@mohasinac/appkit 4.52.5 → 4.53.0

package/dist/_internal/server/jobs/core/autoPayoutEligibility.js

@@ -12,10 +12,10 @@ function getBusinessDayCutoff(daysAgo) {
     return cutoff;
 }
 export async function runAutoPayoutEligibility(ctx) {
-    if (ctx.env("FEATURE_PAYOUTS") !== "true") {
-        ctx.logger.info("FEATURE_PAYOUTS disabled — skipping auto-payout eligibility");
-        return;
-    }
+    // `FEATURE_PAYOUTS` gate deleted 2026-10-19 — see `auctionSettlement.ts`.
+    // This was the one flag actually set (`functions/.env.letitrip-in-app`), so
+    // unlike its four siblings this job was running; removing the gate is a
+    // no-op in behaviour and removes the lever that could silently stop payouts.
     ctx.logger.info("Starting daily auto-payout eligibility sweep", {
         windowDays: AUTO_PAYOUT_WINDOW_DAYS,
     });
@@ -48,6 +48,26 @@ export async function runAutoPayoutEligibility(ctx) {
             ctx.logger.warn(`Store/seller ${storeId} not found — skipping ${orders.length} order(s)`, { orderIds: orders.map((o) => o.id) });
             continue;
         }
+        /*
+         * 🛑 REVEALED before building a payout. This is the fix for active data
+         * corruption, not a style change.
+         *
+         * `userRepository.findById` is ciphertext-by-default, and
+         * `payoutRepository.createPayout` ENCRYPTS `sellerEmail` and `upiId`
+         * (`PAYOUT_PII_FIELDS`). Passing the stored values straight through
+         * encrypted them a SECOND time, and nothing in the codebase ever
+         * double-decrypts — so every payout this cron wrote carried a
+         * permanently unreadable `upiId`, which is the field the money is sent to.
+         *
+         * It also poisoned the blind index: `piiIndicesFor` HMACs whatever it is
+         * given, so hashing already-encrypted input produced a valid-looking
+         * `sellerEmailIndex` that can never match a lookup by the real address.
+         *
+         * `payoutDetails` needs its own unwrap because it is encrypted by
+         * `encryptPayoutDetails`, a separate scheme from the `piiFields` path, so
+         * `revealUser` handles it explicitly.
+         */
+        const sellerPlain = userRepository.revealUser(seller);
         const sellerId = store.ownerId;
         /*
          * The TAXABLE VALUE — see `orderTaxableValue`. Two narrowings, both
@@ -65,8 +85,9 @@ export async function runAutoPayoutEligibility(ctx) {
         const { platformFee, gatewayFee, gstOnFee: gstAmount, netAmount } = computePayoutDeduction(grossAmount, commissions);
         const payoutInput = {
             storeId,
-            sellerName: (seller.displayName ?? seller.email ?? sellerId),
-            sellerEmail: (seller.email ?? ""),
+            // `displayName` is plaintext by D1; the email fallback must be revealed.
+            sellerName: (seller.displayName ?? sellerPlain.email ?? sellerId),
+            sellerEmail: sellerPlain.email ?? "",
             orderIds: orders.map((o) => o.id),
             amount: netAmount,
             grossAmount,
@@ -79,23 +100,31 @@ export async function runAutoPayoutEligibility(ctx) {
             isAutomatic: true,
             currency: getDefaultCurrency(),
             status: "pending",
-            paymentMethod: seller.payoutDetails?.method === "upi"
+            paymentMethod: sellerPlain.payoutDetails?.method === "upi"
                 ? "upi"
                 : "bank_transfer",
-            upiId: seller.payoutDetails?.method === "upi" ? seller.payoutDetails.upiId : undefined,
-            bankAccount: seller.payoutDetails?.method === "bank_transfer" &&
-                seller.payoutDetails.bankAccount
+            upiId: sellerPlain.payoutDetails?.method === "upi"
+                ? sellerPlain.payoutDetails.upiId
+                : undefined,
+            /*
+             * Only the MASKED account fields are copied, which is why this block
+             * escaped the double-encryption above — `accountNumberMasked`,
+             * `ifscCode` and `bankName` are in no PII list. The real
+             * `accountNumber` is deliberately not carried onto the payout.
+             */
+            bankAccount: sellerPlain.payoutDetails?.method === "bank_transfer" &&
+                sellerPlain.payoutDetails.bankAccount
                 ? {
-                    accountHolderName: seller.payoutDetails.bankAccount.accountHolderName,
-                    accountNumberMasked: seller.payoutDetails.bankAccount.accountNumberMasked,
-                    ifscCode: seller.payoutDetails.bankAccount.ifscCode,
-                    bankName: seller.payoutDetails.bankAccount.bankName,
+                    accountHolderName: sellerPlain.payoutDetails.bankAccount.accountHolderName,
+                    accountNumberMasked: sellerPlain.payoutDetails.bankAccount.accountNumberMasked,
+                    ifscCode: sellerPlain.payoutDetails.bankAccount.ifscCode,
+                    bankName: sellerPlain.payoutDetails.bankAccount.bankName,
                 }
                 : undefined,
             notes: `Auto-payout — ${orders.length} delivered order(s) past ${AUTO_PAYOUT_WINDOW_DAYS}-day window`,
             requestedAt: new Date(),
         };
-        const { id: payoutId } = await payoutRepository.create(payoutInput);
+        const { id: payoutId } = await payoutRepository.createPayout(payoutInput);
         for (let i = 0; i < orders.length; i += BATCH_LIMIT) {
             const slice = orders.slice(i, i + BATCH_LIMIT);
             const batch = ctx.db.batch();

package/dist/_internal/server/jobs/core/bundleStockSync.js

@@ -51,10 +51,9 @@ async function sweepBundleMembers(productIds, ctx) {
     };
 }
 export async function runBundleStockSync(ctx) {
-    if (ctx.env("FEATURE_BUNDLES") !== "true") {
-        ctx.logger.info("FEATURE_BUNDLES disabled — skipping bundle stock sync");
-        return;
-    }
+    // `FEATURE_BUNDLES` gate deleted 2026-10-19 — see `auctionSettlement.ts` for
+    // why these survived the 2026-08-29 flag retirement. Unset in
+    // `functions/.env.letitrip-in-app`, so this scheduled sweep had never run.
     ctx.logger.info("Bundle stock sync starting (SB-UNI-V categories)");
     const snap = await ctx.db
         .collection(CATEGORIES_COLLECTION)

package/dist/_internal/server/jobs/core/cleanupRtdbEvents.js

@@ -16,6 +16,16 @@ const EMAIL_STALE_MS = 60 * 60 * 1000;
 /** Long enough for an open thread to notice a ping before it prunes; the
  * message itself lives in Firestore regardless — this only clears the ping. */
 const CHAT_STALE_MS = 15 * 60 * 1000;
+/**
+ * 🛑 SIXTY minutes, and the four-times-longer window is load-bearing rather
+ * than cautious. A `max`-tier trace fans out across up to sixty parts and can
+ * exceed fifteen minutes end to end; a channel pruned while the run is still
+ * working reads to the client as "it died", which is the one signal this
+ * channel exists to make impossible. The durable history is on the run
+ * document, so the cost of keeping the node an hour is a handful of small
+ * nodes and the cost of dropping it early is a false failure report.
+ */
+const STICKER_TRACE_STALE_MS = 60 * 60 * 1000;
 const JOBS_TTL_DAYS = 30;
 export async function runCleanupRtdbEvents(ctx) {
     ctx.logger.info("Starting RTDB events cleanup");
@@ -111,6 +121,40 @@ export async function runCleanupRtdbEvents(ctx) {
         void normalizeError(emailErr);
         ctx.logger.error("Email events cleanup failed (non-fatal)", emailErr);
     }
+    /*
+     * Sticker kiss-cut tracer progress channels. One node per run, overwritten
+     * in place as the trace advances, so the channel's size is bounded by
+     * concurrent runs rather than by history — but only because this prunes it.
+     * `auction-bids/*` is the Firebase budget's one family with no TTL; do not
+     * make this the second.
+     *
+     * The run DOCUMENT keeps the durable event log, so removing a node loses
+     * nothing a retry panel or a post-mortem reads.
+     */
+    try {
+        const traceSnap = await rtdb.ref(RTDB_PATHS.STICKER_TRACE).get();
+        if (traceSnap.exists()) {
+            const allTraceNodes = traceSnap.val();
+            const staleTraceIds = Object.entries(allTraceNodes)
+                .filter(([, node]) => {
+                const at = node.updatedAt ?? 0;
+                // Missing or non-finite is stale BY DEFINITION — it can never age
+                // out on its own, so leaving it would pin the node forever.
+                return !Number.isFinite(at) || at === 0 || at < now - STICKER_TRACE_STALE_MS;
+            })
+                .map(([id]) => id);
+            if (staleTraceIds.length > 0) {
+                await Promise.all(staleTraceIds.map((id) => rtdb.ref(`${RTDB_PATHS.STICKER_TRACE}/${id}`).remove()));
+                ctx.logger.info("Sticker trace progress nodes removed", {
+                    count: staleTraceIds.length,
+                });
+            }
+        }
+    }
+    catch (traceErr) {
+        void normalizeError(traceErr);
+        ctx.logger.error("Sticker trace cleanup failed (non-fatal)", traceErr);
+    }
     /*
      * D9 — chat new-message pings. Its own file says it: "an unpruned RTDB
      * channel is precisely the thing that quietly accumulates… Do not make it

package/dist/_internal/server/jobs/core/event-draw-reasons.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The ONE reason → {HTTP status, stable code} map for the two event prize-draw
+ * job cores (`assignSpinPrize`, `triggerEventRaffle`).
+ *
+ * ## Why this exists
+ *
+ * Each core returns a `reason` string instead of throwing, and each is reachable
+ * by TWO entry points — a Next.js API route and a Firebase callable handler.
+ * That made four translations of one vocabulary, and all four disagreed:
+ *
+ *   · `api/events/[id]/spin/route.ts`       — had `feature_disabled`, no `not_active`
+ *   · `jobs/handlers/assignSpinPrize.ts`    — `identity_required` → 400 (route said 401),
+ *                                             no `feature_disabled` branch at all
+ *   · `api/admin/events/[id]/trigger-raffle/route.ts` — EVERYTHING → 409
+ *   · `jobs/handlers/triggerEventRaffle.ts` — only 404 / 422
+ *
+ * Root Cause #85 ("a handler reachable by two entry points with different
+ * behaviour"), four times over in one feature. The spin route's own header
+ * already documented the trap and still only fixed its own half.
+ *
+ * ## Two rules that produced real bugs
+ *
+ * 1. 🛑 **A PERMANENT refusal must never take a retryable status.** The spin
+ *    route's fallback was 409 (`ALREADY_EXISTS`), described in its own comment
+ *    as "a benign can't-spin-right-now state". An unlisted permanent reason
+ *    therefore shipped `{code:"ALREADY_EXISTS", error:"<reason>"}` — an envelope
+ *    naming two unrelated things — which the UI rendered as "Spin failed.
+ *    Please try again.", inviting a retry that could never succeed.
+ *
+ * 2. 🛑 **A reason-less result is a SUCCESS to both routes.** Both check
+ *    `if (data.reason && !data.<successField>)`, so a core branch that returned
+ *    early *without* a `reason` fell through to `successResponse`.
+ *    `triggerEventRaffle`'s feature-flag branch did exactly that and answered
+ *    `200 "Raffle triggered"` with no winner. Every non-success branch in either
+ *    core must set a reason from this map.
+ *
+ * There is deliberately NO fallback entry here: `reasonToHttp` is exhaustive
+ * over `EventDrawReason`, so adding a reason without a status is a compile
+ * error rather than a silent 409.
+ */
+export declare const EVENT_DRAW_REASON: {
+    /** Neither a signed-in user nor a hashed guest identity was supplied. */
+    readonly IDENTITY_REQUIRED: "identity_required";
+    /** Guest attempt on an event that has not opted into guest participation. */
+    readonly LOGIN_REQUIRED: "login_required";
+    readonly EVENT_NOT_FOUND: "event_not_found";
+    /** Draft / paused / cancelled / ended — see each core's status precondition. */
+    readonly NOT_ACTIVE: "not_active";
+    readonly NO_PRIZES_CONFIGURED: "no_prizes_configured";
+    readonly OUTSIDE_SPIN_WINDOW: "outside_spin_window";
+    /** This identity has already consumed its `spinMaxPerUser` allowance. */
+    readonly ALREADY_USED: "already_used";
+    readonly NOT_A_SPIN_WHEEL: "not_a_spin_wheel";
+    readonly NOT_A_RAFFLE: "not_a_raffle";
+    /** A winner is already recorded; a second draw would mean two winners. */
+    readonly ALREADY_TRIGGERED: "already_triggered";
+    readonly NO_ELIGIBLE_ENTRIES: "no_eligible_entries";
+};
+export type EventDrawReason = (typeof EVENT_DRAW_REASON)[keyof typeof EVENT_DRAW_REASON];
+export interface EventDrawHttpMapping {
+    status: number;
+    /** Stable code the client resolves through `toUserMessage` / `errors.codes.*`. */
+    code: string;
+    /**
+     * Developer-facing fallback sentence. The client renders copy from `code`, so
+     * this is what shows in a log, a curl, or a locale with no key — never the
+     * primary UI string.
+     */
+    message: string;
+}
+/**
+ * Translate a core's `reason` into the response shape both entry points use.
+ *
+ * An unrecognised reason maps to **500**, not to the old 409 fallback: a reason
+ * this map has never heard of is a bug in the core, and a 5xx is what gets it
+ * recorded by `onRequestError` instead of being filed as an ordinary conflict.
+ */
+export declare function reasonToHttp(reason: string | undefined): EventDrawHttpMapping;

package/dist/_internal/server/jobs/core/event-draw-reasons.js

@@ -0,0 +1,133 @@
+/**
+ * The ONE reason → {HTTP status, stable code} map for the two event prize-draw
+ * job cores (`assignSpinPrize`, `triggerEventRaffle`).
+ *
+ * ## Why this exists
+ *
+ * Each core returns a `reason` string instead of throwing, and each is reachable
+ * by TWO entry points — a Next.js API route and a Firebase callable handler.
+ * That made four translations of one vocabulary, and all four disagreed:
+ *
+ *   · `api/events/[id]/spin/route.ts`       — had `feature_disabled`, no `not_active`
+ *   · `jobs/handlers/assignSpinPrize.ts`    — `identity_required` → 400 (route said 401),
+ *                                             no `feature_disabled` branch at all
+ *   · `api/admin/events/[id]/trigger-raffle/route.ts` — EVERYTHING → 409
+ *   · `jobs/handlers/triggerEventRaffle.ts` — only 404 / 422
+ *
+ * Root Cause #85 ("a handler reachable by two entry points with different
+ * behaviour"), four times over in one feature. The spin route's own header
+ * already documented the trap and still only fixed its own half.
+ *
+ * ## Two rules that produced real bugs
+ *
+ * 1. 🛑 **A PERMANENT refusal must never take a retryable status.** The spin
+ *    route's fallback was 409 (`ALREADY_EXISTS`), described in its own comment
+ *    as "a benign can't-spin-right-now state". An unlisted permanent reason
+ *    therefore shipped `{code:"ALREADY_EXISTS", error:"<reason>"}` — an envelope
+ *    naming two unrelated things — which the UI rendered as "Spin failed.
+ *    Please try again.", inviting a retry that could never succeed.
+ *
+ * 2. 🛑 **A reason-less result is a SUCCESS to both routes.** Both check
+ *    `if (data.reason && !data.<successField>)`, so a core branch that returned
+ *    early *without* a `reason` fell through to `successResponse`.
+ *    `triggerEventRaffle`'s feature-flag branch did exactly that and answered
+ *    `200 "Raffle triggered"` with no winner. Every non-success branch in either
+ *    core must set a reason from this map.
+ *
+ * There is deliberately NO fallback entry here: `reasonToHttp` is exhaustive
+ * over `EventDrawReason`, so adding a reason without a status is a compile
+ * error rather than a silent 409.
+ */
+import { EVENT_DRAW_ERROR_CODES } from "../../../../errors/error-codes.js";
+export const EVENT_DRAW_REASON = {
+    /** Neither a signed-in user nor a hashed guest identity was supplied. */
+    IDENTITY_REQUIRED: "identity_required",
+    /** Guest attempt on an event that has not opted into guest participation. */
+    LOGIN_REQUIRED: "login_required",
+    EVENT_NOT_FOUND: "event_not_found",
+    /** Draft / paused / cancelled / ended — see each core's status precondition. */
+    NOT_ACTIVE: "not_active",
+    NO_PRIZES_CONFIGURED: "no_prizes_configured",
+    OUTSIDE_SPIN_WINDOW: "outside_spin_window",
+    /** This identity has already consumed its `spinMaxPerUser` allowance. */
+    ALREADY_USED: "already_used",
+    NOT_A_SPIN_WHEEL: "not_a_spin_wheel",
+    NOT_A_RAFFLE: "not_a_raffle",
+    /** A winner is already recorded; a second draw would mean two winners. */
+    ALREADY_TRIGGERED: "already_triggered",
+    NO_ELIGIBLE_ENTRIES: "no_eligible_entries",
+};
+const MAPPING = {
+    [EVENT_DRAW_REASON.IDENTITY_REQUIRED]: {
+        status: 401,
+        code: EVENT_DRAW_ERROR_CODES.IDENTITY_REQUIRED,
+        message: "No user or guest identity was provided",
+    },
+    [EVENT_DRAW_REASON.LOGIN_REQUIRED]: {
+        status: 401,
+        code: EVENT_DRAW_ERROR_CODES.LOGIN_REQUIRED,
+        message: "Sign in to take part in this event",
+    },
+    [EVENT_DRAW_REASON.EVENT_NOT_FOUND]: {
+        status: 404,
+        code: EVENT_DRAW_ERROR_CODES.EVENT_NOT_FOUND,
+        message: "Event not found",
+    },
+    [EVENT_DRAW_REASON.NOT_ACTIVE]: {
+        status: 409,
+        code: EVENT_DRAW_ERROR_CODES.EVENT_NOT_ACTIVE,
+        message: "This event is not running right now",
+    },
+    [EVENT_DRAW_REASON.NO_PRIZES_CONFIGURED]: {
+        status: 422,
+        code: EVENT_DRAW_ERROR_CODES.SPIN_NO_PRIZES,
+        message: "No spin prizes are configured for this event",
+    },
+    [EVENT_DRAW_REASON.OUTSIDE_SPIN_WINDOW]: {
+        status: 403,
+        code: EVENT_DRAW_ERROR_CODES.SPIN_OUTSIDE_WINDOW,
+        message: "This spin wheel is not open right now",
+    },
+    [EVENT_DRAW_REASON.ALREADY_USED]: {
+        status: 409,
+        code: EVENT_DRAW_ERROR_CODES.SPIN_ALREADY_USED,
+        message: "This identity has already used its spins for this event",
+    },
+    [EVENT_DRAW_REASON.NOT_A_SPIN_WHEEL]: {
+        status: 422,
+        code: EVENT_DRAW_ERROR_CODES.NOT_A_SPIN_WHEEL,
+        message: "This event is not a spin wheel",
+    },
+    [EVENT_DRAW_REASON.NOT_A_RAFFLE]: {
+        status: 422,
+        code: EVENT_DRAW_ERROR_CODES.RAFFLE_NOT_A_RAFFLE,
+        message: "This event does not have a raffle",
+    },
+    [EVENT_DRAW_REASON.ALREADY_TRIGGERED]: {
+        status: 409,
+        code: EVENT_DRAW_ERROR_CODES.RAFFLE_ALREADY_DRAWN,
+        message: "A winner has already been drawn for this raffle",
+    },
+    [EVENT_DRAW_REASON.NO_ELIGIBLE_ENTRIES]: {
+        status: 409,
+        code: EVENT_DRAW_ERROR_CODES.RAFFLE_NO_ELIGIBLE_ENTRIES,
+        message: "No eligible entries to draw from",
+    },
+};
+const UNKNOWN = {
+    status: 500,
+    code: EVENT_DRAW_ERROR_CODES.UNKNOWN_REASON,
+    message: "The event could not be processed",
+};
+/**
+ * Translate a core's `reason` into the response shape both entry points use.
+ *
+ * An unrecognised reason maps to **500**, not to the old 409 fallback: a reason
+ * this map has never heard of is a bug in the core, and a 5xx is what gets it
+ * recorded by `onRequestError` instead of being filed as an ordinary conflict.
+ */
+export function reasonToHttp(reason) {
+    if (!reason)
+        return UNKNOWN;
+    return MAPPING[reason] ?? UNKNOWN;
+}

package/dist/_internal/server/jobs/core/listingProcessor.js

@@ -53,17 +53,31 @@ function getStringArrayOpt(baseOpts, key) {
 }
 const LISTERS = {
     products: (m, o) => productRepository.list(m, o),
-    categories: (m) => categoriesRepository.list(m),
-    brands: (m) => categoriesRepository.list({
+    /*
+     * 🛑 These four forward `search`, and did not until 2026-10-17.
+     *
+     * `categoriesRepository.list` and `couponsRepository.list` both accept
+     * `opts?: { search?: string }`, and all four listers below were written
+     * `(m) => repo.list(m)` — so a search term reaching the Function was
+     * DISCARDED and the page came back unfiltered with a 200, while the same
+     * route's local fallback filtered correctly. Exactly the divergence the
+     * comment further down records for orders/reviews/blogPosts/events/stores
+     * and faqs, four collections later: category, brand, coupon and
+     * sublisting-category search.
+     *
+     * Found by `audit-lister-opts-forwarding`, which now blocks the shape.
+     */
+    categories: (m, o) => categoriesRepository.list(m, { search: getStringOpt(o, "search") }),
+    brands: (m, o) => categoriesRepository.list({
         ...m,
         filters: m.filters
             ? `${m.filters},categoryType==brand`
             : "categoryType==brand",
-    }),
+    }, { search: getStringOpt(o, "search") }),
     orders: (m, o) => orderRepository.listAll(m, { search: getStringOpt(o, "search") }),
     reviews: (m, o) => reviewRepository.listAll(m, { search: getStringOpt(o, "search") }),
-    coupons: (m) => couponsRepository.list(m),
-    bids: (m) => bidRepository.list(m),
+    coupons: (m, o) => couponsRepository.list(m, { search: getStringOpt(o, "search") }),
+    bids: (m, o) => bidRepository.list(m, { search: getStringOpt(o, "search") }),
     payouts: (m) => payoutRepository.list(m),
     blogPosts: (m, o) => blogRepository.listAll(m, { search: getStringOpt(o, "search") }),
     events: (m, o) => eventRepository.list(m, { search: getStringOpt(o, "search") }),
@@ -84,13 +98,19 @@ const LISTERS = {
         tags: getStringArrayOpt(o, "tags"),
     }),
     notifications: (m) => notificationRepository.list(m),
-    scammers: (m) => scammerRepository.listAll(m),
-    sublistingCategories: (m) => categoriesRepository.list({
+    /*
+     * `/api/admin/scammers` passes `{ search: q }` to this same method locally —
+     * its route comment records that the identity arrays "were never searched at
+     * all despite the box promising them" before searchTxt. Through the Function
+     * the opt was dropped again, so the two executors disagreed.
+     */
+    scammers: (m, o) => scammerRepository.listAll(m, { search: getStringOpt(o, "search") }),
+    sublistingCategories: (m, o) => categoriesRepository.list({
         ...m,
         filters: m.filters
             ? `${m.filters},categoryType==sublisting`
             : "categoryType==sublisting",
-    }),
+    }, { search: getStringOpt(o, "search") }),
     productFeatures: (m) => productFeaturesRepository.list(m),
     homepageSections: (m) => homepageSectionsRepository.list(m),
     users: (m) => userRepository.list(m),

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -1,4 +1,5 @@
 import { normalizeError } from "../../../../errors/normalize.js";
+import { ORDER_PII_FIELDS, revealPii } from "../../../../security/index.js";
 import { adminNotificationsRepository, storeRepository, userRepository } from "../../../../repositories/index.js";
 import { decryptPii } from "../../../../security/index.js";
 import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server.js";
@@ -91,7 +92,17 @@ export async function handleOrderCreate(input, ctx) {
      * `decryptPii` was already imported in this file and used for the store
      * owner's phone eleven lines up; the buyer's name was simply missed.
      */
-    const buyerName = decryptPii(order.userName) ?? order.userName ?? "A customer";
+    /*
+     * The NAMED accessor, not a bare `decryptPii` cast.
+     *
+     * This already decrypted and therefore already WORKED — but through a cast
+     * that defeated the brand, so "is every reader converted?" could not be
+     * answered by grepping for `reveal*`. Routing it through `revealOrder` makes
+     * the decision visible in review and in a grep, which is the whole argument
+     * for named accessors over an inline decrypt.
+     */
+    const buyerName = revealPii(order, ORDER_PII_FIELDS).userName ??
+        "A customer";
     const message = buildPurchaseAnnouncementMessage({
         buyerName,
         firstItemName,

package/dist/_internal/server/jobs/core/onScamReportCreate.js

@@ -10,6 +10,17 @@ export async function handleScamReportCreate(input, ctx) {
     if (reportedBy) {
         try {
             const reporter = await userRepository.findById(reportedBy);
+            /*
+             * REVEALED, because this notification is DELIVERED to the reporter and a
+             * masked address cannot receive mail.
+             *
+             * `findById` stopped decrypting when `UserRepository` went
+             * ciphertext-by-default, so `reporter.email` is an `enc:v1:` blob — it
+             * would have been handed to the mailer verbatim. The old intersection
+             * brand could not object, because `Encrypted<string>` was a subtype of
+             * `string`.
+             */
+            const reporterPlain = reporter ? userRepository.revealUser(reporter) : null;
             await sendNotification({
                 userId: reportedBy,
                 type: "scam_report_update",
@@ -18,8 +29,8 @@ export async function handleScamReportCreate(input, ctx) {
                 message: `Your report for "${name}" has been received. Our team will review it within 48 hours.`,
                 relatedId: scammerId,
                 relatedType: "scammer",
-                userEmail: reporter?.email ?? undefined,
-                userPhone: reporter?.phoneNumber ?? undefined,
+                userEmail: reporterPlain?.email ?? undefined,
+                userPhone: reporterPlain?.phoneNumber ?? undefined,
             });
         }
         catch (err) {

package/dist/_internal/server/jobs/core/onScamReportRejected.js

@@ -13,6 +13,12 @@ export async function handleScamReportRejected(input, ctx) {
     const name = displayNames?.[0] ?? "Unknown";
     try {
         const reporter = await userRepository.findById(reportedBy);
+        /*
+         * REVEALED, because this notification is DELIVERED to the reporter and a
+         * masked address cannot receive mail. `findById` is ciphertext-by-default,
+         * so passing `.email` straight through handed the mailer an `enc:v1:` blob.
+         */
+        const reporterPlain = reporter ? userRepository.revealUser(reporter) : null;
         await sendNotification({
             userId: reportedBy,
             type: "scam_report_update",
@@ -21,8 +27,8 @@ export async function handleScamReportRejected(input, ctx) {
             message: `Your report for "${name}" could not be verified with the evidence provided. You may submit a new report with additional evidence.`,
             relatedId: scammerId,
             relatedType: "scammer",
-            userEmail: reporter?.email ?? undefined,
-            userPhone: reporter?.phoneNumber ?? undefined,
+            userEmail: reporterPlain?.email ?? undefined,
+            userPhone: reporterPlain?.phoneNumber ?? undefined,
         });
     }
     catch (err) {

package/dist/_internal/server/jobs/core/onScamReportVerified.js

@@ -13,6 +13,12 @@ export async function handleScamReportVerified(input, ctx) {
     const name = displayNames?.[0] ?? "Unknown";
     try {
         const reporter = await userRepository.findById(reportedBy);
+        /*
+         * REVEALED, because this notification is DELIVERED to the reporter and a
+         * masked address cannot receive mail. `findById` is ciphertext-by-default,
+         * so passing `.email` straight through handed the mailer an `enc:v1:` blob.
+         */
+        const reporterPlain = reporter ? userRepository.revealUser(reporter) : null;
         await sendNotification({
             userId: reportedBy,
             type: "scam_report_update",
@@ -21,8 +27,8 @@ export async function handleScamReportVerified(input, ctx) {
             message: `The report for "${name}" has been verified and published to the Scam Registry. Thank you for helping protect the community.`,
             relatedId: scammerId,
             relatedType: "scammer",
-            userEmail: reporter?.email ?? undefined,
-            userPhone: reporter?.phoneNumber ?? undefined,
+            userEmail: reporterPlain?.email ?? undefined,
+            userPhone: reporterPlain?.phoneNumber ?? undefined,
         });
     }
     catch (err) {

package/dist/_internal/server/jobs/core/onStoreWrite.js

@@ -5,9 +5,16 @@
 import { notifyRevalidate } from "./revalidateNotify.js";
 export async function handleStoreWrite(input, ctx) {
     // The search-index sync this used to perform is gone (Firestore queries handle
-    // search now), so the only remaining side-effect is cache invalidation: drop
-    // the ISR entries for this store's page and the stores listing. Reuses the
-    // existing trigger, so this costs no additional invocations, and performs no
-    // Firestore write (Root Cause #92).
+    // search now), so the only remaining side-effect here is cache invalidation:
+    // drop the ISR entries for this store's page and the stores listing. Reuses
+    // the existing trigger, so it costs no additional invocations, and this
+    // function performs no Firestore write.
+    //
+    // 🛑 The HANDLER above it does write one, as of the public search index:
+    // `markSearchIndexDirty` flips a boolean on `searchIndex/manifest`. That is
+    // still safe under Root Cause #92 — a different collection from the one the
+    // trigger watches, with a boolean read-then-write guard — but the old
+    // blanket claim that this trigger writes nothing is no longer true, and a
+    // comment that is false is worse than no comment.
     await notifyRevalidate({ collection: "stores", id: input.storeId }, ctx);
 }

package/dist/_internal/server/jobs/core/prizeDrawAssignWinner.js

@@ -14,10 +14,11 @@ const ORDER_COLLECTION = "orders";
  * — do not change the selection algorithm.
  */
 export async function assignPrizeDrawWinner(ctx, args) {
-    if (ctx.env("FEATURE_PRIZE_DRAWS") !== "true") {
-        ctx.logger.info("FEATURE_PRIZE_DRAWS disabled — skipping winner assignment");
-        return { kind: "not_eligible" };
-    }
+    // The `FEATURE_PRIZE_DRAWS` gate here was deleted 2026-10-19 with the other
+    // four readers — see the header of `assignSpinPrize.ts`. This one was the
+    // worst-shaped of them: it returned `kind: "not_eligible"`, which every
+    // caller treats as "this order does not win anything", so with the env var
+    // unset a paid prize-draw entry was silently recorded as a non-winner.
     const { orderId, productId } = args;
     const orderRef = ctx.db.collection(ORDER_COLLECTION).doc(orderId);
     const productRef = ctx.db.collection(PRODUCT_COLLECTION).doc(productId);

package/dist/_internal/server/jobs/core/prizeDrawExpiryReveal.js

@@ -17,10 +17,7 @@ const PRIZE_DRAW_LISTING_TYPE = "prize-draw";
  * "closed".
  */
 export async function runPrizeDrawExpiryReveal(ctx) {
-    if (ctx.env("FEATURE_PRIZE_DRAWS") !== "true") {
-        ctx.logger.info("FEATURE_PRIZE_DRAWS disabled — skipping prize-draw expiry reveal");
-        return;
-    }
+    // `FEATURE_PRIZE_DRAWS` gate deleted 2026-10-19 — see `assignSpinPrize.ts`.
     ctx.logger.info("Prize-draw expiry reveal sweep starting");
     const snap = await ctx.db
         .collection(PRODUCT_COLLECTION)

package/dist/_internal/server/jobs/core/prizeDrawSoldOutReveal.js

@@ -18,8 +18,7 @@ function isSoldOut(doc) {
  * the draw, then closes it.
  */
 export async function handlePrizeDrawSoldOut(input, ctx) {
-    if (ctx.env("FEATURE_PRIZE_DRAWS") !== "true")
-        return;
+    // `FEATURE_PRIZE_DRAWS` gate deleted 2026-10-19 — see `assignSpinPrize.ts`.
     const { productId, before, after } = input;
     if (!after)
         return;

package/dist/_internal/server/jobs/core/promotions.js

@@ -6,10 +6,13 @@ import { ProductStatusValues } from "../../../../features/products/schemas/fires
  * (coupon.startDate IS NULL OR <= now) filter Firestore can't express.
  */
 export async function runPromotions(_input, ctx) {
-    if (ctx.env("FEATURE_EVENTS") !== "true") {
-        ctx.logger.info("FEATURE_EVENTS disabled — skipping promotions");
-        return { promotedProducts: [], featuredProducts: [], activeCoupons: [] };
-    }
+    /*
+     * `FEATURE_EVENTS` gate deleted 2026-10-19 — see `auctionSettlement.ts`.
+     * Unset in the Functions env, and this branch returned three EMPTY ARRAYS,
+     * which is indistinguishable from "nothing is promoted right now" to every
+     * caller. A refusal shaped like a valid empty answer is the worst of the
+     * nine; the spin route at least produced a 503 somebody could see.
+     */
     ctx.logger.info("Promotions data requested");
     const now = new Date();
     const nowIso = now.toISOString();

package/dist/_internal/server/jobs/core/searchIndexBuild.d.ts

@@ -0,0 +1,7 @@
+import type { JobContext } from "../runtime/types";
+export declare function runSearchIndexBuild(ctx: JobContext): Promise<void>;
+/**
+ * Force a full rebuild, ignoring the manifest's cadence. For a one-off repair
+ * after a schema bump or a reseed.
+ */
+export declare function runSearchIndexFullRebuild(ctx: JobContext): Promise<void>;