@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/_internal/server/functions/scheduled.d.ts

@@ -7,6 +7,7 @@ export declare const couponExpiry: import("./types").ScheduledFunctionDefinition
 export declare const offerExpiry: import("./types").ScheduledFunctionDefinition;
 export declare const productStatsSync: import("./types").ScheduledFunctionDefinition;
 export declare const revenueRollup: import("./types").ScheduledFunctionDefinition;
+export declare const searchIndexBuild: import("./types").ScheduledFunctionDefinition;
 export declare const priceIndexRollup: import("./types").ScheduledFunctionDefinition;
 export declare const analyticsAlertEvaluate: import("./types").ScheduledFunctionDefinition;
 export declare const pageViewRollup: import("./types").ScheduledFunctionDefinition;
@@ -27,4 +28,4 @@ export declare const prizeDrawExpiryReveal: import("./types").ScheduledFunctionD
 export declare const bundleStockSync: import("./types").ScheduledFunctionDefinition;
 export declare const emiInstallmentReminder: import("./types").ScheduledFunctionDefinition;
 export declare const catalogueImageStalenessReminder: import("./types").ScheduledFunctionDefinition;
-export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];
+export declare const SCHEDULED_FUNCTIONS: readonly [import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition, import("./types").ScheduledFunctionDefinition];

package/dist/_internal/server/functions/scheduled.js

@@ -1,6 +1,6 @@
 // Scheduled function definitions (Cloud Scheduler triggers).
 // Cron syntax accepts both Firebase shorthand and standard cron expressions.
-import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, priceIndexRollupHandler, analyticsAlertEvaluateHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testDataCleanupHandler, } from "../jobs/handlers/index.js";
+import { auctionSettlementHandler, autoPayoutEligibilityHandler, bundleStockSyncHandler, cartPruneHandler, cleanupRtdbEventsHandler, countersReconcileHandler, couponExpiryHandler, dailyDataCleanupHandler, draftPruneHandler, emiInstallmentReminderHandler, catalogueImageStalenessReminderHandler, mediaTmpCleanupHandler, notificationPruneHandler, offerExpiryHandler, paymentWindowTimeoutHandler, hardBanReinstatementHandler, paymentReviewAutoApproveHandler, pendingOrderTimeoutHandler, positionsReconcileHandler, prizeDrawExpiryRevealHandler, productStatsSyncHandler, revenueRollupHandler, priceIndexRollupHandler, searchIndexBuildHandler, analyticsAlertEvaluateHandler, pageViewRollupHandler, pageViewPruneHandler, dailyStatusDigestHandler, weeklyPayoutEligibilityHandler, testDataCleanupHandler, } from "../jobs/handlers/index.js";
 import { defineFunction } from "./define.js";
 const REGION = "asia-south1";
 const EVERY_5_MIN = "every 5 minutes";
@@ -83,6 +83,29 @@ export const revenueRollup = defineFunction({
  * additionally drop each category page's ISR entry nightly on a project that
  * was paused for exceeding ISR writes by 15.5×.
  */
+/*
+ * Build the public search index artifact — every 15 minutes, but it EXITS on
+ * one read unless something changed.
+ *
+ * 🛑 The cadence is not the cost. Firestore bills per document read
+ * regardless of `select()`, so a full rebuild at this cadence would be
+ * ~358,000 reads/day against a 50,000/day tier. The job is idle-exit /
+ * incremental / daily-full instead, landing at ~4,000/day. See the core's
+ * header; it logs its mode and read count on every run so a regression to
+ * always-full is visible before it is a quota wall.
+ *
+ * Its own job rather than folded into an existing cadence: `countersReconcile`
+ * and `productStatsSync` already run near their 540s ceiling, and a rebuild
+ * failing inside one would take category metrics down with it — the argument
+ * `priceIndexRollup` makes directly below.
+ */
+export const searchIndexBuild = defineFunction({
+    name: "searchIndexBuild",
+    description: "Build the public search index artifact into Storage (idle-exit / incremental / daily full).",
+    trigger: { kind: "schedule", cron: "*/15 * * * *", timeZone: "UTC" },
+    handler: searchIndexBuildHandler,
+    options: { region: REGION, timeoutSeconds: 540, memory: "512MiB", maxInstances: 1 },
+});
 export const priceIndexRollup = defineFunction({
     name: "priceIndexRollup",
     description: "Roll up realised sale prices per leaf category into priceIndex/{leafId} (daily 04:30 UTC = 10:00 IST).",
@@ -277,6 +300,7 @@ export const SCHEDULED_FUNCTIONS = [
     productStatsSync,
     revenueRollup,
     priceIndexRollup,
+    searchIndexBuild,
     analyticsAlertEvaluate,
     pageViewRollup,
     pageViewPrune,

package/dist/_internal/server/jobs/core/_event-ref.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Resolve an event reference from a value that may be either a document id or
+ * a slug — the ONE implementation for the `ctx.db` (job-core) layer.
+ *
+ * ## Why this exists
+ *
+ * Public URLs link by SLUG: `EventCard` builds its href from
+ * `event.slug ?? event.id`, and `/events/[id]/participate` reuses that same
+ * route param. So every job core reached from a public surface receives a slug
+ * far more often than an id.
+ *
+ * `assignSpinPrize` and `triggerEventRaffle` both did a bare
+ * `.collection("events").doc(eventId).get()` with no slug fallback, so a spin
+ * launched from any card link returned `event_not_found` — 404 on every
+ * attempt, forever. `enterEvent` had always resolved it correctly
+ * (`eventRepository.findByIdOrSlug`, under a comment saying "eventId may have
+ * arrived as a slug (public URLs link by slug)"); the two job cores were the
+ * copies that never learned the rule.
+ *
+ * ## Why not `eventRepository.findByIdOrSlug`
+ *
+ * That is the right call at the repository layer and `enterEvent` keeps using
+ * it. A job core holds a raw `Firestore` from `JobContext` and no repository —
+ * and no repository in this codebase imports another feature's, because of the
+ * Turbopack import-chain trap (Root Cause #6/#18). A raw collection read has
+ * neither problem. This function also returns the `DocumentReference`, which a
+ * repository method cannot, and the cores need it to write.
+ *
+ * ## Slug first, deliberately
+ *
+ * Mirrors `findByIdOrSlug`'s own order. The common caller is a public URL, so
+ * the slug query hits on the first try; an id lookup then costs one extra
+ * query only on the admin path, where it is already behind a role gate.
+ */
+import type { DocumentReference, Firestore } from "firebase-admin/firestore";
+export interface ResolvedEventRef<T = unknown> {
+    /** The canonical DOCUMENT ID — never the slug, whichever was passed in. */
+    id: string;
+    ref: DocumentReference;
+    data: T;
+}
+/**
+ * @returns the resolved event, or `null` when neither a slug nor an id matches.
+ *
+ * 🛑 Callers must use the returned `id` for every subsequent query and write.
+ * Carrying the caller's original `idOrSlug` forward is how a guest identity
+ * ends up hashed on the slug on one path and on the doc id on another — two
+ * identities for one person on one event, which silently resets any per-user
+ * cap (see `hashGuestIdentity` at the spin route).
+ */
+export declare function resolveEventRef<T = unknown>(db: Firestore, idOrSlug: string): Promise<ResolvedEventRef<T> | null>;

package/dist/_internal/server/jobs/core/_event-ref.js

@@ -0,0 +1,63 @@
+/**
+ * Resolve an event reference from a value that may be either a document id or
+ * a slug — the ONE implementation for the `ctx.db` (job-core) layer.
+ *
+ * ## Why this exists
+ *
+ * Public URLs link by SLUG: `EventCard` builds its href from
+ * `event.slug ?? event.id`, and `/events/[id]/participate` reuses that same
+ * route param. So every job core reached from a public surface receives a slug
+ * far more often than an id.
+ *
+ * `assignSpinPrize` and `triggerEventRaffle` both did a bare
+ * `.collection("events").doc(eventId).get()` with no slug fallback, so a spin
+ * launched from any card link returned `event_not_found` — 404 on every
+ * attempt, forever. `enterEvent` had always resolved it correctly
+ * (`eventRepository.findByIdOrSlug`, under a comment saying "eventId may have
+ * arrived as a slug (public URLs link by slug)"); the two job cores were the
+ * copies that never learned the rule.
+ *
+ * ## Why not `eventRepository.findByIdOrSlug`
+ *
+ * That is the right call at the repository layer and `enterEvent` keeps using
+ * it. A job core holds a raw `Firestore` from `JobContext` and no repository —
+ * and no repository in this codebase imports another feature's, because of the
+ * Turbopack import-chain trap (Root Cause #6/#18). A raw collection read has
+ * neither problem. This function also returns the `DocumentReference`, which a
+ * repository method cannot, and the cores need it to write.
+ *
+ * ## Slug first, deliberately
+ *
+ * Mirrors `findByIdOrSlug`'s own order. The common caller is a public URL, so
+ * the slug query hits on the first try; an id lookup then costs one extra
+ * query only on the admin path, where it is already behind a role gate.
+ */
+import { EVENT_FIELDS } from "../../../../constants/field-names.js";
+const EVENTS_COLLECTION = "events";
+/**
+ * @returns the resolved event, or `null` when neither a slug nor an id matches.
+ *
+ * 🛑 Callers must use the returned `id` for every subsequent query and write.
+ * Carrying the caller's original `idOrSlug` forward is how a guest identity
+ * ends up hashed on the slug on one path and on the doc id on another — two
+ * identities for one person on one event, which silently resets any per-user
+ * cap (see `hashGuestIdentity` at the spin route).
+ */
+export async function resolveEventRef(db, idOrSlug) {
+    if (!idOrSlug)
+        return null;
+    const bySlug = await db
+        .collection(EVENTS_COLLECTION)
+        .where(EVENT_FIELDS.SLUG, "==", idOrSlug)
+        .limit(1)
+        .get();
+    if (!bySlug.empty) {
+        const doc = bySlug.docs[0];
+        return { id: doc.id, ref: doc.ref, data: doc.data() };
+    }
+    const byId = await db.collection(EVENTS_COLLECTION).doc(idOrSlug).get();
+    if (byId.exists) {
+        return { id: byId.id, ref: byId.ref, data: byId.data() };
+    }
+    return null;
+}

package/dist/_internal/server/jobs/core/assignSpinPrize.d.ts

@@ -9,6 +9,23 @@
  * find/create/assign/mark-used sequence runs inside a single Firestore
  * transaction so two rapid spins from the same identity can't both win a
  * prize (the old read-then-`ref.update()` version had this race).
+ *
+ * ## Every non-success branch returns a `reason`, and that is load-bearing
+ *
+ * Both entry points — `POST /api/events/[id]/spin` and the Firebase callable —
+ * decide success by `if (data.reason && !data.spinPrizeId)`. A branch that
+ * returns early WITHOUT a reason is therefore reported to the caller as a
+ * successful spin that awarded nothing. Reasons come from
+ * `EVENT_DRAW_REASON`; `reasonToHttp` turns each into one status and one
+ * stable code for both entry points (Root Cause #85).
+ *
+ * The `FEATURE_PRIZE_DRAWS` gate that used to open this function was DELETED
+ * on 2026-10-19. The whole `FEATURE_*` mechanism had already been retired —
+ * `audit-feature-flags` bans it strict-zero and `.env.example` declares no
+ * such key — but that audit only matched `process.env.FEATURE_*`, and this
+ * read it as `ctx.env("FEATURE_PRIZE_DRAWS")`, which the regex could not see.
+ * So an env var nothing documented was never set in production and every spin
+ * returned 503 `feature_disabled` while the Spin button rendered enabled.
  */
 import type { JobContext } from "../runtime/types";
 export interface AssignSpinPrizeInput {
@@ -19,6 +36,7 @@ export interface AssignSpinPrizeInput {
     guestIpHash?: string;
 }
 export interface AssignSpinPrizeResult {
+    /** The canonical DOCUMENT ID, even when the caller passed a slug. */
     eventId: string;
     userId?: string;
     spinPrizeId?: string;

package/dist/_internal/server/jobs/core/assignSpinPrize.js

@@ -9,39 +9,88 @@
  * find/create/assign/mark-used sequence runs inside a single Firestore
  * transaction so two rapid spins from the same identity can't both win a
  * prize (the old read-then-`ref.update()` version had this race).
+ *
+ * ## Every non-success branch returns a `reason`, and that is load-bearing
+ *
+ * Both entry points — `POST /api/events/[id]/spin` and the Firebase callable —
+ * decide success by `if (data.reason && !data.spinPrizeId)`. A branch that
+ * returns early WITHOUT a reason is therefore reported to the caller as a
+ * successful spin that awarded nothing. Reasons come from
+ * `EVENT_DRAW_REASON`; `reasonToHttp` turns each into one status and one
+ * stable code for both entry points (Root Cause #85).
+ *
+ * The `FEATURE_PRIZE_DRAWS` gate that used to open this function was DELETED
+ * on 2026-10-19. The whole `FEATURE_*` mechanism had already been retired —
+ * `audit-feature-flags` bans it strict-zero and `.env.example` declares no
+ * such key — but that audit only matched `process.env.FEATURE_*`, and this
+ * read it as `ctx.env("FEATURE_PRIZE_DRAWS")`, which the regex could not see.
+ * So an env var nothing documented was never set in production and every spin
+ * returned 503 `feature_disabled` while the Spin button rendered enabled.
  */
 import crypto from "node:crypto";
-import { EVENT_ENTRY_FIELDS, COMMON_FIELDS } from "../../../../constants/field-names.js";
+import { EVENT_ENTRY_FIELDS, EVENT_FIELDS, COMMON_FIELDS, } from "../../../../constants/field-names.js";
 import { resolveDate } from "../../../../utils/index.js";
-const EVENTS_COLLECTION = "events";
+import { resolveEventRef } from "./_event-ref.js";
+import { EVENT_DRAW_REASON } from "./event-draw-reasons.js";
 const EVENT_ENTRIES_COLLECTION = "eventEntries";
 const COUPONS_COLLECTION = "coupons";
 export async function runAssignSpinPrize(input, ctx) {
-    if (ctx.env("FEATURE_PRIZE_DRAWS") !== "true") {
-        ctx.logger.info("FEATURE_PRIZE_DRAWS disabled — skipping spin prize assignment");
-        return { eventId: input.eventId, userId: input.userId, reason: "feature_disabled" };
-    }
-    const { eventId, userId, guestIpHash } = input;
+    const { userId, guestIpHash } = input;
     if (!userId && !guestIpHash) {
-        return { eventId, userId, reason: "identity_required" };
+        return {
+            eventId: input.eventId,
+            userId,
+            reason: EVENT_DRAW_REASON.IDENTITY_REQUIRED,
+        };
+    }
+    /*
+     * 🛑 Slug-or-id, not `.doc(eventId)`. Public URLs link by SLUG (`EventCard`
+     * builds its href from `event.slug ?? event.id`, and the participate tab
+     * reuses that param), so a spin launched from any card link used to resolve
+     * to nothing and return `event_not_found` — a 404 on every attempt, forever.
+     *
+     * Every query and write below uses the RESOLVED `eventId`, never the
+     * caller's input: carrying the slug forward is what let one guest count as
+     * two identities and silently reset `spinMaxPerUser`.
+     */
+    const resolved = await resolveEventRef(ctx.db, input.eventId);
+    if (!resolved) {
+        return {
+            eventId: input.eventId,
+            userId,
+            reason: EVENT_DRAW_REASON.EVENT_NOT_FOUND,
+        };
+    }
+    const eventId = resolved.id;
+    const event = resolved.data;
+    /*
+     * The page redirects a non-running event to the overview, so these were
+     * never reachable through the UI — but `POST /api/events/<ended>/spin`
+     * answered 200 and awarded a prize. A redirect is navigation, not a
+     * precondition.
+     */
+    if (event.type && event.type !== EVENT_FIELDS.TYPE_VALUES.SPIN_WHEEL) {
+        return { eventId, userId, reason: EVENT_DRAW_REASON.NOT_A_SPIN_WHEEL };
     }
-    const eventSnap = await ctx.db.collection(EVENTS_COLLECTION).doc(eventId).get();
-    if (!eventSnap.exists) {
-        return { eventId, userId, reason: "event_not_found" };
+    const endsAt = resolveDate(event.endsAt);
+    if (event.status !== EVENT_FIELDS.STATUS_VALUES.ACTIVE ||
+        (endsAt && ctx.now > endsAt)) {
+        return { eventId, userId, reason: EVENT_DRAW_REASON.NOT_ACTIVE };
     }
-    const event = eventSnap.data();
     if (!userId && !event.allowGuestParticipation) {
-        return { eventId, userId, reason: "login_required" };
+        return { eventId, userId, reason: EVENT_DRAW_REASON.LOGIN_REQUIRED };
     }
-    const prizes = Array.isArray(event.spinPrizes) ? event.spinPrizes : [];
+    // Active prizes only — see the `isActive` note on SpinPrize. The weighted
+    // pick below iterates this same array, so the gate and the draw agree.
+    const prizes = (Array.isArray(event.spinPrizes) ? event.spinPrizes : []).filter((p) => p.isActive !== false);
     const totalWeight = prizes.reduce((s, p) => s + (p.weight ?? 0), 0);
     if (totalWeight <= 0) {
-        return { eventId, userId, reason: "no_prizes_configured" };
+        return { eventId, userId, reason: EVENT_DRAW_REASON.NO_PRIZES_CONFIGURED };
     }
     const windowStart = resolveDate(event.spinWindowStart);
     const windowEnd = resolveDate(event.spinWindowEnd);
     if ((windowStart && ctx.now < windowStart) || (windowEnd && ctx.now > windowEnd)) {
-        return { eventId, userId, reason: "outside_spin_window" };
+        return { eventId, userId, reason: EVENT_DRAW_REASON.OUTSIDE_SPIN_WINDOW };
     }
     const maxPerUser = typeof event.spinMaxPerUser === "number" && event.spinMaxPerUser > 0
         ? event.spinMaxPerUser
@@ -59,11 +108,23 @@ export async function runAssignSpinPrize(input, ctx) {
         const existingData = existingDoc?.data();
         const priorSpinCount = existingData?.spinCount ?? (existingData?.spinUsed ? 1 : 0);
         if (priorSpinCount >= maxPerUser) {
+            /*
+             * 🛑 `reason` is REQUIRED here, and its absence was a bug.
+             *
+             * Both entry points gate on `if (data.reason && !data.spinPrizeId)`, so
+             * this branch used to fall through to `successResponse(…, "Spin
+             * recorded")` — HTTP 200 for a refusal. When the stored entry happened
+             * to carry no `spinPrizeId`, the client then saw a 200 with no prize and
+             * printed "Spin failed. Please try again." for what is really "you have
+             * already spun".
+             */
             return {
                 eventId,
                 userId,
                 spinPrizeId: existingData?.spinPrizeId,
+                spinPrizeCouponCode: existingData?.spinPrizeCouponCode ?? undefined,
                 alreadyUsed: true,
+                reason: EVENT_DRAW_REASON.ALREADY_USED,
             };
         }
         const roll = crypto.randomInt(0, totalWeight);

package/dist/_internal/server/jobs/core/auctionSettlement.js

@@ -211,10 +211,19 @@ async function settleAuction(ctx, product) {
     });
 }
 export async function runAuctionSettlement(ctx) {
-    if (ctx.env("FEATURE_AUCTIONS") !== "true") {
-        ctx.logger.info("FEATURE_AUCTIONS disabled — skipping auction settlement");
-        return;
-    }
+    /*
+     * 🛑 `FEATURE_AUCTIONS` gate DELETED 2026-10-19, and this one was live.
+     *
+     * The flag mechanism was retired on 2026-08-29, but `audit-feature-flags`
+     * only matched `process.env.FEATURE_*` and this read it through
+     * `ctx.env(...)` — so it survived unseen. This is a SCHEDULED Firebase
+     * Function, which reads `functions/.env.<projectId>`, and measured on
+     * 2026-10-19 that file contains exactly one flag: `FEATURE_PAYOUTS=true`.
+     * `FEATURE_AUCTIONS` was never set there, so this sweep returned on its
+     * first line on every run — no expired auction was ever settled in
+     * production, no winner ever got a cart line, and the only trace was an
+     * `info` log saying it had been skipped.
+     */
     ctx.logger.info("Starting auction settlement sweep");
     const expired = await productRepository.getExpiredAuctions(ctx.now);
     if (expired.length === 0) {

package/dist/_internal/server/jobs/core/autoPayoutEligibility.js

@@ -12,10 +12,10 @@ function getBusinessDayCutoff(daysAgo) {
     return cutoff;
 }
 export async function runAutoPayoutEligibility(ctx) {
-    if (ctx.env("FEATURE_PAYOUTS") !== "true") {
-        ctx.logger.info("FEATURE_PAYOUTS disabled — skipping auto-payout eligibility");
-        return;
-    }
+    // `FEATURE_PAYOUTS` gate deleted 2026-10-19 — see `auctionSettlement.ts`.
+    // This was the one flag actually set (`functions/.env.letitrip-in-app`), so
+    // unlike its four siblings this job was running; removing the gate is a
+    // no-op in behaviour and removes the lever that could silently stop payouts.
     ctx.logger.info("Starting daily auto-payout eligibility sweep", {
         windowDays: AUTO_PAYOUT_WINDOW_DAYS,
     });
@@ -48,6 +48,26 @@ export async function runAutoPayoutEligibility(ctx) {
             ctx.logger.warn(`Store/seller ${storeId} not found — skipping ${orders.length} order(s)`, { orderIds: orders.map((o) => o.id) });
             continue;
         }
+        /*
+         * 🛑 REVEALED before building a payout. This is the fix for active data
+         * corruption, not a style change.
+         *
+         * `userRepository.findById` is ciphertext-by-default, and
+         * `payoutRepository.createPayout` ENCRYPTS `sellerEmail` and `upiId`
+         * (`PAYOUT_PII_FIELDS`). Passing the stored values straight through
+         * encrypted them a SECOND time, and nothing in the codebase ever
+         * double-decrypts — so every payout this cron wrote carried a
+         * permanently unreadable `upiId`, which is the field the money is sent to.
+         *
+         * It also poisoned the blind index: `piiIndicesFor` HMACs whatever it is
+         * given, so hashing already-encrypted input produced a valid-looking
+         * `sellerEmailIndex` that can never match a lookup by the real address.
+         *
+         * `payoutDetails` needs its own unwrap because it is encrypted by
+         * `encryptPayoutDetails`, a separate scheme from the `piiFields` path, so
+         * `revealUser` handles it explicitly.
+         */
+        const sellerPlain = userRepository.revealUser(seller);
         const sellerId = store.ownerId;
         /*
          * The TAXABLE VALUE — see `orderTaxableValue`. Two narrowings, both
@@ -65,8 +85,9 @@ export async function runAutoPayoutEligibility(ctx) {
         const { platformFee, gatewayFee, gstOnFee: gstAmount, netAmount } = computePayoutDeduction(grossAmount, commissions);
         const payoutInput = {
             storeId,
-            sellerName: (seller.displayName ?? seller.email ?? sellerId),
-            sellerEmail: (seller.email ?? ""),
+            // `displayName` is plaintext by D1; the email fallback must be revealed.
+            sellerName: (seller.displayName ?? sellerPlain.email ?? sellerId),
+            sellerEmail: sellerPlain.email ?? "",
             orderIds: orders.map((o) => o.id),
             amount: netAmount,
             grossAmount,
@@ -79,23 +100,31 @@ export async function runAutoPayoutEligibility(ctx) {
             isAutomatic: true,
             currency: getDefaultCurrency(),
             status: "pending",
-            paymentMethod: seller.payoutDetails?.method === "upi"
+            paymentMethod: sellerPlain.payoutDetails?.method === "upi"
                 ? "upi"
                 : "bank_transfer",
-            upiId: seller.payoutDetails?.method === "upi" ? seller.payoutDetails.upiId : undefined,
-            bankAccount: seller.payoutDetails?.method === "bank_transfer" &&
-                seller.payoutDetails.bankAccount
+            upiId: sellerPlain.payoutDetails?.method === "upi"
+                ? sellerPlain.payoutDetails.upiId
+                : undefined,
+            /*
+             * Only the MASKED account fields are copied, which is why this block
+             * escaped the double-encryption above — `accountNumberMasked`,
+             * `ifscCode` and `bankName` are in no PII list. The real
+             * `accountNumber` is deliberately not carried onto the payout.
+             */
+            bankAccount: sellerPlain.payoutDetails?.method === "bank_transfer" &&
+                sellerPlain.payoutDetails.bankAccount
                 ? {
-                    accountHolderName: seller.payoutDetails.bankAccount.accountHolderName,
-                    accountNumberMasked: seller.payoutDetails.bankAccount.accountNumberMasked,
-                    ifscCode: seller.payoutDetails.bankAccount.ifscCode,
-                    bankName: seller.payoutDetails.bankAccount.bankName,
+                    accountHolderName: sellerPlain.payoutDetails.bankAccount.accountHolderName,
+                    accountNumberMasked: sellerPlain.payoutDetails.bankAccount.accountNumberMasked,
+                    ifscCode: sellerPlain.payoutDetails.bankAccount.ifscCode,
+                    bankName: sellerPlain.payoutDetails.bankAccount.bankName,
                 }
                 : undefined,
             notes: `Auto-payout — ${orders.length} delivered order(s) past ${AUTO_PAYOUT_WINDOW_DAYS}-day window`,
             requestedAt: new Date(),
         };
-        const { id: payoutId } = await payoutRepository.create(payoutInput);
+        const { id: payoutId } = await payoutRepository.createPayout(payoutInput);
         for (let i = 0; i < orders.length; i += BATCH_LIMIT) {
             const slice = orders.slice(i, i + BATCH_LIMIT);
             const batch = ctx.db.batch();

package/dist/_internal/server/jobs/core/bundleStockSync.js

@@ -51,10 +51,9 @@ async function sweepBundleMembers(productIds, ctx) {
     };
 }
 export async function runBundleStockSync(ctx) {
-    if (ctx.env("FEATURE_BUNDLES") !== "true") {
-        ctx.logger.info("FEATURE_BUNDLES disabled — skipping bundle stock sync");
-        return;
-    }
+    // `FEATURE_BUNDLES` gate deleted 2026-10-19 — see `auctionSettlement.ts` for
+    // why these survived the 2026-08-29 flag retirement. Unset in
+    // `functions/.env.letitrip-in-app`, so this scheduled sweep had never run.
     ctx.logger.info("Bundle stock sync starting (SB-UNI-V categories)");
     const snap = await ctx.db
         .collection(CATEGORIES_COLLECTION)

package/dist/_internal/server/jobs/core/cleanupRtdbEvents.js

@@ -16,6 +16,16 @@ const EMAIL_STALE_MS = 60 * 60 * 1000;
 /** Long enough for an open thread to notice a ping before it prunes; the
  * message itself lives in Firestore regardless — this only clears the ping. */
 const CHAT_STALE_MS = 15 * 60 * 1000;
+/**
+ * 🛑 SIXTY minutes, and the four-times-longer window is load-bearing rather
+ * than cautious. A `max`-tier trace fans out across up to sixty parts and can
+ * exceed fifteen minutes end to end; a channel pruned while the run is still
+ * working reads to the client as "it died", which is the one signal this
+ * channel exists to make impossible. The durable history is on the run
+ * document, so the cost of keeping the node an hour is a handful of small
+ * nodes and the cost of dropping it early is a false failure report.
+ */
+const STICKER_TRACE_STALE_MS = 60 * 60 * 1000;
 const JOBS_TTL_DAYS = 30;
 export async function runCleanupRtdbEvents(ctx) {
     ctx.logger.info("Starting RTDB events cleanup");
@@ -111,6 +121,40 @@ export async function runCleanupRtdbEvents(ctx) {
         void normalizeError(emailErr);
         ctx.logger.error("Email events cleanup failed (non-fatal)", emailErr);
     }
+    /*
+     * Sticker kiss-cut tracer progress channels. One node per run, overwritten
+     * in place as the trace advances, so the channel's size is bounded by
+     * concurrent runs rather than by history — but only because this prunes it.
+     * `auction-bids/*` is the Firebase budget's one family with no TTL; do not
+     * make this the second.
+     *
+     * The run DOCUMENT keeps the durable event log, so removing a node loses
+     * nothing a retry panel or a post-mortem reads.
+     */
+    try {
+        const traceSnap = await rtdb.ref(RTDB_PATHS.STICKER_TRACE).get();
+        if (traceSnap.exists()) {
+            const allTraceNodes = traceSnap.val();
+            const staleTraceIds = Object.entries(allTraceNodes)
+                .filter(([, node]) => {
+                const at = node.updatedAt ?? 0;
+                // Missing or non-finite is stale BY DEFINITION — it can never age
+                // out on its own, so leaving it would pin the node forever.
+                return !Number.isFinite(at) || at === 0 || at < now - STICKER_TRACE_STALE_MS;
+            })
+                .map(([id]) => id);
+            if (staleTraceIds.length > 0) {
+                await Promise.all(staleTraceIds.map((id) => rtdb.ref(`${RTDB_PATHS.STICKER_TRACE}/${id}`).remove()));
+                ctx.logger.info("Sticker trace progress nodes removed", {
+                    count: staleTraceIds.length,
+                });
+            }
+        }
+    }
+    catch (traceErr) {
+        void normalizeError(traceErr);
+        ctx.logger.error("Sticker trace cleanup failed (non-fatal)", traceErr);
+    }
     /*
      * D9 — chat new-message pings. Its own file says it: "an unpruned RTDB
      * channel is precisely the thing that quietly accumulates… Do not make it

package/dist/_internal/server/jobs/core/event-draw-reasons.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The ONE reason → {HTTP status, stable code} map for the two event prize-draw
+ * job cores (`assignSpinPrize`, `triggerEventRaffle`).
+ *
+ * ## Why this exists
+ *
+ * Each core returns a `reason` string instead of throwing, and each is reachable
+ * by TWO entry points — a Next.js API route and a Firebase callable handler.
+ * That made four translations of one vocabulary, and all four disagreed:
+ *
+ *   · `api/events/[id]/spin/route.ts`       — had `feature_disabled`, no `not_active`
+ *   · `jobs/handlers/assignSpinPrize.ts`    — `identity_required` → 400 (route said 401),
+ *                                             no `feature_disabled` branch at all
+ *   · `api/admin/events/[id]/trigger-raffle/route.ts` — EVERYTHING → 409
+ *   · `jobs/handlers/triggerEventRaffle.ts` — only 404 / 422
+ *
+ * Root Cause #85 ("a handler reachable by two entry points with different
+ * behaviour"), four times over in one feature. The spin route's own header
+ * already documented the trap and still only fixed its own half.
+ *
+ * ## Two rules that produced real bugs
+ *
+ * 1. 🛑 **A PERMANENT refusal must never take a retryable status.** The spin
+ *    route's fallback was 409 (`ALREADY_EXISTS`), described in its own comment
+ *    as "a benign can't-spin-right-now state". An unlisted permanent reason
+ *    therefore shipped `{code:"ALREADY_EXISTS", error:"<reason>"}` — an envelope
+ *    naming two unrelated things — which the UI rendered as "Spin failed.
+ *    Please try again.", inviting a retry that could never succeed.
+ *
+ * 2. 🛑 **A reason-less result is a SUCCESS to both routes.** Both check
+ *    `if (data.reason && !data.<successField>)`, so a core branch that returned
+ *    early *without* a `reason` fell through to `successResponse`.
+ *    `triggerEventRaffle`'s feature-flag branch did exactly that and answered
+ *    `200 "Raffle triggered"` with no winner. Every non-success branch in either
+ *    core must set a reason from this map.
+ *
+ * There is deliberately NO fallback entry here: `reasonToHttp` is exhaustive
+ * over `EventDrawReason`, so adding a reason without a status is a compile
+ * error rather than a silent 409.
+ */
+export declare const EVENT_DRAW_REASON: {
+    /** Neither a signed-in user nor a hashed guest identity was supplied. */
+    readonly IDENTITY_REQUIRED: "identity_required";
+    /** Guest attempt on an event that has not opted into guest participation. */
+    readonly LOGIN_REQUIRED: "login_required";
+    readonly EVENT_NOT_FOUND: "event_not_found";
+    /** Draft / paused / cancelled / ended — see each core's status precondition. */
+    readonly NOT_ACTIVE: "not_active";
+    readonly NO_PRIZES_CONFIGURED: "no_prizes_configured";
+    readonly OUTSIDE_SPIN_WINDOW: "outside_spin_window";
+    /** This identity has already consumed its `spinMaxPerUser` allowance. */
+    readonly ALREADY_USED: "already_used";
+    readonly NOT_A_SPIN_WHEEL: "not_a_spin_wheel";
+    readonly NOT_A_RAFFLE: "not_a_raffle";
+    /** A winner is already recorded; a second draw would mean two winners. */
+    readonly ALREADY_TRIGGERED: "already_triggered";
+    readonly NO_ELIGIBLE_ENTRIES: "no_eligible_entries";
+};
+export type EventDrawReason = (typeof EVENT_DRAW_REASON)[keyof typeof EVENT_DRAW_REASON];
+export interface EventDrawHttpMapping {
+    status: number;
+    /** Stable code the client resolves through `toUserMessage` / `errors.codes.*`. */
+    code: string;
+    /**
+     * Developer-facing fallback sentence. The client renders copy from `code`, so
+     * this is what shows in a log, a curl, or a locale with no key — never the
+     * primary UI string.
+     */
+    message: string;
+}
+/**
+ * Translate a core's `reason` into the response shape both entry points use.
+ *
+ * An unrecognised reason maps to **500**, not to the old 409 fallback: a reason
+ * this map has never heard of is a bug in the core, and a 5xx is what gets it
+ * recorded by `onRequestError` instead of being filed as an ordinary conflict.
+ */
+export declare function reasonToHttp(reason: string | undefined): EventDrawHttpMapping;