LotteryEventClient } from "./data";
+export interface LotteryOgData {
+    title: string;
+    imageUrl?: string | null;
+    slotsLabel?: string | null;
+    statusLabel?: string | null;
+}
+export declare function renderLotteryOg(event: LotteryEventClient | null | undefined, opts: {
+    siteName: string;
+    baseUrl?: string;
+}): ReactElement;
+export declare function renderLotteryOgImage(data: LotteryOgData, siteName: string): ReactElement;

package/dist/_internal/server/features/lottery/og.js

@@ -0,0 +1,79 @@
+/**
+ * Lottery OG image renderer.
+ *
+ * ## Why this did not exist
+ *
+ * `lottery/[id]` was the single entry in `verify-og-coverage`'s
+ * `OG_KNOWN_GAPS` — the one public dynamic detail page shipping without an
+ * `opengraph-image.tsx`, carried as a baseline since 2026-05-23 with the note
+ * "OG image follows in a follow-up". Metadata already resolved
+ * (`buildLotteryMetadata`), so a shared link rendered a title and whatever the
+ * event's cover image happened to be, with none of the branded card every
+ * other listing type gets.
+ *
+ * ## 🛑 No money, and no per-slot prices
+ *
+ * An OG image is a public image URL with its contents burned into the pixels:
+ * no sign-in gate reaches it and no paywall markup describes it, which is why
+ * all eight money-bearing renderers were stripped (Root Cause #93). A lottery
+ * is the sharpest case in the codebase — `toClientLotteryConfig` is an
+ * allow-list that exists specifically to keep `price` and `weight` off every
+ * slot — so this renderer takes the CLIENT shape and reads only what that
+ * allow-list already permits: the slot count, and how many are still free.
+ *
+ * "6 of 200 slots left" is a fact about availability rather than a disclosed
+ * amount, and it is the half of the card that earns the click — exactly the
+ * line `renderPrizeDrawOg` draws for "Free entry".
+ */
+import { renderOgLayout } from "../seo/og-layout.js";
+import { resolveOgImageUrl } from "../seo/og.js";
+/**
+ * The event's own status, as a human badge. `active` is deliberately absent:
+ * a live lottery is the default case, so a chip saying so costs a badge slot
+ * and tells the reader nothing they would not assume.
+ */
+const STATUS_BADGE_TEXT = {
+    draft: "Not yet open",
+    paused: "Paused",
+    ended: "Closed",
+    cancelled: "Cancelled",
+};
+export function renderLotteryOg(event, opts) {
+    const cfg = event?.lotteryConfig;
+    const slots = cfg?.slots ?? [];
+    /*
+     * Counted from the slot array rather than read from `totalSlots`, which is
+     * the mirror the admin write path derives FROM `slots.length` — and a mirror
+     * is the field most likely to disagree (Root Cause #42). The array is here
+     * either way, so counting it costs nothing.
+     */
+    const total = slots.length;
+    const free = slots.filter((s) => !s.isBooked).length;
+    const slotsLabel = total > 0
+        ? free > 0
+            ? `${free.toLocaleString("en-IN")} of ${total.toLocaleString("en-IN")} slots left`
+            : `All ${total.toLocaleString("en-IN")} slots claimed`
+        : null;
+    const coverUrl = event?.coverImage && typeof event.coverImage.url === "string"
+        ? event.coverImage.url
+        : (event?.coverImageUrl ?? null);
+    return renderLotteryOgImage({
+        title: event?.title ?? "Lottery",
+        imageUrl: resolveOgImageUrl(coverUrl, opts.baseUrl),
+        slotsLabel,
+        statusLabel: event?.status ? (STATUS_BADGE_TEXT[event.status] ?? null) : null,
+    }, opts.siteName);
+}
+export function renderLotteryOgImage(data, siteName) {
+    const badges = [data.statusLabel].filter((s) => Boolean(s));
+    return renderOgLayout({
+        title: data.title,
+        subtitle: data.slotsLabel ?? undefined,
+        imageUrl: data.imageUrl,
+        siteName: `${siteName} · Lottery`,
+        badges: badges.length > 0 ? badges : undefined,
+        // Violet, distinct from the prize-draw amber beside it in the nav — the two
+        // are different products and a shared accent makes shared links ambiguous.
+        theme: { accentColor: "#8b5cf6" },
+    });
+}

package/dist/_internal/server/features/messages/actions.js

@@ -12,6 +12,7 @@ import { createMessage, listMessages, softDeleteMessage, deleteAllMessages, list
 import { finalizeStagedMediaArray } from "../../../../features/media/finalize.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
+import { normalizeListingType } from "../../../../features/products/utils/listing-type.js";
 import { siteSettingsRepository } from "../../../../repositories/index.js";
 const MESSAGE_MAX_LENGTH = 2000;
 /**
@@ -161,6 +162,9 @@ export async function sendMessage(input) {
                 title: product.title,
                 image: product.images?.[0],
                 price: product.price,
+                // Without this the card cannot pick the right detail route — see the
+                // field's own comment on `MessageProductRef`.
+                listingType: normalizeListingType(product),
             };
         }
         // A missing/deleted product is not an error — the card simply doesn't

package/dist/_internal/server/features/offers/adapters.js

@@ -12,7 +12,7 @@
  */
 // Display masking only — `pii-mask.ts` is the crypto-FREE half that Root Cause
 // #24 split out of `pii-encrypt.ts` precisely so it could be imported freely.
-import { maskEmail, maskName } from "../../../../security/pii-mask.js";
+import { offerRepository } from "../../../../features/seller/repository/offer.repository.js";
 function toIsoOrUndefined(value) {
     return value instanceof Date ? value.toISOString() : undefined;
 }
@@ -21,11 +21,25 @@ function toIso(value) {
 }
 /** The three buyer keys, resolved per `buyerIdentity`. Absent keys stay absent. */
 function buyerIdentityFields(doc, mode) {
+    /*
+     * 🛑 Both branches go through the repository's named accessors.
+     *
+     * `OfferRepository.mapDoc` no longer decrypts, so `doc.buyerName` and
+     * `doc.buyerEmail` are CIPHERTEXT here. Before this, `"full"` returned the
+     * `enc:v1:` blobs straight to the seller, and `"masked"` handed them to
+     * `maskName`/`maskEmail`, which refuse ciphertext by design and answer
+     * "Anonymous" / "***@***.***" — so neither mode worked, in opposite ways.
+     *
+     * `"full"` is the seller's own view of a buyer who made them an offer, which
+     * is a legitimate plaintext read; `"masked"` is everything else.
+     */
     if (mode === "full") {
-        return { buyerUid: doc.buyerUid, buyerName: doc.buyerName, buyerEmail: doc.buyerEmail };
+        const plain = offerRepository.revealOffer(doc);
+        return { buyerUid: doc.buyerUid, buyerName: plain.buyerName, buyerEmail: plain.buyerEmail };
     }
     if (mode === "masked") {
-        return { buyerName: maskName(doc.buyerName), buyerEmail: maskEmail(doc.buyerEmail) };
+        const masked = offerRepository.maskedOffer(doc);
+        return { buyerName: masked.buyerName, buyerEmail: masked.buyerEmail };
     }
     return {};
 }

package/dist/_internal/server/features/orders/actions.js

@@ -22,7 +22,7 @@ export async function createOrderAction(input) {
         const parsed = createOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid order input");
-        return orderRepository.create({
+        return orderRepository.createOrder({
             ...parsed.data,
             userId: user.uid,
             status: "pending",
@@ -211,7 +211,12 @@ export async function attachPaymentProofAction(orderId, proof) {
         });
         notifyAdminsOfPaymentProof({
             id: orderId,
-            userName: order.userName,
+            /*
+             * Revealed: this names the buyer to an admin who is about to verify
+             * their payment proof, so a mask would defeat the purpose. `order` comes
+             * from a repository read, which is ciphertext-by-default.
+             */
+            userName: orderRepository.revealOrder(order).userName,
             productTitle: order.productTitle,
             totalPrice: order.totalPrice,
         });

package/dist/_internal/server/features/raffle/actions.d.ts

@@ -10,3 +10,22 @@ import { type TriggerEventRaffleInput, type TriggerEventRaffleResult } from "../
 import { type AssignSpinPrizeInput, type AssignSpinPrizeResult } from "../../jobs/core/assignSpinPrize";
 export declare function triggerEventRaffleAction(input: TriggerEventRaffleInput): Promise<ActionResult<TriggerEventRaffleResult>>;
 export declare function assignSpinPrizeAction(input: AssignSpinPrizeInput): Promise<ActionResult<AssignSpinPrizeResult>>;
+/**
+ * Resolve a slug-or-id to the canonical event DOCUMENT ID.
+ *
+ * Exists for one caller — `POST /api/events/[id]/spin`, which must hash a
+ * guest's identity against a stable key BEFORE calling the spin action.
+ *
+ * 🛑 Why this is not just a nicety. Public URLs link by slug, so the route
+ * received a slug and did `hashGuestIdentity(slug, request)`, while
+ * `enterEvent` hashes on the resolved doc id. Two identities for one guest on
+ * one event. While the spin core's lookup was broken that was invisible (every
+ * spin 404'd); the moment the lookup was fixed it would have become a silent
+ * `spinMaxPerUser` bypass — exhaust your spins on `/events/<slug>/participate`
+ * and get a fresh allowance on `/events/<docId>/participate`.
+ *
+ * Returns `null` for an unknown event; the route then lets the spin action
+ * produce the single authoritative `event_not_found` rather than guessing at
+ * one here.
+ */
+export declare function resolveEventIdAction(idOrSlug: string): Promise<ActionResult<string | null>>;

package/dist/_internal/server/features/raffle/actions.js

@@ -10,6 +10,7 @@ import { wrapAction } from "@mohasinac/appkit/server";
 import { getAdminDb } from "../../../../providers/db-firebase/admin.js";
 import { runTriggerEventRaffle, } from "../../jobs/core/triggerEventRaffle.js";
 import { runAssignSpinPrize, } from "../../jobs/core/assignSpinPrize.js";
+import { resolveEventRef } from "../../jobs/core/_event-ref.js";
 function buildContext(job) {
     const logger = {
         info: (msg, meta) => console.info(`[${job}] ${msg}`, meta ?? {}),
@@ -30,3 +31,27 @@ export async function triggerEventRaffleAction(input) {
 export async function assignSpinPrizeAction(input) {
     return wrapAction(async () => runAssignSpinPrize(input, buildContext("user.assignSpinPrize")));
 }
+/**
+ * Resolve a slug-or-id to the canonical event DOCUMENT ID.
+ *
+ * Exists for one caller — `POST /api/events/[id]/spin`, which must hash a
+ * guest's identity against a stable key BEFORE calling the spin action.
+ *
+ * 🛑 Why this is not just a nicety. Public URLs link by slug, so the route
+ * received a slug and did `hashGuestIdentity(slug, request)`, while
+ * `enterEvent` hashes on the resolved doc id. Two identities for one guest on
+ * one event. While the spin core's lookup was broken that was invisible (every
+ * spin 404'd); the moment the lookup was fixed it would have become a silent
+ * `spinMaxPerUser` bypass — exhaust your spins on `/events/<slug>/participate`
+ * and get a fresh allowance on `/events/<docId>/participate`.
+ *
+ * Returns `null` for an unknown event; the route then lets the spin action
+ * produce the single authoritative `event_not_found` rather than guessing at
+ * one here.
+ */
+export async function resolveEventIdAction(idOrSlug) {
+    return wrapAction(async () => {
+        const resolved = await resolveEventRef(buildContext("user.resolveEventId").db, idOrSlug);
+        return resolved?.id ?? null;
+    });
+}

package/dist/_internal/server/features/reviews/actions.js

@@ -17,7 +17,7 @@ export async function createReviewAction(input) {
         await assertNotDuplicateReview(productId, user.uid);
         const product = await productRepository.findById(productId);
         const profile = await userRepository.findById(user.uid);
-        return reviewRepository.create({
+        return reviewRepository.createReview({
             productId,
             productTitle: product?.title ?? productId,
             storeId: storeId || product?.storeId,

package/dist/_internal/server/features/reviews/data.d.ts

@@ -1,5 +1,5 @@
 export declare const getReviewsForProduct: (productId: string, limit?: number) => Promise<import("../../../..").ReviewDocument[]>;
-export declare const getReviewsForStore: (storeId: string, page?: number, pageSize?: number) => Promise<import("../../../..").FirebaseSieveResult<import("../../../..").ReviewDocument> | {
+export declare const getReviewsForStore: (storeId: string, page?: number, pageSize?: number) => Promise<import("../../../..").FirebaseSieveResult<import("../../../../security/encrypted").Plaintext<import("../../../..").ReviewDocument>> | {
     items: never[];
     total: number;
     page: number;