@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/_internal/server/features/digital-code/metadata.js

@@ -26,7 +26,7 @@ export function buildDigitalCodeMetadata(product, opts) {
             description,
             url: canonical,
             type: "website",
-            images: image ? [{ url: image }] : undefined,
+            images: image ? [{ url: typeof image === "string" ? image : image.url }] : undefined,
         },
         twitter: {
             card: image ? "summary_large_image" : "summary",

package/dist/_internal/server/features/digital-code/og.d.ts

@@ -10,7 +10,9 @@ interface DigitalCodeDocLike {
     price?: number | null;
     currency?: string | null;
     mainImage?: string | null;
-    images?: (string | null | undefined)[] | null;
+    images?: ({
+        url: string;
+    } | string | null | undefined)[] | null;
     digitalCode?: {
         codeDeliveryMethod?: string;
     } | null;

package/dist/_internal/server/features/digital-code/og.js

@@ -9,7 +9,9 @@ export function renderDigitalCodeOg(doc, opts) {
     return renderDigitalCodeOgImage({
         title: doc?.title ?? "Digital Code",
         deliveryMethod,
-        imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
+        imageUrl: resolveOgImageUrl(doc?.mainImage ||
+            (typeof doc?.images?.[0] === "string" ? doc.images[0] : doc?.images?.[0]?.url) ||
+            null, opts.baseUrl),
     }, opts.siteName);
 }
 export function renderDigitalCodeOgImage(data, siteName) {

package/dist/_internal/server/features/digital-code/pool.d.ts

@@ -20,10 +20,25 @@ import { type ProductCodeContentKind } from "../../../../features/products/schem
 /**
  * Where a delivered asset's bytes live.
  *
- * Deliberately OUTSIDE every prefix the public media proxy knows how to resolve,
- * and no `mediaAssets` row is ever created for it — a `mediaAssets` row is what
- * mints a `/media/{shortId}` slug, and that slug is served without
- * authentication. No row, no slug, no public URL.
+ * No `mediaAssets` row is ever created for one — a row is what mints a
+ * `/media/{shortId}` slug, and that slug is served without authentication. No
+ * row, no slug, no public URL. That half was, and remains, true.
+ *
+ * 🛑 CORRECTED 2026-10-19. This block used to open with "deliberately OUTSIDE
+ * every prefix the public media proxy knows how to resolve", and that was
+ * FALSE from the day the proxy's raw-path fallback shipped: `/media/[...slug]`
+ * treats any multi-segment slug it cannot resolve through `mediaAssets` as a
+ * literal storage path, so `/media/private/digital-content/...` resolved and
+ * served. It did watermark, so no pristine original leaked — but a paid asset
+ * was reachable by anyone who guessed the object name, and the only thing
+ * standing in the way was `randomUUID()`.
+ *
+ * The proxy now refuses a raw path under `private/` outright
+ * (`PRIVATE_PREFIX` in `src/app/api/media/[...slug]/route.ts`), so the
+ * statement is true again — but it is true because of a check, not because of
+ * the prefix, and that distinction is the whole reason this comment was wrong
+ * for so long. An unenforced invariant written as a fact is worse than no
+ * comment: it is the reason nobody looked.
  */
 export declare const DIGITAL_CONTENT_PREFIX = "private/digital-content";
 /**

package/dist/_internal/server/features/digital-code/pool.js

@@ -26,10 +26,25 @@ import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION, } from "../../../../fe
 /**
  * Where a delivered asset's bytes live.
  *
- * Deliberately OUTSIDE every prefix the public media proxy knows how to resolve,
- * and no `mediaAssets` row is ever created for it — a `mediaAssets` row is what
- * mints a `/media/{shortId}` slug, and that slug is served without
- * authentication. No row, no slug, no public URL.
+ * No `mediaAssets` row is ever created for one — a row is what mints a
+ * `/media/{shortId}` slug, and that slug is served without authentication. No
+ * row, no slug, no public URL. That half was, and remains, true.
+ *
+ * 🛑 CORRECTED 2026-10-19. This block used to open with "deliberately OUTSIDE
+ * every prefix the public media proxy knows how to resolve", and that was
+ * FALSE from the day the proxy's raw-path fallback shipped: `/media/[...slug]`
+ * treats any multi-segment slug it cannot resolve through `mediaAssets` as a
+ * literal storage path, so `/media/private/digital-content/...` resolved and
+ * served. It did watermark, so no pristine original leaked — but a paid asset
+ * was reachable by anyone who guessed the object name, and the only thing
+ * standing in the way was `randomUUID()`.
+ *
+ * The proxy now refuses a raw path under `private/` outright
+ * (`PRIVATE_PREFIX` in `src/app/api/media/[...slug]/route.ts`), so the
+ * statement is true again — but it is true because of a check, not because of
+ * the prefix, and that distinction is the whole reason this comment was wrong
+ * for so long. An unenforced invariant written as a fact is worse than no
+ * comment: it is the reason nobody looked.
  */
 export const DIGITAL_CONTENT_PREFIX = "private/digital-content";
 /**

package/dist/_internal/server/features/live/metadata.js

@@ -29,7 +29,7 @@ export function buildLiveItemMetadata(product, opts) {
             description,
             url: canonical,
             type: "website",
-            images: image ? [{ url: image }] : undefined,
+            images: image ? [{ url: typeof image === "string" ? image : image.url }] : undefined,
         },
         twitter: {
             card: image ? "summary_large_image" : "summary",

package/dist/_internal/server/features/live/og.d.ts

@@ -10,7 +10,9 @@ interface LiveItemDocLike {
     price?: number | null;
     currency?: string | null;
     mainImage?: string | null;
-    images?: (string | null | undefined)[] | null;
+    images?: ({
+        url: string;
+    } | string | null | undefined)[] | null;
     liveItem?: {
         species?: string;
     } | null;

package/dist/_internal/server/features/live/og.js

@@ -4,7 +4,9 @@ export function renderLiveItemOg(doc, opts) {
     return renderLiveItemOgImage({
         title: doc?.title ?? "Live Listing",
         species: doc?.liveItem?.species ?? null,
-        imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
+        imageUrl: resolveOgImageUrl(doc?.mainImage ||
+            (typeof doc?.images?.[0] === "string" ? doc.images[0] : doc?.images?.[0]?.url) ||
+            null, opts.baseUrl),
     }, opts.siteName);
 }
 export function renderLiveItemOgImage(data, siteName) {

package/dist/_internal/server/features/lottery/actions.js

@@ -117,7 +117,15 @@ export async function submitLotteryPullAction(input) {
             });
             return { assignedSlot: chosen, userLotteryNumber: nextNumber };
         });
-        // Create the entry document outside the transaction (acceptable — slot is already booked)
+        /*
+         * Create the entry document outside the transaction (acceptable — slot is
+         * already booked).
+         *
+         * Typed `LotteryEntryPlain`: this is PLAINTEXT from the session and the
+         * request body, and `createEntry` encrypts it. The document type now says
+         * `Encrypted<string>`, so annotating this `LotteryEntryDocument` is a
+         * compile error — correctly, because the values here are not ciphertext.
+         */
         const entryData = {
             sourceType: data.sourceType,
             ...(data.sourceType === "event" ? { eventId: sourceId } : { productId: sourceId }),

package/dist/_internal/server/features/lottery/og.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Lottery OG image renderer.
+ *
+ * ## Why this did not exist
+ *
+ * `lottery/[id]` was the single entry in `verify-og-coverage`'s
+ * `OG_KNOWN_GAPS` — the one public dynamic detail page shipping without an
+ * `opengraph-image.tsx`, carried as a baseline since 2026-05-23 with the note
+ * "OG image follows in a follow-up". Metadata already resolved
+ * (`buildLotteryMetadata`), so a shared link rendered a title and whatever the
+ * event's cover image happened to be, with none of the branded card every
+ * other listing type gets.
+ *
+ * ## 🛑 No money, and no per-slot prices
+ *
+ * An OG image is a public image URL with its contents burned into the pixels:
+ * no sign-in gate reaches it and no paywall markup describes it, which is why
+ * all eight money-bearing renderers were stripped (Root Cause #93). A lottery
+ * is the sharpest case in the codebase — `toClientLotteryConfig` is an
+ * allow-list that exists specifically to keep `price` and `weight` off every
+ * slot — so this renderer takes the CLIENT shape and reads only what that
+ * allow-list already permits: the slot count, and how many are still free.
+ *
+ * "6 of 200 slots left" is a fact about availability rather than a disclosed
+ * amount, and it is the half of the card that earns the click — exactly the
+ * line `renderPrizeDrawOg` draws for "Free entry".
+ */
+import type { ReactElement } from "react";
+import type { LotteryEventClient } from "./data";
+export interface LotteryOgData {
+    title: string;
+    imageUrl?: string | null;
+    slotsLabel?: string | null;
+    statusLabel?: string | null;
+}
+export declare function renderLotteryOg(event: LotteryEventClient | null | undefined, opts: {
+    siteName: string;
+    baseUrl?: string;
+}): ReactElement;
+export declare function renderLotteryOgImage(data: LotteryOgData, siteName: string): ReactElement;

package/dist/_internal/server/features/lottery/og.js

@@ -0,0 +1,79 @@
+/**
+ * Lottery OG image renderer.
+ *
+ * ## Why this did not exist
+ *
+ * `lottery/[id]` was the single entry in `verify-og-coverage`'s
+ * `OG_KNOWN_GAPS` — the one public dynamic detail page shipping without an
+ * `opengraph-image.tsx`, carried as a baseline since 2026-05-23 with the note
+ * "OG image follows in a follow-up". Metadata already resolved
+ * (`buildLotteryMetadata`), so a shared link rendered a title and whatever the
+ * event's cover image happened to be, with none of the branded card every
+ * other listing type gets.
+ *
+ * ## 🛑 No money, and no per-slot prices
+ *
+ * An OG image is a public image URL with its contents burned into the pixels:
+ * no sign-in gate reaches it and no paywall markup describes it, which is why
+ * all eight money-bearing renderers were stripped (Root Cause #93). A lottery
+ * is the sharpest case in the codebase — `toClientLotteryConfig` is an
+ * allow-list that exists specifically to keep `price` and `weight` off every
+ * slot — so this renderer takes the CLIENT shape and reads only what that
+ * allow-list already permits: the slot count, and how many are still free.
+ *
+ * "6 of 200 slots left" is a fact about availability rather than a disclosed
+ * amount, and it is the half of the card that earns the click — exactly the
+ * line `renderPrizeDrawOg` draws for "Free entry".
+ */
+import { renderOgLayout } from "../seo/og-layout.js";
+import { resolveOgImageUrl } from "../seo/og.js";
+/**
+ * The event's own status, as a human badge. `active` is deliberately absent:
+ * a live lottery is the default case, so a chip saying so costs a badge slot
+ * and tells the reader nothing they would not assume.
+ */
+const STATUS_BADGE_TEXT = {
+    draft: "Not yet open",
+    paused: "Paused",
+    ended: "Closed",
+    cancelled: "Cancelled",
+};
+export function renderLotteryOg(event, opts) {
+    const cfg = event?.lotteryConfig;
+    const slots = cfg?.slots ?? [];
+    /*
+     * Counted from the slot array rather than read from `totalSlots`, which is
+     * the mirror the admin write path derives FROM `slots.length` — and a mirror
+     * is the field most likely to disagree (Root Cause #42). The array is here
+     * either way, so counting it costs nothing.
+     */
+    const total = slots.length;
+    const free = slots.filter((s) => !s.isBooked).length;
+    const slotsLabel = total > 0
+        ? free > 0
+            ? `${free.toLocaleString("en-IN")} of ${total.toLocaleString("en-IN")} slots left`
+            : `All ${total.toLocaleString("en-IN")} slots claimed`
+        : null;
+    const coverUrl = event?.coverImage && typeof event.coverImage.url === "string"
+        ? event.coverImage.url
+        : (event?.coverImageUrl ?? null);
+    return renderLotteryOgImage({
+        title: event?.title ?? "Lottery",
+        imageUrl: resolveOgImageUrl(coverUrl, opts.baseUrl),
+        slotsLabel,
+        statusLabel: event?.status ? (STATUS_BADGE_TEXT[event.status] ?? null) : null,
+    }, opts.siteName);
+}
+export function renderLotteryOgImage(data, siteName) {
+    const badges = [data.statusLabel].filter((s) => Boolean(s));
+    return renderOgLayout({
+        title: data.title,
+        subtitle: data.slotsLabel ?? undefined,
+        imageUrl: data.imageUrl,
+        siteName: `${siteName} · Lottery`,
+        badges: badges.length > 0 ? badges : undefined,
+        // Violet, distinct from the prize-draw amber beside it in the nav — the two
+        // are different products and a shared accent makes shared links ambiguous.
+        theme: { accentColor: "#8b5cf6" },
+    });
+}

package/dist/_internal/server/features/messages/actions.js

@@ -12,6 +12,7 @@ import { createMessage, listMessages, softDeleteMessage, deleteAllMessages, list
 import { finalizeStagedMediaArray } from "../../../../features/media/finalize.js";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions.js";
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
+import { normalizeListingType } from "../../../../features/products/utils/listing-type.js";
 import { siteSettingsRepository } from "../../../../repositories/index.js";
 const MESSAGE_MAX_LENGTH = 2000;
 /**
@@ -159,8 +160,11 @@ export async function sendMessage(input) {
             productRef = {
                 productId: product.id,
                 title: product.title,
-                image: product.images?.[0],
+                image: product.images?.[0]?.url,
                 price: product.price,
+                // Without this the card cannot pick the right detail route — see the
+                // field's own comment on `MessageProductRef`.
+                listingType: normalizeListingType(product),
             };
         }
         // A missing/deleted product is not an error — the card simply doesn't

package/dist/_internal/server/features/offers/adapters.js

@@ -12,7 +12,7 @@
  */
 // Display masking only — `pii-mask.ts` is the crypto-FREE half that Root Cause
 // #24 split out of `pii-encrypt.ts` precisely so it could be imported freely.
-import { maskEmail, maskName } from "../../../../security/pii-mask.js";
+import { offerRepository } from "../../../../features/seller/repository/offer.repository.js";
 function toIsoOrUndefined(value) {
     return value instanceof Date ? value.toISOString() : undefined;
 }
@@ -21,11 +21,25 @@ function toIso(value) {
 }
 /** The three buyer keys, resolved per `buyerIdentity`. Absent keys stay absent. */
 function buyerIdentityFields(doc, mode) {
+    /*
+     * 🛑 Both branches go through the repository's named accessors.
+     *
+     * `OfferRepository.mapDoc` no longer decrypts, so `doc.buyerName` and
+     * `doc.buyerEmail` are CIPHERTEXT here. Before this, `"full"` returned the
+     * `enc:v1:` blobs straight to the seller, and `"masked"` handed them to
+     * `maskName`/`maskEmail`, which refuse ciphertext by design and answer
+     * "Anonymous" / "***@***.***" — so neither mode worked, in opposite ways.
+     *
+     * `"full"` is the seller's own view of a buyer who made them an offer, which
+     * is a legitimate plaintext read; `"masked"` is everything else.
+     */
     if (mode === "full") {
-        return { buyerUid: doc.buyerUid, buyerName: doc.buyerName, buyerEmail: doc.buyerEmail };
+        const plain = offerRepository.revealOffer(doc);
+        return { buyerUid: doc.buyerUid, buyerName: plain.buyerName, buyerEmail: plain.buyerEmail };
     }
     if (mode === "masked") {
-        return { buyerName: maskName(doc.buyerName), buyerEmail: maskEmail(doc.buyerEmail) };
+        const masked = offerRepository.maskedOffer(doc);
+        return { buyerName: masked.buyerName, buyerEmail: masked.buyerEmail };
     }
     return {};
 }

package/dist/_internal/server/features/orders/actions.js

@@ -22,7 +22,7 @@ export async function createOrderAction(input) {
         const parsed = createOrderSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid order input");
-        return orderRepository.create({
+        return orderRepository.createOrder({
             ...parsed.data,
             userId: user.uid,
             status: "pending",
@@ -211,7 +211,12 @@ export async function attachPaymentProofAction(orderId, proof) {
         });
         notifyAdminsOfPaymentProof({
             id: orderId,
-            userName: order.userName,
+            /*
+             * Revealed: this names the buyer to an admin who is about to verify
+             * their payment proof, so a mask would defeat the purpose. `order` comes
+             * from a repository read, which is ciphertext-by-default.
+             */
+            userName: orderRepository.revealOrder(order).userName,
             productTitle: order.productTitle,
             totalPrice: order.totalPrice,
         });

package/dist/_internal/server/features/parts/og.js

@@ -58,7 +58,7 @@ export function renderPartOg(part, usedByCount, opts) {
 /** One classification's card. */
 export function renderPartClassificationOg(slot, count, opts) {
     const label = PART_SLOT_LABEL[slot] ?? slot;
-    return shell("Parts database", label, 
+    return shell("Beyblade parts gallery", label, 
     // `count` comes from the same bounded read the page renders, so the number
     // on the card is the number on the page. A separate count query would be a
     // second source that could disagree.

package/dist/_internal/server/features/pre-orders/og.d.ts

@@ -8,7 +8,9 @@ interface PreOrderDocLike {
     title?: string | null;
     preOrderReleaseDate?: Date | string | null;
     mainImage?: string | null;
-    images?: (string | null | undefined)[] | null;
+    images?: ({
+        url: string;
+    } | string | null | undefined)[] | null;
 }
 /** High-level OG renderer — accepts the raw pre-order document from `getPreOrderForDetail`. */
 export declare function renderPreOrderOg(doc: PreOrderDocLike | null | undefined, opts: {

package/dist/_internal/server/features/pre-orders/og.js

@@ -12,7 +12,9 @@ export function renderPreOrderOg(doc, opts) {
     return renderPreOrderOgImage({
         title: doc?.title ?? "Pre-Order",
         releaseDateLabel,
-        imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
+        imageUrl: resolveOgImageUrl(doc?.mainImage ||
+            (typeof doc?.images?.[0] === "string" ? doc.images[0] : doc?.images?.[0]?.url) ||
+            null, opts.baseUrl),
     }, opts.siteName);
 }
 export function renderPreOrderOgImage(data, siteName) {

package/dist/_internal/server/features/price-index/search.d.ts

@@ -117,3 +117,21 @@ export interface PriceIndexSearchResponse {
  * Cost: one `searchTxt` push-down query plus ONE multi-get. Both bounded.
  */
 export declare function searchPriceIndex(rawQuery: string): Promise<PriceIndexSearchResponse>;
+/**
+ * Tier 1 adoption — the client already resolved candidate leaves LOCALLY via
+ * the public search artifact (`useSiteSearch({ types: ["model", "category"] })`),
+ * at zero Firestore reads. This is the ONLY query this path still needs: one
+ * multi-get, bounded by however many ids the client resolved (capped the
+ * same as the search path, so a crafted request cannot demand an unbounded
+ * `getAll`).
+ *
+ * 🛑 Deliberately NOT filtering brand/bundle categoryType here — the CALLER
+ * already did that at index-build time (`PUBLIC_INDEX_SOURCES`'s category
+ * source only emits real listing leaves under the "model"/"category" type
+ * keys), so re-deriving the same filter from a bare id list would be a
+ * second, independently-maintained copy of a rule that already lives in one
+ * place. If that assumption is ever wrong, the cost is a band shown for a
+ * brand/bundle row — cosmetic, not a leak, since no money figure is ever
+ * attached to a document that does not already have sales recorded.
+ */
+export declare function getPriceIndexBandsForIds(rawIds: readonly string[]): Promise<PriceIndexSearchResult[]>;

package/dist/_internal/server/features/price-index/search.js

@@ -154,8 +154,22 @@ export async function searchPriceIndex(rawQuery) {
         return !t || t === "category" || t === "sublisting";
     });
     const page = listingRows.slice(0, PRICE_INDEX_SEARCH_LIMIT);
-    const bandsByLeaf = await priceIndexRepository.getManyForLeaves(page.map((c) => c.id));
-    const results = page.map((c) => {
+    const results = await buildBandsForLeaves(page);
+    return {
+        ...base,
+        results,
+        truncated: listingRows.length > PRICE_INDEX_SEARCH_LIMIT,
+    };
+}
+/**
+ * The ONE multi-get, shared by the search path above and the ids-only path
+ * below — the actual band-shaping logic (sort by sample size, omit an empty
+ * `bands` array, the "no sales recorded" vs "zero sales" distinction) must
+ * answer identically regardless of how the category list was resolved.
+ */
+async function buildBandsForLeaves(leaves) {
+    const bandsByLeaf = await priceIndexRepository.getManyForLeaves(leaves.map((c) => c.id));
+    return leaves.map((c) => {
         const doc = bandsByLeaf.get(c.id);
         const bands = doc
             ? Object.entries(doc.byListingType ?? {})
@@ -180,9 +194,35 @@ export async function searchPriceIndex(rawQuery) {
             ...(doc ? { windowDays: doc.windowDays, computedAt: toIso(doc.computedAt) } : {}),
         };
     });
-    return {
-        ...base,
-        results,
-        truncated: listingRows.length > PRICE_INDEX_SEARCH_LIMIT,
-    };
+}
+/**
+ * Tier 1 adoption — the client already resolved candidate leaves LOCALLY via
+ * the public search artifact (`useSiteSearch({ types: ["model", "category"] })`),
+ * at zero Firestore reads. This is the ONLY query this path still needs: one
+ * multi-get, bounded by however many ids the client resolved (capped the
+ * same as the search path, so a crafted request cannot demand an unbounded
+ * `getAll`).
+ *
+ * 🛑 Deliberately NOT filtering brand/bundle categoryType here — the CALLER
+ * already did that at index-build time (`PUBLIC_INDEX_SOURCES`'s category
+ * source only emits real listing leaves under the "model"/"category" type
+ * keys), so re-deriving the same filter from a bare id list would be a
+ * second, independently-maintained copy of a rule that already lives in one
+ * place. If that assumption is ever wrong, the cost is a band shown for a
+ * brand/bundle row — cosmetic, not a leak, since no money figure is ever
+ * attached to a document that does not already have sales recorded.
+ */
+export async function getPriceIndexBandsForIds(rawIds) {
+    const ids = [...new Set(rawIds.filter((id) => typeof id === "string" && id.length > 0))].slice(0, PRICE_INDEX_SEARCH_LIMIT);
+    if (ids.length === 0)
+        return [];
+    const docs = await categoriesRepository.getManyByIds(ids);
+    const leaves = docs.map((c) => ({
+        id: c.id,
+        name: c.name,
+        slug: c.slug,
+        path: c.path,
+        display: c.display,
+    }));
+    return buildBandsForLeaves(leaves);
 }

package/dist/_internal/server/features/prize-draws/og.d.ts

@@ -17,7 +17,9 @@ interface PrizeDrawDocLike {
     price?: number | null;
     currency?: string | null;
     mainImage?: string | null;
-    images?: (string | null | undefined)[] | null;
+    images?: ({
+        url: string;
+    } | string | null | undefined)[] | null;
     prizeRevealStatus?: "pending" | "open" | "closed" | null;
     prizeMaxEntries?: number | null;
     prizeCurrentEntries?: number | null;

package/dist/_internal/server/features/prize-draws/og.js

@@ -19,7 +19,9 @@ export function renderPrizeDrawOg(doc, opts) {
     return renderPrizeDrawOgImage({
         title: doc?.title ?? doc?.name ?? "Prize Draw",
         pricePerEntryLabel,
-        imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
+        imageUrl: resolveOgImageUrl(doc?.mainImage ||
+            (typeof doc?.images?.[0] === "string" ? doc.images[0] : doc?.images?.[0]?.url) ||
+            null, opts.baseUrl),
         revealStatus: doc?.prizeRevealStatus ?? null,
         entriesLabel,
     }, opts.siteName);

package/dist/_internal/server/features/products/group-members.d.ts

@@ -42,6 +42,16 @@ export interface PublicGroupMember {
     groupTitle?: string;
     /** Drives the stepper's `max`. */
     availableQuantity: number;
+    /**
+     * Made to order — the stepper is UNCAPPED for this member.
+     *
+     * 🛑 This is an ALLOW-LIST projection: a field absent from this interface and
+     * from `toPublicGroupMember` below simply does not reach the picker, with no
+     * error anywhere. Without it the picker reads `availableQuantity: 0` on a
+     * print-on-demand member and caps the stepper at zero — the member renders,
+     * looks selectable, and cannot be chosen.
+     */
+    madeToOrder?: boolean;
     storeId: string;
     storeName?: string;
     status: string;
@@ -50,6 +60,22 @@ export interface PublicGroupMember {
      *  snapshot it for per-member GST proration at checkout. */
     gstRate?: 0 | 5 | 12 | 18 | 28;
     hsnCode?: string;
+    /**
+     * The group's OWN selection rules — present only on the PARENT row, since
+     * that is the only document that carries them.
+     *
+     * 🛑 Projected so `readGroupRules` has something real to read client-side.
+     * Without these the picker would silently see no rules on every page that
+     * derives them from this endpoint's own response (`ShowGroupSection`),
+     * which is a client-only regression of the exact kind E3 exists to close —
+     * a server-only rule reads as a broken button, and here it would be the
+     * reverse: a client that never finds out a rule exists at all.
+     */
+    groupMinMembers?: number;
+    groupMaxMembers?: number;
+    groupMaxUnitsPerMember?: number;
+    groupRequiredMemberIds?: string[];
+    groupDiscountPercent?: number;
 }
 export declare function toPublicGroupMember(doc: ProductDocument): PublicGroupMember;
 export declare function toPublicGroupMembers(docs: readonly ProductDocument[]): PublicGroupMember[];

package/dist/_internal/server/features/products/group-members.js

@@ -22,18 +22,24 @@ export function toPublicGroupMember(doc) {
         title: doc.title,
         price: doc.price,
         currency: doc.currency,
-        image: doc.images?.[0] ?? doc.mainImage,
+        image: doc.images?.[0]?.url ?? doc.mainImage,
         condition: doc.condition,
         listingType: normalizeListingType(doc),
         isGroupParent: doc.isGroupParent,
         groupTitle: doc.groupTitle,
         availableQuantity: doc.availableQuantity ?? 0,
+        madeToOrder: doc.madeToOrder,
         storeId: doc.storeId,
         storeName: doc.storeName,
         status: doc.status,
         isSold: doc.isSold,
         gstRate: doc.gstRate,
         hsnCode: doc.hsnCode,
+        groupMinMembers: doc.groupMinMembers,
+        groupMaxMembers: doc.groupMaxMembers,
+        groupMaxUnitsPerMember: doc.groupMaxUnitsPerMember,
+        groupRequiredMemberIds: doc.groupRequiredMemberIds,
+        groupDiscountPercent: doc.groupDiscountPercent,
     };
 }
 export function toPublicGroupMembers(docs) {

package/dist/_internal/server/features/products/og.d.ts

@@ -11,7 +11,9 @@ interface ProductDocLike {
     title?: string | null;
     price?: number | null;
     mainImage?: string | null;
-    images?: (string | null | undefined)[] | null;
+    images?: ({
+        url: string;
+    } | string | null | undefined)[] | null;
 }
 /** High-level OG renderer — accepts the raw product document from `getProductForDetail`. */
 export declare function renderProductOg(doc: ProductDocLike | null | undefined, opts: OgOptions & {

package/dist/_internal/server/features/products/og.js

@@ -6,7 +6,9 @@ export function renderProductOg(doc, opts) {
     return renderProductOgImage({
         title: doc?.title ?? "Product",
         price: doc?.price ?? null,
-        imageUrl: resolveOgImageUrl(doc?.mainImage || doc?.images?.[0] || null, opts.baseUrl),
+        imageUrl: resolveOgImageUrl(doc?.mainImage ||
+            (typeof doc?.images?.[0] === "string" ? doc.images[0] : doc?.images?.[0]?.url) ||
+            null, opts.baseUrl),
     }, opts.siteName);
 }
 export function renderProductOgImage(data, siteName) {

package/dist/_internal/server/features/raffle/actions.d.ts

@@ -10,3 +10,22 @@ import { type TriggerEventRaffleInput, type TriggerEventRaffleResult } from "../
 import { type AssignSpinPrizeInput, type AssignSpinPrizeResult } from "../../jobs/core/assignSpinPrize";
 export declare function triggerEventRaffleAction(input: TriggerEventRaffleInput): Promise<ActionResult<TriggerEventRaffleResult>>;
 export declare function assignSpinPrizeAction(input: AssignSpinPrizeInput): Promise<ActionResult<AssignSpinPrizeResult>>;
+/**
+ * Resolve a slug-or-id to the canonical event DOCUMENT ID.
+ *
+ * Exists for one caller — `POST /api/events/[id]/spin`, which must hash a
+ * guest's identity against a stable key BEFORE calling the spin action.
+ *
+ * 🛑 Why this is not just a nicety. Public URLs link by slug, so the route
+ * received a slug and did `hashGuestIdentity(slug, request)`, while
+ * `enterEvent` hashes on the resolved doc id. Two identities for one guest on
+ * one event. While the spin core's lookup was broken that was invisible (every
+ * spin 404'd); the moment the lookup was fixed it would have become a silent
+ * `spinMaxPerUser` bypass — exhaust your spins on `/events/<slug>/participate`
+ * and get a fresh allowance on `/events/<docId>/participate`.
+ *
+ * Returns `null` for an unknown event; the route then lets the spin action
+ * produce the single authoritative `event_not_found` rather than guessing at
+ * one here.
+ */
+export declare function resolveEventIdAction(idOrSlug: string): Promise<ActionResult<string | null>>;