@mohasinac/appkit 4.52.5 → 4.53.0

package/dist/features/support/repository/support.repository.js

@@ -4,9 +4,9 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { SUPPORT_TICKET_FIELDS } from "../../../constants/field-names.js";
 import { buildSearchTxt } from "../../../utils/search-txt.js";
-import { planSearchTxt, emptySearchResult } from "../../../utils/search-txt-query.js";
+import { planSearchTxt, emptySearchResult, beginSearchWindow, } from "../../../utils/search-txt-query.js";
 import { sieveAnd, sieveFilter, SIEVE_OP } from "../../../utils/sieve-builder.js";
-import { decryptPiiFields } from "../../../security/pii-encrypt.js";
+import { maskPii, revealPii } from "../../../security/pii-accessors.js";
 import { SUPPORT_TICKET_COLLECTION, SUPPORT_TICKET_PII_FIELDS, SUPPORT_TICKET_TRACKED_FIELDS, TicketStatusValues, ACTIVE_TICKET_STATUSES, } from "../schemas/firestore.js";
 import { withHistory } from "../../../_internal/shared/history/index.js";
 export class SupportRepository extends BaseRepository {
@@ -35,9 +35,38 @@ export class SupportRepository extends BaseRepository {
         return subject ? buildSearchTxt([subject]) : null;
     }
     /** Decrypt on read so callers see the shape they wrote. */
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return decryptPiiFields(raw, [...SUPPORT_TICKET_PII_FIELDS]);
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `SupportTicketDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealTicket(doc) {
+        return revealPii(doc, SUPPORT_TICKET_PII_FIELDS);
+    }
+    /** As `revealTicket`, for a list read. */
+    revealTickets(docs) {
+        return docs.map((d) => this.revealTicket(d));
+    }
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedTicket(doc) {
+        return maskPii(doc, SUPPORT_TICKET_PII_FIELDS);
+    }
+    /** As `maskedTicket`, for a list read. */
+    maskedTickets(docs) {
+        return docs.map((d) => this.maskedTicket(d));
     }
     async createTicket(input) {
         try {
@@ -50,6 +79,9 @@ export class SupportRepository extends BaseRepository {
                 createdAt: now,
                 updatedAt: now,
             };
+            // Plaintext in; `create` encrypts via the write hook. This used to be
+            // `as unknown as SupportTicketDocument` — a double cast that claimed the
+            // freshly-built literal was already ciphertext.
             return this.create(data);
         }
         catch (err) {
@@ -77,9 +109,9 @@ export class SupportRepository extends BaseRepository {
         /*
          * The term is tokenised the same way the index was built, and only the
          * FIRST token is pushed down — Firestore allows one `array-contains` per
-         * query. The rest are applied in memory by `sieveQuery`'s own pass, which
-         * is what keeps a two-word search from silently matching on the first word
-         * alone (the partial-pushdown trap in Root Cause #62).
+         * query. The rest are AND-refined in memory by `beginSearchWindow` /
+         * `finish` below, which is what keeps a two-word search from matching on
+         * one word alone (the partial-pushdown trap in Root Cause #62).
          */
         const clauses = [
             sieveFilter(SUPPORT_TICKET_FIELDS.STORE_ID, SIEVE_OP.EQ, storeId),
@@ -101,13 +133,29 @@ export class SupportRepository extends BaseRepository {
         if (plan.head) {
             baseQuery = baseQuery.where(SUPPORT_TICKET_FIELDS.SEARCH_TXT, "array-contains", plan.head);
         }
+        /*
+         * 🛑 The comment above used to claim `sieveQuery` applied the remaining
+         * terms "in memory by its own pass". It does not and never did — nothing
+         * read `plan.rest`, so a two-word search returned every ticket matching
+         * the LONGEST word, with `truncated` unset so the pager also claimed the
+         * result was complete. The claim was the only thing standing where the
+         * refine should have been (Root Cause #50's shape: a named guarantee with
+         * no implementation behind it).
+         *
+         * `beginSearchWindow` is the three-part conversion, and all three parts
+         * have to happen together — fetch a window, RAISE `maxPageSize` to it, and
+         * hand `finish` the page to slice. Doing one and three without two leaves
+         * Sieve clamping the window back to a page, which reads exactly like a
+         * working conversion and silently no-ops.
+         */
+        const win = beginSearchWindow({ page, pageSize }, plan);
         const model = {
             filters: sieveAnd(...clauses.slice(1)),
             sorts: "-createdAt",
-            page,
-            pageSize,
+            ...win.model,
         };
-        return this.sieveQuery(model, SupportRepository.SIEVE_FIELDS, { defaultPageSize: pageSize, maxPageSize: 50, baseQuery });
+        const result = await this.sieveQuery(model, SupportRepository.SIEVE_FIELDS, { defaultPageSize: pageSize, maxPageSize: win.maxPageSize(50), baseQuery });
+        return win.finish(result);
     }
     async getTicketById(ticketId) {
         return this.findById(ticketId);
@@ -158,6 +206,8 @@ export class SupportRepository extends BaseRepository {
      */
     async updateTicketStatus(ticketId, update, ctx, prior) {
         const current = prior !== undefined ? prior : await this.getTicketById(ticketId);
+        // Plain in, ciphertext out: `this.update` runs the write hook over
+        // `piiFields`, which is what encrypts `assignedToName` on the way down.
         const patch = {
             ...update,
             ...this.resolutionStamps(current, update.status),
@@ -177,6 +227,12 @@ export class SupportRepository extends BaseRepository {
      * Never fabricated for a ticket resolved before this existed — that one
      * renders an em-dash, the same rule the offer timeline follows.
      */
+    /*
+     * Returns the PLAIN shape. It only ever emits two Date fields, neither of
+     * them PII — but it is SPREAD into a plaintext patch, and a return typed
+     * against the document would poison that patch's inferred type with
+     * `Encrypted<string>` members it never actually sets.
+     */
     resolutionStamps(current, next) {
         if (!next || next === current?.status)
             return {};
@@ -188,6 +244,14 @@ export class SupportRepository extends BaseRepository {
         return {};
     }
     /** Append a timeline entry when the patch touches a tracked field. */
+    /*
+     * Takes and returns the PLAIN shape.
+     *
+     * It only threads a patch through `withHistory` and casts both sides to
+     * `FirestoreDocument` anyway, so it is indifferent to whether the PII in it
+     * is ciphertext — and its callers hold plaintext, because encryption happens
+     * in `this.update`'s write hook downstream.
+     */
     withTicketHistory(current, patch, ctx, defaultTrigger) {
         const withEntry = withHistory(current, patch, {
             tracked: SUPPORT_TICKET_TRACKED_FIELDS,
@@ -233,9 +297,25 @@ export class SupportRepository extends BaseRepository {
             throw new DatabaseError("Failed to add message to ticket", err);
         }
     }
-    async assignTicket(ticketId, assignedTo, assignedToName, ctx, prior) {
+    async assignTicket(ticketId, assignedTo, 
+    /*
+     * PLAINTEXT. `BaseRepository.update` runs `encryptPiiFields` over
+     * `piiFields`, which includes `assignedToName`, so the value is encrypted
+     * on the way down — the parameter is honest about what the caller holds.
+     * `asEncrypted` here would be the misuse its own docstring forbids:
+     * labelling plaintext as ciphertext.
+     */
+    assignedToName, ctx, prior) {
         const current = prior !== undefined ? prior : await this.getTicketById(ticketId);
-        return this.update(ticketId, this.withTicketHistory(current, { assignedTo, assignedToName, updatedAt: new Date() }, ctx, "assignTicket"));
+        return this.update(ticketId, this.withTicketHistory(current, {
+            assignedTo,
+            // No cast: `withTicketHistory` takes the PLAIN shape, and this
+            // parameter is plaintext (the write hook encrypts downstream). The
+            // cast that used to sit here existed only because the payload type
+            // claimed ciphertext.
+            assignedToName,
+            updatedAt: new Date(),
+        }, ctx, "assignTicket"));
     }
     async listAll(model) {
         return this.sieveQuery(model, SupportRepository.SIEVE_FIELDS, { defaultPageSize: 25, maxPageSize: 100 });

package/dist/features/support/schemas/firestore.d.ts

@@ -16,6 +16,7 @@
  */
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export declare const TicketCategoryValues: {
     readonly ORDER_ISSUE: "order_issue";
     readonly BILLING_PAYMENT: "billing_payment";
@@ -72,12 +73,22 @@ export interface TicketRelatedParties {
     productId?: string;
     bidId?: string;
 }
+/**
+ * `SupportTicketDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type SupportTicketPlain = Plaintext<SupportTicketDocument>;
 export interface SupportTicketDocument extends BaseDocument {
     userId: string;
     /** Denormalized — for admin table display. */
-    userEmail: string;
+    userEmail: Encrypted<string>;
     /** Denormalized — for admin table display. */
-    userDisplayName: string;
+    userDisplayName: Encrypted<string>;
     category: TicketCategory;
     subject: string;
     /** Initial description written by the user when opening the ticket. */
@@ -109,7 +120,7 @@ export interface SupportTicketDocument extends BaseDocument {
     /** UID of the assigned employee. */
     assignedTo?: string;
     /** Denormalized display name of the assignee. */
-    assignedToName?: string;
+    assignedToName?: Encrypted<string>;
     /**
      * Internal-only notes visible only to admins/employees, never shown to the ticket author.
      * Append-only — never overwrite, always append with timestamp.
@@ -166,8 +177,8 @@ export declare const SUPPORT_TICKET_TRACKED_FIELDS: readonly ["status", "priorit
  * (`assignedTo`) and never the name.
  */
 export declare const SUPPORT_TICKET_PII_FIELDS: readonly ["userEmail", "userDisplayName", "assignedToName"];
-export type SupportTicketCreateInput = Pick<SupportTicketDocument, "userId" | "userEmail" | "userDisplayName" | "category" | "subject" | "description" | "orderId" | "storeId">;
-export type SupportTicketUpdateInput = Partial<Pick<SupportTicketDocument, "status" | "priority" | "assignedTo" | "assignedToName" | "internalNotes" | "relatedParties">>;
+export type SupportTicketCreateInput = Pick<SupportTicketPlain, "userId" | "userEmail" | "userDisplayName" | "category" | "subject" | "description" | "orderId" | "storeId">;
+export type SupportTicketUpdateInput = Partial<Pick<SupportTicketPlain, "status" | "priority" | "assignedTo" | "assignedToName" | "internalNotes" | "relatedParties">>;
 export declare const SUPPORT_TICKET_COLLECTION: "supportTickets";
 export declare const SUPPORT_TICKET_ID_PREFIX: "ticket-";
 export declare const SUPPORT_TICKET_INDEXED_FIELDS: readonly ["userId", "storeId", "searchTxt", "status", "category", "priority", "assignedTo", "orderId", "createdAt", "updatedAt"];

package/dist/features/tester/seed-data/authored/admin__events-raffles-spin.js

@@ -77,17 +77,32 @@ export const authored = {
         startPage: "/admin/events",
         steps: [
             "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open 'QA Event raffle-open' in the admin and read the entry list.",
-            "Trigger the raffle draw and read the winner named.",
+            "Open 'QA Event raffle-open' in the admin editor and read the entry list and the 'Pool size' readout in the raffle panel.",
+            "Press 'Trigger Raffle Now'. A CONFIRMATION DIALOG must appear first — read it, then confirm.",
+            "Read the winner named and the pool size reported.",
             "RELOAD and read the winner again.",
             "Read whether the winner's name and entry are both recorded on the event.",
-            "Sign in as the winning buyer and check they were notified.",
-            "Sign back in as admin and attempt to draw a second time, reading what happens.",
+            "Sign in as the winning buyer and open the notification bell; read the notification and follow its link.",
+            "Sign back in as admin, reopen the event, and read the button's label and enabled state. Then attempt a second draw.",
         ],
-        expectedBehaviour: "The draw picks once with real randomness, records the winner on the event, and notifies them. A second draw must be refused — redrawing replaces a winner who has already been told they won, and the notification cannot be recalled.",
-        expectedUiState: "The winner is named and survives the reload. The event records both the winner and their entry. The buyer has a notification. The second draw attempt is refused rather than producing a new winner.",
-        expectedData: { drawsPermitted: 1 },
-        endResult: "Delete the event afterwards. A second draw succeeding is the most serious failure on this page.",
+        expectedBehaviour: "The draw picks once with real randomness, records the winner on the event, and notifies them. A second draw must be refused — redrawing replaces a winner who has already been told they won, and the notification cannot be recalled. A pool size of 0 on an event that visibly has entries is itself the failure: it means the eligibility query and the entry writer disagree about which field marks an entry eligible.",
+        expectedUiState: "A confirmation dialog gates the draw. The winner is named and survives the reload. The event records both the winner and their entry. The buyer has one notification that deep-links to the event's winner page. On reopening, the button reads 'Already triggered' and is disabled; forcing a second draw is refused naming the existing winner, never with a generic failure.",
+        /*
+         * `drawsPermitted: 1` was already here and had never been exercised. The
+         * other three are the preconditions that made it unexercisable:
+         *   poolSizeNotZero       — the draw queried `status == "CONFIRMED"`, which
+         *                           nothing writes at entry time, so EVERY draw
+         *                           returned "no eligible entries"
+         *   winnerNotifications   — the winner was recorded and never told
+         *   confirmationDialogs   — an irreversible action with no confirmation
+         */
+        expectedData: {
+            drawsPermitted: 1,
+            poolSizeNotZero: true,
+            winnerNotifications: 1,
+            confirmationDialogs: 1,
+        },
+        endResult: "BEFORE: there was no confirmation dialog, the draw answered 'no eligible entries' on an event with entries (so no winner could ever be drawn), and on the rare path it did write a winner that person was never notified. AFTER: the dialog gates it, one winner is drawn and notified, and the second attempt is refused naming the existing winner. Delete the event afterwards. A second draw succeeding is the most serious failure on this page.",
     },
     "checklist-admin-events-raffles-spin-spin-wheel-create": {
         roles: ["admin", "buyer"],
@@ -98,13 +113,25 @@ export const authored = {
             "Define three prizes with labels and weights, set a maximum of 2 spins per user, and set a spin window covering today.",
             "Save, RELOAD, and read every prize, weight, the maximum and the window.",
             "Open the event's public page at /events/{its id} and read the wheel and its segments.",
-            "Check the wheel shows the prize labels and does NOT disclose their weights.",
+            "View SOURCE (or the network payload) for /events/{its id}/participate and search the response text for the string 'weight'. Then search it for 'couponId'.",
         ],
         inputs: { title: "QA Event spin-create", prizeCount: 3, maxPerUser: 2 },
         expectedBehaviour: "Prizes, weights, the per-user maximum and the window all round-trip. Weights are the odds and belong server-side — a public wheel that renders them tells every visitor which segment is worthless.",
-        expectedUiState: "After the reload all four groups of settings hold. The public wheel shows three labelled segments and no weight values anywhere on the page or in its source.",
-        expectedData: { weightsInPublicSource: 0 },
-        endResult: "Leave the event in place — the limits case reads it.",
+        expectedUiState: "After the reload all four groups of settings hold. The public wheel shows three labelled segments.",
+        /*
+         * 🛑 The last step searches the PAYLOAD, not the rendered wheel, and that
+         * is the whole case.
+         *
+         * It previously read "check the wheel does NOT disclose their weights" —
+         * and the rendered wheel has never shown a weight, so a tester looked at
+         * three labelled segments and passed. Meanwhile the participate page cast
+         * the stored prize array straight into a client prop, so every weight AND
+         * every internal coupon document id was sitting in the RSC payload of a
+         * public page. The case asserted `weightsInPublicSource: 0` and could not
+         * see the thing it was counting.
+         */
+        expectedData: { weightsInPublicSource: 0, couponIdsInPublicSource: 0 },
+        endResult: "BEFORE: the payload contained 'weight: 15', 'weight: 25', 'weight: 10' and a 'couponId' for any prize carrying a coupon. AFTER: neither string appears anywhere in it, while the three labels still render. Leave the event in place — the limits case reads it.",
     },
     "checklist-admin-events-raffles-spin-spin-wheel-limits-enforced": {
         roles: ["admin", "buyer"],
@@ -113,16 +140,31 @@ export const authored = {
             "Sign in as rehan.sheikh@gmail.com / TempPass123! and open 'QA Event spin-create'.",
             "Spin once and read the prize and the remaining count.",
             "Spin a second time and read the remaining count.",
-            "Attempt a third spin and read the refusal.",
-            "RELOAD the page and attempt another spin.",
+            "Attempt a third spin and read the refusal WORD FOR WORD.",
+            "RELOAD the page and read the Spin button's state before clicking anything.",
+            "An event is reachable by two URL spellings — its SLUG and its DOCUMENT ID. Note which one you have been using, then open the OTHER one as the same account and attempt a spin.",
             "Sign out and sign in as admin@letitrip.in / TempPass123!, then narrow the spin window so it is closed.",
-            "Sign back in as the buyer and attempt a spin, reading the refusal.",
+            "Sign back in as the buyer and attempt a spin, reading that refusal word for word too.",
         ],
         inputs: { maxPerUser: 2 },
-        expectedBehaviour: "The per-user cap and the window are both enforced server-side. A cap held in the browser resets on refresh and is no cap at all, and the two refusals must read differently — 'no spins left' and 'the window is closed' are different facts and a single generic message tells the buyer neither.",
-        expectedUiState: "The remaining count falls with each spin and the third is refused naming the limit. After the reload it is still refused. With the window closed the refusal names the window instead. A fresh spin available after a reload is the failure.",
-        expectedData: { spinsAfterReload: 0 },
-        endResult: "Delete the event afterwards.",
+        expectedBehaviour: "The per-user cap and the window are both enforced server-side, the cap is scoped to the PERSON rather than to the URL spelling, and the two refusals read differently — 'no spins left' and 'the window is closed' are different facts and a single generic message tells the buyer neither.",
+        expectedUiState: "The third attempt is refused naming the limit. After the reload the button is already disabled with the spent state shown, without a round trip. The other URL spelling is refused identically. With the window closed the refusal names the window instead.",
+        /*
+         * Three invariants, each of which was broken in a different way:
+         *   spinsAfterReload       — the cap itself
+         *   spinsViaOtherUrlForm   — the guest/identity hash was scoped to the
+         *                            SLUG while enterEvent scoped it to the doc id,
+         *                            so the two URL spellings were two identities
+         *                            and the other one handed out a fresh allowance
+         *   distinctRefusalMessages — both refusals were the same sentence
+         */
+        expectedData: {
+            maxPerUser: 2,
+            spinsAfterReload: 0,
+            spinsViaOtherUrlForm: 0,
+            distinctRefusalMessages: 2,
+        },
+        endResult: "BEFORE: every refusal on this page read 'Spin failed. Please try again.', the button stayed enabled after a reload so the cap cost a round trip to discover, and the other URL spelling granted a fresh set of spins. AFTER: 'You've already used your spins for this event.' and 'The spin window isn't open right now.' are distinct, the button is pre-disabled, and both URL spellings share one allowance. Delete the event afterwards.",
     },
     "checklist-admin-events-raffles-spin-event-entries-admin-view": {
         roles: ["admin"],

package/dist/features/tester/seed-data/authored/buying__browsing-search.js

@@ -284,12 +284,28 @@ export const authored = {
         steps: [
             "Open /.",
             "Scroll down looking for a 'Raffles' or 'Spin Wheels' strip.",
+            "Read the TYPE of EVERY card in that strip — open each one if the card does not say. Write down any card that is not a raffle or a spin wheel.",
             "Open /events in a new tab.",
             "Note which events have a raffle or spin-wheel type and are currently active.",
         ],
-        expectedBehaviour: "If any raffle or spin-wheel event is active on /events, the homepage shows a 'Raffles & Spin Wheels' strip containing those events. The strip is absent only when genuinely no raffle event is active.",
-        expectedUiState: "The homepage shows a 'Raffles & Spin Wheels' heading with at least one event card beneath it (e.g. 'Daily Beyblade Pull! Spin for a Prize'). The same event must also appear on /events.",
-        endResult: "Nothing is persisted.",
+        expectedBehaviour: "If any raffle or spin-wheel event is active on /events, the homepage shows a 'Raffles & Spin Wheels' strip containing those events AND NOTHING ELSE. The strip is absent only when genuinely no raffle or spin-wheel event is active.",
+        expectedUiState: "The homepage shows a 'Raffles & Spin Wheels' heading with at least one event card beneath it (e.g. 'Daily Beyblade Pull! Spin for a Prize'). Every card in the strip is a raffle or a spin wheel. The same events must also appear on /events.",
+        /*
+         * 🛑 Step 3 — reading each card's TYPE — is the case.
+         *
+         * The strip filtered on `hasRaffle`, which was not in the events repository's
+         * SIEVE_FIELDS. The Sieve adapter runs with `throwExceptions: false`, so an
+         * unallowlisted field does not raise: the clause was SILENTLY DISCARDED and
+         * the query degraded to `status == active` sorted by start date. The strip
+         * rendered the six most recently-started active events of any type — sales,
+         * polls, feedback forms — under a heading promising raffles.
+         *
+         * Every card was a real, live, correctly-rendered event, which is exactly
+         * why this read as working. Only the heading was false, and the old case
+         * asked for "at least one event card", which that satisfied.
+         */
+        expectedData: { nonPrizeEventsInStrip: 0 },
+        endResult: "BEFORE: the strip listed active events of ANY type — a clearance sale and a poll appeared under 'Raffles & Spin Wheels' — because the raffle filter was being dropped before the query ran. AFTER: every card in the strip is a raffle or a spin wheel. Nothing is persisted.",
     },
     "checklist-buying-browsing-search-homepage-prize-draws-section": {
         roles: ["guest"],

package/dist/features/tester/seed-data/authored/content-discovery__authenticity-checker.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/content-discovery__authenticity-checker.js

@@ -0,0 +1,243 @@
+/*
+ * WHY: Authored six-part procedures for content-discovery/authenticity-checker.
+ * WHAT: 13 cases, keyed by full checklist id.
+ *
+ * 🛑 EVERY CASE IS WRITTEN AS BEFORE → AFTER, because this feature's whole
+ * failure mode is a confident, plausible, wrong answer returned with HTTP 200. A
+ * case reading "check the authenticity tool works" passes against all of these:
+ *
+ *   1. A two-state sign-in gate. `SessionProvider` mounts `initialUser={null}`,
+ *      so `loading` starts true for SIGNED-IN users too — the page flashed "sign
+ *      in to run a lookup" at an authenticated collector on every hard load.
+ *   2. A verdict with no hedge. The engine can match a midfake batch code; the
+ *      wrong version of that screen reads as an accusation against the seller.
+ *   3. One date printed as fact. Two decodings of a Metal Fight box code
+ *      circulate and Takara Tomy has published neither.
+ *   4. Treating a real product code as evidence. A counterfeit catalogue
+ *      measured for this site carried 900+ genuine Takara Tomy codes.
+ *   5. Picking one bey when the typed name matches a dozen.
+ *   6. Calling a legitimate spelling a fake tell — Takara Tomy romanises the
+ *      line as "Pegasis" while Hasbro prints "Pegasus", and an earlier draft of
+ *      the checker flagged the TT spelling as trademark evasion.
+ *   7. Calling Funskool a fake. It is a licensed Indian importer.
+ *   8. A sign-in wall with no public content, which is thin content to a crawler
+ *      and useless to someone who arrived from search.
+ *
+ * So each case names what the wrong answer LOOKED like, and several assert the
+ * presence of a hedge rather than the presence of a result.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed-data/authored/index.ts
+ * @tag sideEffects:none
+ */
+export const authored = {
+    "checklist-content-discovery-authenticity-checker-guest-sees-reference-not-a-wall": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Open /tools/authenticity signed out.",
+            "Confirm there is exactly ONE sign-in box, and it sits where the lookup form would be.",
+            "Scroll past it and confirm the generation table renders — six rows, each naming years, code prefixes and licensed marques.",
+            "Confirm the 'Checks that apply whatever the generation' list renders with real text in each row.",
+            "Answer no if the page is only a sign-in prompt, or if the reference content is missing.",
+        ],
+        expectedBehaviour: "BEFORE: gating the page would have meant a signed-out visitor — and a crawler — getting nothing but 'please sign in', which is thin content and throws away the highest-intent query this site can answer. AFTER: only the LOOKUP is gated. The generation table, the box-code explanation, the universal checks and the licensed-marque list are server-rendered and public, identical for crawlers and humans.",
+        expectedUiState: "One sign-in card reading 'Sign in to run a lookup', followed by the heading 'Which generation is it, and what does the box code mean' and six generation rows, then the universal checks, then 'Who is actually licensed'.",
+        expectedData: { generationRows: 6 },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+    "checklist-content-discovery-authenticity-checker-no-signin-flash-when-authenticated": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Sign in as a buyer.",
+            "Hard-reload /tools/authenticity (Ctrl+F5, not a soft navigation).",
+            "Watch the lookup area through the first second of the load.",
+            "Answer no if the words 'Sign in to run a lookup' appear at any point.",
+        ],
+        expectedBehaviour: "BEFORE: a two-state gate (`!user` → prompt) showed the sign-in card to signed-in users on every hard load, because the session provider mounts with a null user and resolves asynchronously. AFTER: three states — while `loading` is true the area shows 'Checking your session…', and the prompt is reachable only once the session has resolved to no user.",
+        expectedUiState: "Either 'Checking your session…' briefly, then the form. Never the sign-in card.",
+        endResult: "The form is present after reload. Nothing persists.",
+    },
+    "checklist-content-discovery-authenticity-checker-midfake-code-reads-as-batch-not-accusation": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Sign in and open /tools/authenticity.",
+            "Enter A0813 in 'Code on the box' and leave everything else empty.",
+            "Submit.",
+            "Read the verdict block and the caveat directly beneath it.",
+            "Answer no if the screen anywhere calls the item counterfeit, or accuses the seller, or omits the caveat.",
+        ],
+        inputs: { code: "A0813" },
+        expectedBehaviour: "BEFORE: the obvious implementation of a code match is a boolean 'FAKE'. A0813 is a real recorded midfake batch code, and a midfake is Takara-Tomy-blueprint product of reduced quality — a statement about a production run, not about whoever is selling it. AFTER: the verdict is 'Likely reproduction', and the caveat in the same block says it is a statement about a batch or brand and not an accusation against the seller.",
+        expectedUiState: "A 'Likely reproduction' badge, a one-sentence headline about matching a batch the community records as a midfake, and a caveat naming batch-or-brand rather than the seller. A Safety block about lead and cadmium is present.",
+        expectedData: { verdict: "likely-reproduction" },
+        endResult: "Nothing is written. Reloading clears the result.",
+    },
+    "checklist-content-discovery-authenticity-checker-date-code-shows-both-readings": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter A0813 as the code and submit.",
+            "Find the 'Reading A0813' panel.",
+            "Confirm TWO readings are listed — one treating the letter as the month, one treating it as the factory with the digits as a week number.",
+            "Confirm the panel says both circulate and that Takara Tomy has published neither.",
+            "Answer no if only one date is shown, or if a date is stated without that hedge.",
+        ],
+        inputs: { code: "A0813" },
+        expectedBehaviour: "BEFORE: the reference post states a month-day-year rule, so the obvious build prints '8 January 2013' as a fact. A factory/week/year reading also circulates and Takara Tomy has never published a decoding — the post itself says there is no official statement. AFTER: both readings render, labelled, with the disagreement stated.",
+        expectedUiState: "'Reading A0813' with two labelled lines — '…letter = month…' → 8 January 2013, and '…letter = factory, next two digits = week…' → factory A, week 8 of 2013 — plus a sentence saying to treat the date as indicative.",
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-real-product-code-is-not-evidence": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter BB-105 in 'Code on the box', leave the name empty, and submit.",
+            "Read the signal rows under 'What I checked'.",
+            "Confirm one row says the code is a well-formed Metal Fight code AND that this says nothing about authenticity.",
+            "Answer no if a valid product code is presented as supporting authenticity.",
+        ],
+        inputs: { code: "BB-105" },
+        expectedBehaviour: "BEFORE: matching a code against a real product list reads as verification, and that is the single most misleading thing this tool could do — a counterfeit catalogue measured for this site printed 516 real B-xx, 189 BB-xx and 147 BX-xx codes across 1,277 unlicensed products. AFTER: a well-formed code establishes the GENERATION and is marked neutral, with the 900-codes measurement stated.",
+        expectedUiState: "A neutral signal row (not a green/supporting one) saying BB-105 is a well-formed Metal Fight code and that unlicensed sellers print real codes routinely.",
+        expectedData: { generation: "mfb" },
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-name-code-mismatch-asks-rather-than-accuses": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter 'Storm Pegasus' as the model name and BB-105 as the code. Submit.",
+            "Confirm the verdict is 'Discrepancy found' and a signal explains that Storm Pegasus is BB-28 while BB-105 is a different release.",
+            "Confirm the signal tells you a Random Booster or multi-pack is an innocent explanation.",
+            "Now tick 'This came in a Random Booster or a multi-pack' and submit again.",
+            "Confirm the verdict is no longer a discrepancy and a signal says a mismatch is EXPECTED for a Random Booster.",
+            "Answer no if the second submission still reports a discrepancy.",
+        ],
+        inputs: { name: "Storm Pegasus", code: "BB-105", randomBooster: true },
+        expectedBehaviour: "BEFORE: flagging every name/code mismatch would flag a large class of genuine product, because a Random Booster box carries the BOOSTER's code and not the code of the bey inside — the reference table records several, e.g. Pisces DF145BS under F2810 marked 'Random Booster TT'. AFTER: the mismatch is reported as a question with the Random Booster explanation offered, and ticking the box re-reads it as expected rather than suspicious.",
+        expectedUiState: "First submission: 'Discrepancy found' plus a row naming both codes. Second: not a discrepancy, plus a row reading 'Code does not match the model — but you said this is a Random Booster'.",
+        expectedData: { firstVerdict: "discrepancy-found", secondVerdict: "inconclusive" },
+        endResult: "Nothing is written either time.",
+    },
+    "checklist-content-discovery-authenticity-checker-ambiguous-name-asks-which-model": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter 'Valkyrie' as the model name, leave the code empty, and submit.",
+            "Confirm the tool does NOT announce one specific release.",
+            "Confirm a question appears asking which one, with several named options each showing its product code and generation.",
+            "Pick one option.",
+            "Confirm the result now names that release and the question is gone.",
+            "Answer no if the first submission confidently names a single Valkyrie.",
+        ],
+        inputs: { name: "Valkyrie" },
+        expectedBehaviour: "BEFORE: a best-match lookup picks the top scoring row and announces it — 'Matched Ultimate Valkyrie Legacy Variable'-9' — which is a confident answer to a question nobody asked, and every per-model fact after it (the expected product code above all) is then about the wrong bey. AFTER: several candidates at the same quality become a question; picking one pins it and re-runs.",
+        expectedUiState: "A question headed 'Which one? \"Valkyrie\" matches N releases', with one button per candidate labelled by name and hinting its code and generation. After the pick, a signal naming the chosen release.",
+        endResult: "Nothing is written. The pick is not remembered after reload.",
+    },
+    "checklist-content-discovery-authenticity-checker-takara-spelling-is-not-flagged": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter 'Storm Pegasis' (Takara Tomy's own spelling, with an i) and submit.",
+            "Confirm the bey resolves and NO signal suggests the spelling is a trademark-evasion tell.",
+            "Now enter 'Scythee Kronos' (a genuine evasion spelling, doubled e) and submit.",
+            "Confirm that one DOES carry the misspelling note.",
+            "Answer no if 'Storm Pegasis' is flagged, or if 'Scythee Kronos' is not.",
+        ],
+        inputs: { name: "Storm Pegasis" },
+        expectedBehaviour: "BEFORE: this project's counterfeit crawl lists `Pegasis` among the trademark-evasion spellings — true of that one catalogue, and NOT a general rule. Takara Tomy romanises the line as Pegasis (the corpus's own Japanese for Storm Pegasus is ストームペガシス) while Hasbro prints Pegasus. An earlier draft told the user that the spelling printed on a genuine Takara Tomy box was a sign of a fake. AFTER: the pair is registered as a legitimate variant, so it resolves as an alias and the warning stays silent; a real evasion spelling still trips it.",
+        expectedUiState: "'Storm Pegasis' → a signal reading 'Matched Storm Pegasus 105RF' with no mention of evasion. 'Scythee Kronos' → a signal reading 'Read as \"Scythe Kronos T125EDS\"' that does mention trademark evasion.",
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-funskool-is-not-a-fake-signal": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter 'Funskool' in 'Brand printed on the box' and submit.",
+            "Confirm the signal says Funskool is a LICENSED marque.",
+            "Confirm the verdict is not 'Likely reproduction'.",
+            "Now enter 'Rapidity' instead and submit.",
+            "Confirm that one IS reported as a known unlicensed producer, with a Safety block.",
+            "Answer no if Funskool is treated as a concern, or if Rapidity is not named.",
+        ],
+        inputs: { marque: "Funskool" },
+        expectedBehaviour: "BEFORE: a tool that only knows 'Takara Tomy / Hasbro' tells an Indian buyer holding a legitimate Funskool box that the brand is unrecognised — a false positive against a licensed importer, in this marketplace's main market. AFTER: the licensed set includes Funskool (India), Mani (Hong Kong), Sheng Tai (Singapore), NewBoy (Middle East) and the rest, and only named unlicensed producers reach a reproduction verdict.",
+        expectedUiState: "Funskool → a supporting signal naming it licensed and mentioning the regional importers. Rapidity → 'Likely reproduction', a signal naming Hongyi, and a Safety block about lead and cadmium.",
+        expectedData: { funskoolVerdict: "inconclusive", rapidityVerdict: "likely-reproduction" },
+        endResult: "Nothing is written either time.",
+    },
+    "checklist-content-discovery-authenticity-checker-unknown-code-is-not-called-fake": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Enter L9999 as the code and submit.",
+            "If asked which generation, choose Metal Fight.",
+            "Read the signal about the code.",
+            "Confirm it says the code is NOT RECORDED and explicitly that this does not mean fake.",
+            "Answer no if an unrecorded code is presented as evidence of a fake.",
+        ],
+        inputs: { code: "L9999", generation: "mfb" },
+        expectedBehaviour: "BEFORE: an absent lookup result reads as a negative result. The reference table is 90 distinct codes compiled by collectors from boxes they personally held, so it was never complete and new genuine codes surface regularly. AFTER: an unmatched code produces a neutral signal saying 'not recorded', with that reasoning stated.",
+        expectedUiState: "A neutral signal row saying L9999 is not in either table and that an absent code means 'not recorded', not 'fake'. The verdict is 'Inconclusive', never 'Likely reproduction'.",
+        expectedData: { verdict: "inconclusive" },
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-asks-generation-when-nothing-inferable": {
+        roles: ["buyer"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Submit the form with every field empty.",
+            "Confirm the tool asks for something rather than returning a verdict.",
+            "Now enter a name that matches nothing — 'zzzznope' — and submit.",
+            "Confirm a question appears asking which generation it is, with six options each naming years and example code prefixes.",
+            "Answer no if the tool returns any verdict at all without being able to establish a generation.",
+        ],
+        inputs: { name: "zzzznope" },
+        expectedBehaviour: "BEFORE: guessing a generation hands the user a confidently wrong checklist — tri-wing screws mean something on Burst and nothing on a 2001 plastic bey, and the box date-code table only covers the Metal series. AFTER: with no generation established the verdict is 'Need a bit more' and a question is asked, with the reason for asking stated.",
+        expectedUiState: "A 'Need a bit more' badge and a question headed 'Which generation is it?' with six buttons, each labelled with the generation, its years and an example code shape.",
+        expectedData: { verdict: "needs-input" },
+        endResult: "Nothing is changed.",
+    },
+    "checklist-content-discovery-authenticity-checker-api-refuses-signed-out": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Signed out, open the browser devtools console on /tools/authenticity.",
+            // A tester step is prose a human types into a devtools console: it cannot
+            // import a constant, and calling the real URL signed out IS the case.
+            // audit-hardcoded-api-routes-ok: literal URL inside a manual test procedure
+            "Run: await fetch('/api/tools/authenticity', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ code: 'A0813' }) }).then(r => r.status)",
+            "Confirm the status is 401 (or 403) and not 200.",
+            "Confirm the response body contains no assessment — no verdict, no signals.",
+            "Answer no if a signed-out call returns an assessment.",
+        ],
+        inputs: { code: "A0813" },
+        expectedBehaviour: "BEFORE: gating only the UI leaves the endpoint open, and the endpoint is where the output actually comes from — 'this matches a batch recorded as a midfake' read off an anonymous API is a quotable claim with no account behind it. AFTER: `auth: true` on the route refuses the call before the engine runs.",
+        expectedUiState: "The console shows 401 or 403. No verdict text appears anywhere in the response.",
+        expectedData: { status: 401 },
+        endResult: "Nothing is written; no assessment is produced.",
+    },
+    "checklist-content-discovery-authenticity-checker-json-ld-declares-the-gate": {
+        roles: ["guest"],
+        startPage: "/tools/authenticity",
+        steps: [
+            "Signed out, view source on /tools/authenticity (Ctrl+U, not devtools' rendered DOM).",
+            "Find the application/ld+json block with \"@type\": \"WebApplication\".",
+            "Confirm it carries isAccessibleForFree true at the top level and a hasPart entry with isAccessibleForFree FALSE and a cssSelector.",
+            "Copy that cssSelector value and run document.querySelectorAll(<selector>).length in the console.",
+            "Confirm the count is 1 — the selector matches a real element on the page.",
+            "Answer no if the selector matches nothing, or if the gate is undeclared.",
+        ],
+        expectedBehaviour: "BEFORE: a page with gated content and no declaration is a structured-data mismatch — and the alternative mistake, serving the reference content only to crawler user-agents, is cloaking. AFTER: the page declares the gate exactly as the guest-price gate does: the free reference content is marked free, and the lookup region is carved out by selector as not free. 🛑 Root Cause #93 is the record of the failure this case exists to catch — a class name and a selector living as two literals in two files, where a rename points the crawler at a selector matching nothing and looks identical to making no declaration at all.",
+        expectedUiState: "A WebApplication JSON-LD block naming the tool, plus a breadcrumb block. The hasPart cssSelector resolves to exactly one element in the live DOM.",
+        expectedData: { gatedSelectorMatches: 1 },
+        endResult: "Nothing is changed; this case only reads.",
+    },
+};