@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/_internal/server/jobs/core/triggerEventRaffle.js

@@ -1,40 +1,121 @@
 /**
  * Core: select a raffle winner for an event using `crypto.randomInt()`. Pool
  * logic keys off the event's `raffleType`.
+ *
+ * ## Three things in here had never worked
+ *
+ * 1. **The pool query could not match any entry created by this app.** It
+ *    asked for `status == "CONFIRMED"` — a real field with a real admin
+ *    workflow (`AdminAllEventEntriesView`'s Confirm / Waitlist / Cancel row
+ *    actions) but with NO writer at creation time. `enterEvent` never set it
+ *    and neither did the seed, so the pool was empty unless an admin had
+ *    hand-confirmed every entry one row at a time — on a raffle seeded with
+ *    1,892 entries. Every draw returned `no_eligible_entries`; the raffle had
+ *    never once been drawable.
+ *
+ *    The predicate is now `reviewStatus == "approved"`: written on every entry
+ *    path, already indexed `(eventId, reviewStatus, submittedAt DESC)`, and
+ *    auto-approved for raffles by `enterEvent`. `status` keeps its RSVP
+ *    meaning and is deliberately NOT the gate — see the note on both fields in
+ *    `constants/field-names.ts`.
+ *
+ * 2. **`drawsPermitted: 1` was not enforced.** The already-drawn check and the
+ *    winner write sat outside any transaction, so two concurrent admin clicks
+ *    both saw no winner and both wrote — two winners for one prize. The
+ *    check-and-write is now inside `runTransaction`, following the sibling
+ *    core `prizeDrawAssignWinner`.
+ *
+ * 3. **The winner was never told.** A winner was recorded and the only way to
+ *    find out was to revisit the event page.
+ *
+ * The `FEATURE_PRIZE_DRAWS` gate that used to open this function was deleted
+ * 2026-10-19 — see the header of `assignSpinPrize.ts`. Its branch here was the
+ * second-worst shaped of the nine: it returned early with **no `reason`**, and
+ * the route decides success by `if (data.reason && !data.raffleWinnerUserId)`,
+ * so a disabled feature answered `200 "Raffle triggered"` with no winner.
  */
 import crypto from "node:crypto";
-import { EVENT_ENTRY_FIELDS } from "../../../../constants/field-names.js";
-const EVENTS_COLLECTION = "events";
+import { normalizeError } from "../../../../errors/normalize.js";
+import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
+import { EVENT_ENTRY_FIELDS, EVENT_FIELDS } from "../../../../constants/field-names.js";
+import { EVENT_ENTRY_PII_FIELDS, maskPii } from "../../../../security/index.js";
+import { resolveEventRef } from "./_event-ref.js";
+import { EVENT_DRAW_REASON } from "./event-draw-reasons.js";
+/**
+ * The winner's display name, masked for a PUBLIC announcement.
+ *
+ * `maskPii` rather than `eventEntryRepository.maskedEntry` because the pool
+ * here is typed as a local `EntryDoc`, not a full `EventEntryDocument` — and
+ * `maskPii` takes a plain object, so no cast is needed to use the shared rule.
+ */
+const maskedWinnerName = (data) => maskPii(data, EVENT_ENTRY_PII_FIELDS).userDisplayName;
 const EVENT_ENTRIES_COLLECTION = "eventEntries";
+const COUPONS_COLLECTION = "coupons";
 export async function runTriggerEventRaffle(input, ctx) {
-    if (ctx.env("FEATURE_PRIZE_DRAWS") !== "true") {
-        ctx.logger.info("FEATURE_PRIZE_DRAWS disabled — skipping event raffle");
-        return { eventId: input.eventId, raffleEntryCount: 0 };
-    }
-    const eventRef = ctx.db.collection(EVENTS_COLLECTION).doc(input.eventId);
-    const eventSnap = await eventRef.get();
-    if (!eventSnap.exists) {
+    // Slug-or-id — the admin UI passes a doc id, but this shares its resolver
+    // with the spin core, which is reached from public slug URLs.
+    const resolved = await resolveEventRef(ctx.db, input.eventId);
+    if (!resolved) {
         return {
             eventId: input.eventId,
             raffleEntryCount: 0,
-            reason: "event_not_found",
+            reason: EVENT_DRAW_REASON.EVENT_NOT_FOUND,
         };
     }
-    const event = eventSnap.data();
+    const eventId = resolved.id;
+    const eventRef = resolved.ref;
+    const event = resolved.data;
+    /*
+     * Nothing checked that this event HAS a raffle, so the runner would happily
+     * draw a winner on a poll or a sale and write `raffleWinnerUserId` onto it.
+     * `hasRaffle` is the bolt-on flag; `type === "raffle"` is the dedicated
+     * event type. Either qualifies — a raffle-typed event with the flag unset is
+     * a seeding omission, not a reason to refuse a legitimate draw.
+     */
+    if (event.hasRaffle !== true && event.type !== EVENT_FIELDS.TYPE_VALUES.RAFFLE) {
+        return { eventId, raffleEntryCount: 0, reason: EVENT_DRAW_REASON.NOT_A_RAFFLE };
+    }
+    /*
+     * A draw is permitted on an ACTIVE or ENDED event, and deliberately not on
+     * draft / paused / cancelled. "Ended" is the normal case — a raffle is drawn
+     * after entries close — so gating on `active` alone would refuse every real
+     * draw. Cancelled is the one that matters: drawing a winner for a cancelled
+     * raffle creates an obligation nobody intended.
+     */
+    if (event.status !== EVENT_FIELDS.STATUS_VALUES.ACTIVE &&
+        event.status !== EVENT_FIELDS.STATUS_VALUES.ENDED) {
+        return { eventId, raffleEntryCount: 0, reason: EVENT_DRAW_REASON.NOT_ACTIVE };
+    }
+    // Cheap pre-check so the common "already drawn" case costs no transaction.
+    // The authoritative check is inside the transaction below — this one races.
     if (event.raffleWinnerUserId) {
         return {
-            eventId: input.eventId,
+            eventId,
             raffleEntryCount: 0,
             alreadyTriggered: true,
             raffleWinnerUserId: event.raffleWinnerUserId,
+            reason: EVENT_DRAW_REASON.ALREADY_TRIGGERED,
         };
     }
     const raffleType = input.raffleType ?? event.raffleType ?? "open_raffle";
     const topN = input.topN ?? event.raffleTopN ?? 0;
+    /*
+     * Built OUTSIDE the transaction, on purpose. The pool can be large (a seeded
+     * raffle claims 1,892 entries) and a Firestore transaction holds locks for
+     * everything it reads — so reading the pool inside would make a draw scale
+     * its lock footprint with entrant count. The same split as
+     * `prizeDrawAssignWinner`: read the candidates normally, then do the
+     * check-and-write transactionally.
+     *
+     * 🛑 `reviewStatus == "approved"`, NOT `status == "CONFIRMED"`. See this
+     * file's header. `enterEvent` now auto-approves raffle entries, so a live
+     * entrant lands in this pool without an admin touching anything; a FLAGGED
+     * entry correctly drops out of it.
+     */
     const entriesSnap = await ctx.db
         .collection(EVENT_ENTRIES_COLLECTION)
-        .where(EVENT_ENTRY_FIELDS.EVENT_ID, "==", input.eventId)
-        .where(EVENT_ENTRY_FIELDS.STATUS, "==", EVENT_ENTRY_FIELDS.STATUS_VALUES.CONFIRMED)
+        .where(EVENT_ENTRY_FIELDS.EVENT_ID, "==", eventId)
+        .where(EVENT_ENTRY_FIELDS.REVIEW_STATUS, "==", EVENT_ENTRY_FIELDS.REVIEW_STATUS_VALUES.APPROVED)
         .get();
     let pool = entriesSnap.docs.map((d) => ({
         id: d.id,
@@ -60,32 +141,133 @@ export async function runTriggerEventRaffle(input, ctx) {
     }
     if (pool.length === 0) {
         return {
-            eventId: input.eventId,
+            eventId,
             raffleEntryCount: 0,
-            reason: "no_eligible_entries",
+            reason: EVENT_DRAW_REASON.NO_ELIGIBLE_ENTRIES,
         };
     }
-    const winnerIdx = crypto.randomInt(0, pool.length);
-    const winner = pool[winnerIdx];
-    await eventRef.update({
-        raffleWinnerUserId: winner.data.userId,
-        raffleWinnerDisplayName: winner.data.userDisplayName ?? "",
-        raffleWinnerEntryId: winner.id,
-        raffleTriggeredAt: ctx.now,
-        raffleEntryCount: entriesSnap.size,
-        raffleGithubFunctionUrl: `${ctx.env("PROOF_OF_FAIRNESS_BASE_URL") ?? ""}/raffles/${input.eventId}.json`,
-        updatedAt: ctx.now,
+    /*
+     * Resolve the prize coupon's CODE before the transaction and record it on the
+     * event alongside the winner.
+     *
+     * `rafflePrizeCouponId` was write-only: accepted by the admin create/update
+     * routes, declared in `EVENT_FIELDS`, rendered by the winner page — and never
+     * read by this runner. Recording the code here makes the prize durable
+     * against a later edit of the event's coupon, the same reason
+     * `assignSpinPrize` stores `spinPrizeCouponCode` on the entry rather than
+     * re-deriving it. Resolution is best-effort: a missing coupon must not cost
+     * somebody their win.
+     */
+    let rafflePrizeCouponCode;
+    if (event.rafflePrizeCouponId) {
+        const coupSnap = await ctx.db
+            .collection(COUPONS_COLLECTION)
+            .doc(event.rafflePrizeCouponId)
+            .get();
+        if (coupSnap.exists) {
+            rafflePrizeCouponCode = coupSnap.data().code;
+        }
+        else {
+            ctx.logger.warn("Raffle prize couponId does not resolve to a coupon", {
+                eventId,
+                couponId: event.rafflePrizeCouponId,
+            });
+        }
+    }
+    /*
+     * 🛑 The one-draw invariant. Re-read the event INSIDE the transaction.
+     *
+     * The pre-check above reads outside it, so two admins clicking at the same
+     * moment both pass it. Firestore aborts and retries a transaction whose read
+     * set changed, so whichever commits second sees the first winner here and
+     * bails. Two winners for one prize is the failure the tester's own case
+     * calls the most serious on this page, and it was fully reachable.
+     */
+    const drawn = await ctx.db.runTransaction(async (tx) => {
+        const fresh = await tx.get(eventRef);
+        const freshData = (fresh.data() ?? {});
+        if (freshData.raffleWinnerUserId) {
+            return {
+                alreadyTriggered: true,
+                raffleWinnerUserId: freshData.raffleWinnerUserId,
+            };
+        }
+        const winner = pool[crypto.randomInt(0, pool.length)];
+        const maskedName = maskedWinnerName(winner.data) ?? "";
+        tx.update(eventRef, {
+            [EVENT_FIELDS.RAFFLE_WINNER_USER_ID]: winner.data.userId,
+            /*
+             * 🛑 MASKED, not raw. `userDisplayName` is an `EVENT_ENTRY_PII_FIELDS`
+             * member, so an entry read returns ciphertext — and this writes onto the
+             * EVENT document, where the field is neither encrypted nor decrypted, and
+             * is then shown PUBLICLY as the raffle winner. Masked rather than revealed
+             * because a public winner announcement is exactly the surface that should
+             * read "R*** K***".
+             */
+            [EVENT_FIELDS.RAFFLE_WINNER_DISPLAY_NAME]: maskedName,
+            [EVENT_FIELDS.RAFFLE_WINNER_ENTRY_ID]: winner.id,
+            [EVENT_FIELDS.RAFFLE_TRIGGERED_AT]: ctx.now,
+            [EVENT_FIELDS.RAFFLE_ENTRY_COUNT]: entriesSnap.size,
+            ...(rafflePrizeCouponCode ? { rafflePrizeCouponCode } : {}),
+            [EVENT_FIELDS.RAFFLE_GITHUB_FUNCTION_URL]: `${ctx.env("PROOF_OF_FAIRNESS_BASE_URL") ?? ""}/raffles/${eventId}.json`,
+            [EVENT_FIELDS.UPDATED_AT]: ctx.now,
+        });
+        return {
+            alreadyTriggered: false,
+            winnerId: winner.id,
+            userId: winner.data.userId,
+            maskedName,
+        };
     });
+    if (drawn.alreadyTriggered) {
+        return {
+            eventId,
+            raffleEntryCount: 0,
+            alreadyTriggered: true,
+            raffleWinnerUserId: drawn.raffleWinnerUserId,
+            reason: EVENT_DRAW_REASON.ALREADY_TRIGGERED,
+        };
+    }
     ctx.logger.info("Event raffle triggered", {
-        eventId: input.eventId,
+        eventId,
         raffleType,
         poolSize: pool.length,
-        winnerId: winner.id,
+        winnerId: drawn.winnerId,
     });
+    /*
+     * Tell the winner. Best-effort and AFTER the commit: a notification that
+     * fails must not roll back a recorded draw (the draw is irreversible and
+     * re-running it would pick a different winner), and a send inside the
+     * transaction would be retried on every abort. Same shape as
+     * `prizeDrawAssignWinner`.
+     */
+    if (drawn.userId) {
+        try {
+            await sendNotification({
+                userId: drawn.userId,
+                type: "prize_won",
+                priority: "high",
+                title: "You won the raffle!",
+                message: rafflePrizeCouponCode
+                    ? `You've been drawn as the winner. Your prize coupon code is ${rafflePrizeCouponCode}.`
+                    : "You've been drawn as the winner — open the event to see your prize.",
+                relatedId: eventId,
+                relatedType: "event",
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.warn("Raffle winner notification failed", {
+                eventId,
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
     return {
-        eventId: input.eventId,
-        raffleWinnerUserId: winner.data.userId,
-        raffleWinnerDisplayName: winner.data.userDisplayName,
+        eventId,
+        raffleWinnerUserId: drawn.userId,
+        raffleWinnerDisplayName: drawn.maskedName,
+        rafflePrizeCouponCode,
         raffleEntryCount: entriesSnap.size,
     };
 }

package/dist/_internal/server/jobs/core/weeklyPayoutEligibility.js

@@ -8,10 +8,7 @@ import { getDefaultCurrency } from "../../../../core/index.js";
 import { computePayoutDeduction } from "../../../shared/fees/calculator.js";
 import { ordersTaxableValue } from "../../../shared/checkout/order-math.js";
 export async function runWeeklyPayoutEligibility(ctx) {
-    if (ctx.env("FEATURE_PAYOUTS") !== "true") {
-        ctx.logger.info("FEATURE_PAYOUTS disabled — skipping weekly payout eligibility");
-        return { payoutsCreated: 0, ordersProcessed: 0, payoutIds: [] };
-    }
+    // `FEATURE_PAYOUTS` gate deleted 2026-10-19 — see `autoPayoutEligibility.ts`.
     ctx.logger.info("Starting weekly payout eligibility sweep");
     const siteSettings = await siteSettingsRepository.getSingleton();
     const commissions = siteSettings.commissions;
@@ -48,10 +45,19 @@ export async function runWeeklyPayoutEligibility(ctx) {
          * one pay different amounts for the same orders. */
         const grossAmount = ordersTaxableValue(orders.map((o) => o.data));
         const { platformFee, gatewayFee, gstOnFee, netAmount } = computePayoutDeduction(grossAmount, commissions);
+        /*
+         * 🛑 REVEALED before building a payout — see the identical note in
+         * `autoPayoutEligibility.ts`. `findById` is ciphertext-by-default and
+         * `createPayout` encrypts `sellerEmail`/`upiId` again, so the stored
+         * values went in double-encrypted and permanently unreadable, and the
+         * HMAC'd `sellerEmailIndex` could never match a real lookup.
+         */
+        const sellerPlain = userRepository.revealUser(seller);
         const payoutInput = {
             storeId,
-            sellerName: (seller.displayName ?? seller.email ?? store.ownerId),
-            sellerEmail: (seller.email ?? ""),
+            // `displayName` is plaintext by D1; the email fallback must be revealed.
+            sellerName: (seller.displayName ?? sellerPlain.email ?? store.ownerId),
+            sellerEmail: sellerPlain.email ?? "",
             orderIds: orders.map((o) => o.id),
             amount: netAmount,
             grossAmount,
@@ -63,20 +69,20 @@ export async function runWeeklyPayoutEligibility(ctx) {
             gstRate: commissions.gstPercent / 100,
             currency: defaultCurrency,
             status: "pending",
-            paymentMethod: seller.payoutDetails?.method === "upi" ? "upi" : "bank_transfer",
-            upiId: seller.payoutDetails?.method === "upi" ? seller.payoutDetails.upiId : undefined,
-            bankAccount: seller.payoutDetails?.method === "bank_transfer" && seller.payoutDetails.bankAccount
+            paymentMethod: sellerPlain.payoutDetails?.method === "upi" ? "upi" : "bank_transfer",
+            upiId: sellerPlain.payoutDetails?.method === "upi" ? sellerPlain.payoutDetails.upiId : undefined,
+            bankAccount: sellerPlain.payoutDetails?.method === "bank_transfer" && sellerPlain.payoutDetails.bankAccount
                 ? {
-                    accountHolderName: seller.payoutDetails.bankAccount.accountHolderName,
-                    accountNumberMasked: seller.payoutDetails.bankAccount.accountNumberMasked,
-                    ifscCode: seller.payoutDetails.bankAccount.ifscCode,
-                    bankName: seller.payoutDetails.bankAccount.bankName,
+                    accountHolderName: sellerPlain.payoutDetails.bankAccount.accountHolderName,
+                    accountNumberMasked: sellerPlain.payoutDetails.bankAccount.accountNumberMasked,
+                    ifscCode: sellerPlain.payoutDetails.bankAccount.ifscCode,
+                    bankName: sellerPlain.payoutDetails.bankAccount.bankName,
                 }
                 : undefined,
             notes: `Automated weekly payout — ${orders.length} delivered order(s)`,
             requestedAt: new Date(),
         };
-        const { id: payoutId } = await payoutRepository.create(payoutInput);
+        const { id: payoutId } = await payoutRepository.createPayout(payoutInput);
         for (let i = 0; i < orders.length; i += BATCH_LIMIT) {
             const slice = orders.slice(i, i + BATCH_LIMIT);
             const batch = ctx.db.batch();

package/dist/_internal/server/jobs/handlers/assignSpinPrize.d.ts

@@ -1,3 +1,11 @@
 import type { CallableHandler } from "../runtime/types";
 import { type AssignSpinPrizeInput, type AssignSpinPrizeResult } from "../core/assignSpinPrize";
+/**
+ * Statuses come from `reasonToHttp`, shared with `POST /api/events/[id]/spin`.
+ *
+ * This used to be a hand-written if-chain, and it disagreed with the route it
+ * mirrors: `identity_required` was 400 here and 401 there, and there was no
+ * `feature_disabled` branch at all, so that reason fell through as a SUCCESS.
+ * Two entry points, one handler, two behaviours — Root Cause #85.
+ */
 export declare const assignSpinPrizeHandler: CallableHandler<AssignSpinPrizeInput, AssignSpinPrizeResult>;

package/dist/_internal/server/jobs/handlers/assignSpinPrize.js

@@ -1,25 +1,25 @@
 import { runAssignSpinPrize, } from "../core/assignSpinPrize.js";
-function httpError(message, status) {
+import { reasonToHttp } from "../core/event-draw-reasons.js";
+function httpError(message, status, code) {
     const err = new Error(message);
     err.httpStatus = status;
+    err.code = code;
     return err;
 }
+/**
+ * Statuses come from `reasonToHttp`, shared with `POST /api/events/[id]/spin`.
+ *
+ * This used to be a hand-written if-chain, and it disagreed with the route it
+ * mirrors: `identity_required` was 400 here and 401 there, and there was no
+ * `feature_disabled` branch at all, so that reason fell through as a SUCCESS.
+ * Two entry points, one handler, two behaviours — Root Cause #85.
+ */
 export const assignSpinPrizeHandler = async (input, ctx) => {
     const result = await runAssignSpinPrize(input, ctx);
-    if (result.reason === "event_not_found") {
-        throw httpError("Event not found", 404);
-    }
-    if (result.reason === "identity_required") {
-        throw httpError("No user or guest identity provided", 400);
-    }
-    if (result.reason === "login_required") {
-        throw httpError("You must be logged in to spin this wheel", 401);
-    }
-    if (result.reason === "outside_spin_window") {
-        throw httpError("This spin wheel is not open right now", 403);
-    }
-    if (result.reason === "no_prizes_configured") {
-        throw httpError("No spin prizes configured for this event", 422);
+    // Mirrors the route's own success test: a reason with no prize is a refusal.
+    if (result.reason && !result.spinPrizeId) {
+        const { status, code, message } = reasonToHttp(result.reason);
+        throw httpError(message, status, code);
     }
     return result;
 };

package/dist/_internal/server/jobs/handlers/index.d.ts

@@ -29,6 +29,7 @@ export { paymentReviewAutoApproveHandler } from "./paymentReviewAutoApprove";
 export { productStatsSyncHandler } from "./productStatsSync";
 export { revenueRollupHandler } from "./revenueRollup";
 export { priceIndexRollupHandler } from "./priceIndexRollup";
+export { searchIndexBuildHandler } from "./searchIndexBuild";
 export { analyticsAlertEvaluateHandler } from "./analyticsAlertEvaluate";
 export { pageViewRollupHandler } from "./pageViewRollup";
 export { pageViewPruneHandler } from "./pageViewPrune";

package/dist/_internal/server/jobs/handlers/index.js

@@ -29,6 +29,7 @@ export { paymentReviewAutoApproveHandler } from "./paymentReviewAutoApprove.js";
 export { productStatsSyncHandler } from "./productStatsSync.js";
 export { revenueRollupHandler } from "./revenueRollup.js";
 export { priceIndexRollupHandler } from "./priceIndexRollup.js";
+export { searchIndexBuildHandler } from "./searchIndexBuild.js";
 export { analyticsAlertEvaluateHandler } from "./analyticsAlertEvaluate.js";
 export { pageViewRollupHandler } from "./pageViewRollup.js";
 export { pageViewPruneHandler } from "./pageViewPrune.js";

package/dist/_internal/server/jobs/handlers/onCategoryWrite.js

@@ -1,8 +1,26 @@
+import { markSearchIndexDirty } from "../../features/search/index-build/artifact-store.js";
 import { handleCategoryWrite } from "../core/onCategoryWrite.js";
+/*
+ * 🛑 Also marks the public search index stale.
+ *
+ * Added here rather than in the core so all five content triggers share one
+ * shape, and so each core keeps doing exactly the one thing it is named for.
+ *
+ * Safe under Root Cause #92 — which cost 12 MILLION invocations a day —
+ * because it writes a DIFFERENT collection (`searchIndex/manifest`) from the
+ * one this trigger watches, the same argument `priceIndexRollup` makes for
+ * writing `priceIndex/{leafId}` and never `categories`. #92's other half is
+ * handled inside `markSearchIndexDirty`: its no-op guard is a BOOLEAN read,
+ * never a deep compare, so a burst of 50 writes costs 50 reads and one write.
+ *
+ * It never throws: a missed mark delays the index by one 15-minute cadence,
+ * and failing the content write that triggered it would be far worse.
+ */
 export const onCategoryWriteHandler = async (event, ctx) => {
     await handleCategoryWrite({
         categoryId: event.params.categoryId,
         before: event.before,
         after: event.after,
     }, ctx);
+    await markSearchIndexDirty(ctx.db, "onCategoryWrite");
 };

package/dist/_internal/server/jobs/handlers/onProductWrite.js

@@ -1,8 +1,26 @@
+import { markSearchIndexDirty } from "../../features/search/index-build/artifact-store.js";
 import { handleProductWrite } from "../core/onProductWrite.js";
+/*
+ * 🛑 Also marks the public search index stale.
+ *
+ * Added here rather than in the core so all five content triggers share one
+ * shape, and so each core keeps doing exactly the one thing it is named for.
+ *
+ * Safe under Root Cause #92 — which cost 12 MILLION invocations a day —
+ * because it writes a DIFFERENT collection (`searchIndex/manifest`) from the
+ * one this trigger watches, the same argument `priceIndexRollup` makes for
+ * writing `priceIndex/{leafId}` and never `categories`. #92's other half is
+ * handled inside `markSearchIndexDirty`: its no-op guard is a BOOLEAN read,
+ * never a deep compare, so a burst of 50 writes costs 50 reads and one write.
+ *
+ * It never throws: a missed mark delays the index by one 15-minute cadence,
+ * and failing the content write that triggered it would be far worse.
+ */
 export const onProductWriteHandler = async (event, ctx) => {
     await handleProductWrite({
         productId: event.params.productId,
         before: event.before,
         after: event.after,
     }, ctx);
+    await markSearchIndexDirty(ctx.db, "onProductWrite");
 };

package/dist/_internal/server/jobs/handlers/onReviewWrite.js

@@ -1,4 +1,22 @@
+import { markSearchIndexDirty } from "../../features/search/index-build/artifact-store.js";
 import { handleReviewWrite } from "../core/onReviewWrite.js";
+/*
+ * 🛑 Also marks the public search index stale.
+ *
+ * Added here rather than in the core so all five content triggers share one
+ * shape, and so each core keeps doing exactly the one thing it is named for.
+ *
+ * Safe under Root Cause #92 — which cost 12 MILLION invocations a day —
+ * because it writes a DIFFERENT collection (`searchIndex/manifest`) from the
+ * one this trigger watches, the same argument `priceIndexRollup` makes for
+ * writing `priceIndex/{leafId}` and never `categories`. #92's other half is
+ * handled inside `markSearchIndexDirty`: its no-op guard is a BOOLEAN read,
+ * never a deep compare, so a burst of 50 writes costs 50 reads and one write.
+ *
+ * It never throws: a missed mark delays the index by one 15-minute cadence,
+ * and failing the content write that triggered it would be far worse.
+ */
 export const onReviewWriteHandler = async (event, ctx) => {
     await handleReviewWrite({ reviewId: event.params.reviewId, before: event.before, after: event.after }, ctx);
+    await markSearchIndexDirty(ctx.db, "onReviewWrite");
 };

package/dist/_internal/server/jobs/handlers/onScamReportUpdate.js

@@ -1,5 +1,22 @@
+import { markSearchIndexDirty } from "../../features/search/index-build/artifact-store.js";
 import { handleScamReportVerified } from "../core/onScamReportVerified.js";
 import { handleScamReportRejected } from "../core/onScamReportRejected.js";
+/*
+ * 🛑 Also marks the public search index stale.
+ *
+ * Added here rather than in the core so all five content triggers share one
+ * shape, and so each core keeps doing exactly the one thing it is named for.
+ *
+ * Safe under Root Cause #92 — which cost 12 MILLION invocations a day —
+ * because it writes a DIFFERENT collection (`searchIndex/manifest`) from the
+ * one this trigger watches, the same argument `priceIndexRollup` makes for
+ * writing `priceIndex/{leafId}` and never `categories`. #92's other half is
+ * handled inside `markSearchIndexDirty`: its no-op guard is a BOOLEAN read,
+ * never a deep compare, so a burst of 50 writes costs 50 reads and one write.
+ *
+ * It never throws: a missed mark delays the index by one 15-minute cadence,
+ * and failing the content write that triggered it would be far worse.
+ */
 export const onScamReportUpdateHandler = async (event, ctx) => {
     const before = event.before;
     const after = event.after;
@@ -22,4 +39,5 @@ export const onScamReportUpdateHandler = async (event, ctx) => {
     else if (nextStatus === "rejected") {
         await handleScamReportRejected(baseInput, ctx);
     }
+    await markSearchIndexDirty(ctx.db, "onScamReportUpdate");
 };

package/dist/_internal/server/jobs/handlers/onStoreWrite.js

@@ -1,8 +1,26 @@
+import { markSearchIndexDirty } from "../../features/search/index-build/artifact-store.js";
 import { handleStoreWrite } from "../core/onStoreWrite.js";
+/*
+ * 🛑 Also marks the public search index stale.
+ *
+ * Added here rather than in the core so all five content triggers share one
+ * shape, and so each core keeps doing exactly the one thing it is named for.
+ *
+ * Safe under Root Cause #92 — which cost 12 MILLION invocations a day —
+ * because it writes a DIFFERENT collection (`searchIndex/manifest`) from the
+ * one this trigger watches, the same argument `priceIndexRollup` makes for
+ * writing `priceIndex/{leafId}` and never `categories`. #92's other half is
+ * handled inside `markSearchIndexDirty`: its no-op guard is a BOOLEAN read,
+ * never a deep compare, so a burst of 50 writes costs 50 reads and one write.
+ *
+ * It never throws: a missed mark delays the index by one 15-minute cadence,
+ * and failing the content write that triggered it would be far worse.
+ */
 export const onStoreWriteHandler = async (event, ctx) => {
     await handleStoreWrite({
         storeId: event.params.storeId,
         before: event.before,
         after: event.after,
     }, ctx);
+    await markSearchIndexDirty(ctx.db, "onStoreWrite");
 };

package/dist/_internal/server/jobs/handlers/searchIndexBuild.d.ts

@@ -0,0 +1,2 @@
+import type { ScheduleHandler } from "../runtime/types";
+export declare const searchIndexBuildHandler: ScheduleHandler;

package/dist/_internal/server/jobs/handlers/searchIndexBuild.js

@@ -0,0 +1,2 @@
+import { runSearchIndexBuild } from "../core/searchIndexBuild.js";
+export const searchIndexBuildHandler = runSearchIndexBuild;

package/dist/_internal/server/jobs/handlers/triggerEventRaffle.d.ts

@@ -1,3 +1,11 @@
 import type { CallableHandler } from "../runtime/types";
 import { type TriggerEventRaffleInput, type TriggerEventRaffleResult } from "../core/triggerEventRaffle";
+/**
+ * Statuses come from `reasonToHttp`, shared with
+ * `POST /api/admin/events/[id]/trigger-raffle`.
+ *
+ * The hand-written chain this replaces knew two reasons (404 / 422) while the
+ * route mapped everything to 409 — so the same refusal had two different
+ * statuses depending on which door it came through (Root Cause #85).
+ */
 export declare const triggerEventRaffleHandler: CallableHandler<TriggerEventRaffleInput, TriggerEventRaffleResult>;

package/dist/_internal/server/jobs/handlers/triggerEventRaffle.js

@@ -1,16 +1,25 @@
 import { runTriggerEventRaffle, } from "../core/triggerEventRaffle.js";
-function httpError(message, status) {
+import { reasonToHttp } from "../core/event-draw-reasons.js";
+function httpError(message, status, code) {
     const err = new Error(message);
     err.httpStatus = status;
+    err.code = code;
     return err;
 }
+/**
+ * Statuses come from `reasonToHttp`, shared with
+ * `POST /api/admin/events/[id]/trigger-raffle`.
+ *
+ * The hand-written chain this replaces knew two reasons (404 / 422) while the
+ * route mapped everything to 409 — so the same refusal had two different
+ * statuses depending on which door it came through (Root Cause #85).
+ */
 export const triggerEventRaffleHandler = async (input, ctx) => {
     const result = await runTriggerEventRaffle(input, ctx);
-    if (result.reason === "event_not_found") {
-        throw httpError("Event not found", 404);
-    }
-    if (result.reason === "no_eligible_entries") {
-        throw httpError("No eligible entries for raffle", 422);
+    // Mirrors the route's own success test: a reason with no winner is a refusal.
+    if (result.reason && !result.raffleWinnerUserId) {
+        const { status, code, message } = reasonToHttp(result.reason);
+        throw httpError(message, status, code);
     }
     return result;
 };

package/dist/_internal/shared/actions/action-registry.js

@@ -1063,6 +1063,35 @@ export const ACTIONS = {
                 confirmKind: "danger",
             },
         },
+        /*
+         * The raffle draw. Added 2026-10-19 — before this there was NO control to
+         * draw a raffle anywhere in the product: the endpoint and its
+         * `ADMIN_ENDPOINTS.EVENT_TRIGGER_RAFFLE` constant existed with zero
+         * callers, and the tester case whose step 3 reads "trigger the raffle
+         * draw" was literally unexecutable.
+         *
+         * `kind: "danger"` with a REQUIRED confirmation, because a draw is
+         * genuinely irreversible: it writes the winner onto the event, and the
+         * winner's notification cannot be recalled. The server enforces the
+         * one-draw invariant transactionally and answers 409
+         * `RAFFLE_ALREADY_DRAWN` on a second attempt, so this dialog is the
+         * courtesy and that 409 is the guarantee.
+         */
+        "draw-raffle-winner": {
+            iconKey: "verify",
+            id: "event.draw-raffle-winner",
+            label: "Draw raffle winner",
+            ariaLabel: "Pick a random winner from the approved entries",
+            description: "Picks one winner at random from this event's approved entries, records them on the event, and notifies them.",
+            kind: "danger",
+            permissions: ["admin"],
+            confirmation: {
+                title: "Draw the raffle winner?",
+                body: "One winner will be picked at random from the approved entries, announced on the event page, and notified. A raffle can only be drawn once — this action cannot be undone.",
+                confirmLabel: "Yes, draw the winner",
+                confirmKind: "danger",
+            },
+        },
     },
     USER: {
         "cancel-order": {