@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/features/contact/components/ContactPageView.js

@@ -1,6 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Container, Div, Heading, Main, Section, Stack, Text } from "../../../ui/index.js";
+import { Anchor, Container, Div, Heading, Main, PendingValue, Section, Stack, Text } from "../../../ui/index.js";
 import { AdSlot } from "../../homepage/components/AdSlot.js";
 import { ContactForm } from "./ContactForm.js";
 import { ContactInfoSidebar } from "./ContactInfoSidebar.js";
@@ -9,7 +9,53 @@ import { CONTACT_ENDPOINTS } from "../../../constants/api-endpoints.js";
 async function submitContact(data) {
     await apiClient.post(CONTACT_ENDPOINTS.SUBMIT, data);
 }
-export function ContactPageView() {
+export function ContactPageView({ business }) {
+    /*
+     * Built from `business` rather than hardcoded. Every one of these was a
+     * literal in this file until 2026-10-19 — `support@letitrip.in`,
+     * `+91 89196 65811`, `Mon-Sat · 10:00 AM - 7:00 PM IST` — which meant the
+     * contact page could disagree with `siteSettings.contact`, with the FAQ
+     * variables and with the footer, and did.
+     *
+     * A channel with no value is OMITTED rather than rendered pending: a contact
+     * sidebar listing "Email: [to be confirmed]" as a clickable row is worse
+     * than a sidebar that does not offer email. The pending markers belong on
+     * the legal-identity block below, where absence is the thing worth seeing.
+     */
+    const infoItems = [
+        business.supportEmail
+            ? {
+                icon: "📧",
+                label: "Email",
+                value: business.supportEmail,
+                href: `mailto:${business.supportEmail}`,
+            }
+            : null,
+        business.supportPhone
+            ? {
+                icon: "📞",
+                label: "Phone",
+                value: business.supportPhone,
+                href: `tel:${business.supportPhone.replace(/[^\d+]/g, "")}`,
+            }
+            : null,
+        business.whatsAppLink
+            ? {
+                icon: "💬",
+                label: "WhatsApp",
+                value: business.whatsAppDisplay ?? "Message us",
+                href: business.whatsAppLink,
+            }
+            : null,
+        business.communityUrl
+            ? {
+                icon: "👥",
+                label: "WhatsApp Community",
+                value: "Join the group",
+                href: business.communityUrl,
+            }
+            : null,
+    ].filter((i) => i !== null);
     return (_jsx(Main, { children: _jsx(Section, { padding: "y-2xl", children: _jsx(Container, { size: "xl", children: _jsxs(Stack, { gap: "section", children: [_jsxs(Stack, { gap: "3", children: [_jsx(Heading, { level: 1, size: "3xl", weight: "semibold", color: "primary", children: "Contact Us" }), _jsx(Text, { color: "muted", children: "Questions, support requests, or partnership inquiries." })] }), _jsx(AdSlot, { id: "detail-below-gallery", className: "mb-2" }), _jsxs(Div, { layout: "grid", gap: "6", className: "grid-cols-12", children: [_jsx(Div, { className: "col-span-12 lg:col-span-8", children: _jsx(ContactForm, { onSubmit: submitContact, labels: {
                                             title: "Send us a message",
                                             nameLabel: "Your Name",
@@ -17,30 +63,14 @@ export function ContactPageView() {
                                             subjectLabel: "Subject",
                                             messageLabel: "Message",
                                             submitButton: "Send Message",
-                                        } }) }), _jsx(Div, { className: "col-span-12 lg:col-span-4", children: _jsx(ContactInfoSidebar, { infoItems: [
-                                            {
-                                                icon: "📧",
-                                                label: "Email",
-                                                value: "support@letitrip.in",
-                                                href: "mailto:support@letitrip.in",
-                                            },
-                                            {
-                                                icon: "💬",
-                                                label: "WhatsApp",
-                                                value: "+91 89196 65811",
-                                                href: "https://wa.me/918919665811",
-                                            },
-                                            {
-                                                icon: "👥",
-                                                label: "WhatsApp Community",
-                                                value: "Join the group",
-                                                href: "https://chat.whatsapp.com/JOlbdSwhVWYDKujolcBZDr",
-                                            },
-                                        ], labels: {
-                                            title: "Support",
-                                            businessHoursLabel: "Business Hours",
-                                            businessHoursValue: "Mon-Sat · 10:00 AM - 7:00 PM IST",
-                                            responseTimeLabel: "Response Time",
-                                            responseTimeValue: "Usually within 24 hours",
-                                        } }) })] }), _jsx(AdSlot, { id: "detail-below-price" })] }) }) }) }));
+                                        } }) }), _jsx(Div, { className: "col-span-12 lg:col-span-4", children: _jsxs(Stack, { gap: "lg", children: [_jsx(ContactInfoSidebar, { infoItems: infoItems, labels: {
+                                                    title: "Support",
+                                                    businessHoursLabel: "Business Hours",
+                                                    // 🛑 No invented fallback. "Mon-Sat · 10:00 AM - 7:00 PM
+                                                    // IST" was hardcoded here and matched nothing anyone had
+                                                    // committed to.
+                                                    businessHoursValue: business.supportHours ?? "[to be confirmed]",
+                                                    responseTimeLabel: "Response Time",
+                                                    responseTimeValue: "Usually within 24 hours",
+                                                } }), _jsxs(Div, { surface: "muted", padding: "card", rounded: "lg", border: "default", children: [_jsx(Heading, { level: 2, size: "sm", weight: "semibold", className: "mb-3 uppercase tracking-wide", color: "muted", children: "Business details" }), _jsxs(Stack, { gap: "xs", children: [_jsx(Text, { size: "sm", weight: "medium", children: business.legalName }), business.structure ? (_jsx(Text, { size: "sm", color: "muted", children: business.structure })) : null, business.proprietor ? (_jsxs(Text, { size: "sm", color: "muted", children: ["Proprietor: ", business.proprietor] })) : null, (business.addressLines ?? []).map((line) => (_jsx(Text, { size: "sm", color: "muted", children: line }, line))), _jsxs(Text, { size: "sm", color: "muted", className: "mt-2", children: ["GSTIN:", " ", _jsx(PendingValue, { value: business.gstin, label: "GSTIN" })] }), business.grievanceHref ? (_jsx(Text, { size: "sm", className: "mt-2", children: _jsx(Anchor, { href: business.grievanceHref, children: "Grievance redressal" }) })) : null] })] })] }) })] }), _jsx(AdSlot, { id: "detail-below-price" })] }) }) }) }));
 }

package/dist/features/corporate/api/route.js

@@ -33,7 +33,7 @@ export async function GET(request) {
             filters,
             sort,
             page,
-            perPage: pageSize,
+            pageSize: pageSize,
         });
         const totalPages = Math.max(1, Math.ceil(result.total / pageSize));
         return NextResponse.json({

package/dist/features/corporate/repository/corporate.repository.js

@@ -9,7 +9,7 @@ export class CorporateRepository {
         const result = await this.repo.findAll({
             filters: `status==${status}`,
             sort: "-createdAt",
-            perPage: 100,
+            pageSize: 100,
         });
         return result.data;
     }

package/dist/features/corporate/types/index.d.ts

@@ -33,5 +33,5 @@ export interface CorporateInquiryListResponse {
     data: CorporateInquiry[];
     total: number;
     page: number;
-    perPage: number;
+    pageSize: number;
 }

package/dist/features/cron/jobs/auction-expiry.job.js

@@ -13,7 +13,7 @@ export function createAuctionExpiryJob(auctionRepo) {
     }, async (ctx) => {
         const result = await auctionRepo.findAll({
             filters: sieveAnd(sieveFilter("status", SIEVE_OP.EQ, "live"), sieveFilter("endTime", SIEVE_OP.LTE, ctx.scheduleTime)),
-            perPage: 500,
+            pageSize: 500,
         });
         let processed = 0;
         let errors = 0;

package/dist/features/cron/jobs/preorder-reminder.job.js

@@ -19,7 +19,7 @@ export function createPreOrderReminderJob(preOrderRepo) {
         const cutoff = sevenDaysFromNow();
         const result = await preOrderRepo.findAll({
             filters: sieveAnd(sieveFilter("status", SIEVE_OP.EQ, "confirmed"), sieveFilter("expectedShippingDate", SIEVE_OP.LTE, cutoff)),
-            perPage: 500,
+            pageSize: 500,
         });
         let processed = 0;
         let errors = 0;

package/dist/features/digital-codes/components/DigitalCodeDetailPageView.js

@@ -1,18 +1,18 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import Link from "next/link.js";
 import { getDigitalCodeForDetail } from "../../../_internal/server/features/digital-code/data.js";
-const CLS_BREADCRUMB_LINK = "hover:text-primary-600 transition-colors";
+const CLS_BREADCRUMB_LINK = "hover:text-primary-600 dark:hover:text-primary-400 transition-colors";
 const CLS_DIGITALCODE_BADGE = "inline-block rounded-full bg-violet-100 dark:bg-violet-900/30 px-[var(--appkit-space-2-5)] py-[var(--appkit-space-0-5)] text-violet-700 dark:text-violet-300";
 import { ROUTES } from "../../../next/routing/route-map.js";
 import { getDefaultCurrency } from "../../../core/baseline-resolver.js";
 import { formatCurrency } from "../../../utils/number.formatter.js";
 import { normalizeRichTextHtml } from "../../../utils/string.formatter.js";
 import { safeDisplayName } from "../../../security/index.js";
-import { Div, Container, GatedPrice, Heading, Main, Nav, RichText, Row, Section, Span, Stack, Text, Dl, Dt, Dd, } from "../../../ui/index.js";
+import { Div, Container, GatedPrice, Heading, Main, Nav, RichText, Row, Section, Span, Stack, Text, SpecTable, } from "../../../ui/index.js";
 import { PreOrderDetailView } from "../../products/components/PreOrderDetailView.js";
 import { ProductGalleryClient } from "../../products/components/ProductGalleryClient.js";
 import { ProductTabsShell } from "../../products/components/ProductTabsShell.js";
-import { CustomSectionTabContent } from "../../products/components/CustomSectionTabContent.js";
+import { toCustomSectionTabs } from "../../products/components/CustomSectionTabContent.js";
 import { ShareButton } from "../../products/components/ShareButton.js";
 import { HistoryTracker } from "../../history/components/HistoryTracker.js";
 import { RelatedItemsSection } from "../../products/components/RelatedItemsSection.js";
@@ -52,7 +52,6 @@ export async function DigitalCodeDetailPageView({ slug, initialProduct, renderPr
     const storeSlug = (typeof p.storeSlug === "string" ? p.storeSlug : null) || (typeof p.storeId === "string" ? p.storeId : null);
     const storeHref = storeSlug ? String(ROUTES.PUBLIC.STORE_DETAIL(storeSlug)) : null;
     const specs = Array.isArray(p.specifications) ? p.specifications : [];
-    const customSections = Array.isArray(p.customSections) ? p.customSections : [];
     const descriptionHtml = toDescriptionHtml(p.description);
     const [{ relatedItems, relatedByBrand, relatedByTags, relatedByStore }, groups, initialReviews] = await Promise.all([
         computeRelatedItems(product),
@@ -65,11 +64,7 @@ export async function DigitalCodeDetailPageView({ slug, initialProduct, renderPr
                     price: price ?? undefined,
                     storeId: typeof p.storeId === "string" ? p.storeId : undefined,
                     storeName: storeName ?? undefined,
-                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.DIGITAL_CODES), className: CLS_BREADCRUMB_LINK, children: "Digital Codes" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(PreOrderDetailView, { renderGallery: () => _jsx(ProductGalleryClient, { images: images, productName: title }), renderInfo: () => (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_DIGITALCODE_BADGE, children: "Digital Code" }), codesLeft > 0 ? (_jsxs(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: [codesLeft, " available"] })) : (_jsx(Span, { size: "xs", weight: "semibold", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "danger-surface", color: "error", children: "Sold out" }))] }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), price !== null && (_jsx(Text, { size: "2xl", weight: "bold", color: "primary", children: _jsx(GatedPrice, { children: formatCurrency(price, currency) }) })), meta?.redemptionInstructions && (_jsx(Text, { size: "xs", color: "muted", children: meta.redemptionInstructions })), descriptionHtml && (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" })), safeSeller && (_jsx(Div, { border: "subtle", rounded: "xl", surface: "muted", padding: "md", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Sold by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && (_jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" }))] }) }))] })), renderTabs: () => (_jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(Dl, { divide: "subtle", rounded: "xl", border: "subtle", className: "overflow-hidden", children: specs.map((s, i) => (_jsxs(Row, { gap: "md", oddEven: "zebra", surface: "default", padding: "inline", children: [_jsx(Dt, { className: "w-36 flex-shrink-0", color: "primary", weight: "medium", children: s.name }), _jsxs(Dd, { className: "flex-1", color: "muted", children: [s.value, s.unit ? ` ${s.unit}` : ""] })] }, i))) })) : undefined, reviewsContent: _jsx(ReviewsListingPanel, { source: { kind: "product", productId: product.id }, stateMode: "local", context: "listing", initialData: initialReviews, emptyLabel: "No reviews yet \u2014 be the first to review this product." }), customTabs: customSections.map((s) => ({
-                                id: s.id,
-                                label: s.title,
-                                content: _jsx(CustomSectionTabContent, { section: s }),
-                            })) })), renderBuyBar: () => (_jsx(Div, { id: "digital-code-buy-bar", children: renderPrimaryActions?.({
+                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.DIGITAL_CODES), className: CLS_BREADCRUMB_LINK, children: "Digital Codes" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(PreOrderDetailView, { renderGallery: () => _jsx(ProductGalleryClient, { images: images, productName: title }), renderInfo: () => (_jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_DIGITALCODE_BADGE, children: "Digital Code" }), codesLeft > 0 ? (_jsxs(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: [codesLeft, " available"] })) : (_jsx(Span, { size: "xs", weight: "semibold", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "danger-surface", color: "error", children: "Sold out" }))] }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), price !== null && (_jsx(Text, { size: "2xl", weight: "bold", color: "primary", children: _jsx(GatedPrice, { children: formatCurrency(price, currency) }) })), meta?.redemptionInstructions && (_jsx(Text, { size: "xs", color: "muted", children: meta.redemptionInstructions })), descriptionHtml && (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" })), safeSeller && (_jsx(Div, { border: "subtle", rounded: "xl", surface: "muted", padding: "md", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Sold by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && (_jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" }))] }) }))] })), renderTabs: () => (_jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(SpecTable, { rows: specs })) : undefined, reviewsContent: _jsx(ReviewsListingPanel, { source: { kind: "product", productId: product.id }, stateMode: "local", context: "listing", initialData: initialReviews, emptyLabel: "No reviews yet \u2014 be the first to review this product." }), customTabs: toCustomSectionTabs(p.customSections) })), renderBuyBar: () => (_jsx(Div, { id: "digital-code-buy-bar", children: renderPrimaryActions?.({
                                 productId: String(product.id),
                                 productSlug: String(p.slug ?? product.id),
                                 productTitle: title,

package/dist/features/events/actions/event-actions.d.ts

@@ -114,6 +114,20 @@ export declare function getEventSpinResults(eventId: string, limit?: number): Pr
  * supplied by the server from a verified session, never by the client.
  */
 export declare function getUserSpinResultsForEvent(eventId: string, userId: string): Promise<import("../types").SpinResultEntry[]>;
+/**
+ * Has this signed-in user already entered this event?
+ *
+ * Exists so the participate page can render a raffle's already-entered state on
+ * FIRST PAINT. The form tracked it in `useState(0)`, which a reload reset — so
+ * a returning entrant saw an inviting empty form, submitted, and was refused.
+ * A refusal the page could have predicted is a worse experience than a form
+ * that says so up front.
+ *
+ * Reuses `hasUserEntered` (one `(eventId, userId)` equality pair, an index that
+ * is already proven by `countUserEntries`) rather than counting, because the
+ * limit is one — see `RAFFLE_MAX_ENTRIES_PER_USER`.
+ */
+export declare function hasUserEnteredEvent(eventId: string, userId: string): Promise<boolean>;
 /**
  * Per-option vote tally for a poll event — replaces the voter-ranked
  * leaderboard for event.type === "poll", where ranking "who happened to

package/dist/features/events/actions/event-actions.js

@@ -12,11 +12,11 @@ import { eventEntryRepository } from "../repository/event-entry.repository.js";
 import { ERROR_MESSAGES, AuthorizationError, ValidationError, NotFoundError, } from "../../../errors/index.js";
 import { resolveDate } from "../../../utils/index.js";
 import { hashGuestIdentity } from "../../../security/rate-limit.js";
+import { RAFFLE_MAX_ENTRIES_PER_USER } from "../../../_internal/shared/features/events/config.js";
 const ERR_EVENT_NOT_FOUND = "Event not found";
 import { coerceMediaField, getMediaUrl } from "../../../utils/index.js";
 import { finalizeStagedMediaField, finalizeStagedMediaObject, finalizeStagedMediaObjectArray, } from "../../media/finalize.js";
 import { hidePublicTestData } from "../../../_internal/server/features/tester/visibility.js";
-import { maskName } from "../../../security/pii-mask.js";
 // --- Admin: Create Event --------------------------------------------------
 export async function createEvent(adminId, input) {
     const finalizedCoverUrl = await finalizeStagedMediaField(getMediaUrl(input.coverImage) ??
@@ -193,6 +193,11 @@ export async function getEventSpinResults(eventId, limit = 10) {
         return [];
     const prizeTitleById = new Map((event.spinPrizes ?? []).map((p) => [p.id, p.label]));
     const entries = await eventEntryRepository.getRecentSpinResults(event.id, limit);
+    /*
+     * Spin results are shown publicly, so the entrant name is MASKED — and it
+     * has to be masked by `maskedEntry`, which decrypts first. `maskName` on the
+     * stored value answers "Anonymous" for every row by design.
+     */
     return entries.map((entry) => ({
         id: entry.id,
         /*
@@ -211,7 +216,15 @@ export async function getEventSpinResults(eventId, limit = 10) {
          * on for its own label. A caller's OWN spins are served unmasked by
          * `getUserSpinResultsForEvent` — masking is for other people's.
          */
-        userDisplayName: entry.userId ? maskName(entry.userDisplayName) : undefined,
+        /*
+           * `maskedEntry`, not `maskName` on the stored value. `maskName`
+           * refuses ciphertext by design and answers "Anonymous", so this
+           * public list showed every entrant as Anonymous. `maskedEntry`
+           * decrypts first, then masks.
+           */
+        userDisplayName: entry.userId
+            ? eventEntryRepository.maskedEntry(entry).userDisplayName
+            : undefined,
         isGuest: !entry.userId,
         spinPrizeId: entry.spinPrizeId,
         spinPrizeTitle: entry.spinPrizeId ? prizeTitleById.get(entry.spinPrizeId) : undefined,
@@ -238,13 +251,35 @@ export async function getUserSpinResultsForEvent(eventId, userId) {
     const entries = await eventEntryRepository.getUserSpinResults(event.id, userId);
     return entries.map((entry) => ({
         id: entry.id,
-        userDisplayName: entry.userDisplayName,
+        userDisplayName: eventEntryRepository.maskedEntry(entry).userDisplayName,
         isGuest: false,
         spinPrizeId: entry.spinPrizeId,
         spinPrizeTitle: entry.spinPrizeId ? prizeTitleById.get(entry.spinPrizeId) : undefined,
+        // Safe here and ONLY here — `userId` comes from a verified session, so
+        // this is the caller's own prize. The public feed must not carry it.
+        spinPrizeCouponCode: entry.spinPrizeCouponCode ?? undefined,
         spinWonAt: entry.spinWonAt ? new Date(entry.spinWonAt).toISOString() : undefined,
     }));
 }
+/**
+ * Has this signed-in user already entered this event?
+ *
+ * Exists so the participate page can render a raffle's already-entered state on
+ * FIRST PAINT. The form tracked it in `useState(0)`, which a reload reset — so
+ * a returning entrant saw an inviting empty form, submitted, and was refused.
+ * A refusal the page could have predicted is a worse experience than a form
+ * that says so up front.
+ *
+ * Reuses `hasUserEntered` (one `(eventId, userId)` equality pair, an index that
+ * is already proven by `countUserEntries`) rather than counting, because the
+ * limit is one — see `RAFFLE_MAX_ENTRIES_PER_USER`.
+ */
+export async function hasUserEnteredEvent(eventId, userId) {
+    const event = await eventRepository.findByIdOrSlug(eventId);
+    if (!event)
+        return false;
+    return eventEntryRepository.hasUserEntered(event.id, userId);
+}
 /**
  * Per-option vote tally for a poll event — replaces the voter-ranked
  * leaderboard for event.type === "poll", where ranking "who happened to
@@ -398,6 +433,33 @@ export async function enterEvent(eventId, input, user, request) {
             throw new ValidationError(ERROR_MESSAGES.EVENT.ALREADY_ENTERED);
         }
     }
+    /*
+     * 🛑 The same hole, one event type over: a signed-in user could enter the
+     * SAME RAFFLE as many times as they liked, and every entry joined the
+     * winner pool.
+     *
+     * Guests were deduped by hashed IP, surveys enforced `maxEntriesPerUser`,
+     * polls got the guard documented above — and raffle, the one type where a
+     * duplicate entry is a direct and quantifiable unfairness, had none. The
+     * client-side guard was inert in two independent ways: `submissionCount` is
+     * `useState(0)` that is never hydrated from the server, so a reload resets
+     * it; and `maxEntriesPerUser` was not passed to `EventRaffleEntryForm` at
+     * all, so it defaulted to 1 while nothing enforced it.
+     *
+     * The limit is `RAFFLE_MAX_ENTRIES_PER_USER`, shared with the form that
+     * renders "you've used all N entry slots" — there is no raffle config to
+     * consult (`maxEntriesPerUser` lives on `SurveyConfig` only), and two
+     * mirrored literals is how the UI came to claim a limit nothing enforced.
+     *
+     * Reuses the same `countUserEntries` as the survey and poll paths, so the
+     * read cost and the `(eventId, userId)` index it needs are already proven.
+     */
+    if (user && event.type === "raffle") {
+        const priorEntries = await eventEntryRepository.countUserEntries(resolvedEventId, user.uid);
+        if (priorEntries >= RAFFLE_MAX_ENTRIES_PER_USER) {
+            throw new ValidationError(ERROR_MESSAGES.EVENT.ALREADY_ENTERED);
+        }
+    }
     if (event.type === "poll" && event.pollConfig) {
         const validOptionIds = event.pollConfig.options.map((o) => o.id);
         const votes = input.pollVotes ?? [];
@@ -421,8 +483,25 @@ export async function enterEvent(eventId, input, user, request) {
             }
         }
     }
+    /*
+     * 🛑 `raffle` was absent here, and that is what kept the raffle draw broken
+     * even after its pool query was fixed.
+     *
+     * `runTriggerEventRaffle` builds its pool from `reviewStatus == "approved"`.
+     * With raffle missing from this list every live entry was written `pending`,
+     * so a freshly-entered raffle still drew from an empty pool — the fix to the
+     * query alone would have changed nothing a user could see.
+     *
+     * A raffle entry is a name and an optional message. There is no submitted
+     * content to moderate, which is why it belongs with `poll` and `feedback`
+     * rather than behind `survey`'s `entryReviewRequired` opt-in. An admin can
+     * still FLAG an individual entry, and flagging correctly drops it from the
+     * pool — that is the moderation path, not a standing review queue of every
+     * entrant.
+     */
     const autoApprove = event.type === "poll" ||
         event.type === "feedback" ||
+        event.type === "raffle" ||
         (event.type === "survey" &&
             !event.surveyConfig?.entryReviewRequired);
     const reviewStatus = autoApprove ? "approved" : "pending";

package/dist/features/events/api/[id]/route.js

@@ -47,7 +47,7 @@ export async function GET(_request, context) {
             event.pollConfig?.resultsVisibility === "always") {
             const allEntries = await entriesRepo.findAll({
                 filters: `eventId==${id}`,
-                perPage: 1000,
+                pageSize: 1000,
             });
             const voteCounts = {};
             for (const entry of allEntries.data) {
@@ -70,7 +70,7 @@ export async function GET(_request, context) {
                 filters: `eventId==${id},reviewStatus==approved`,
                 sort: "points",
                 order: "desc",
-                perPage: 10,
+                pageSize: 10,
             });
             leaderboard = leaderboardResult.data.map((entry) => {
                 const { userId: _userId, userEmail: _userEmail, ...rest } = entry;

package/dist/features/events/components/AdminEventEditorView.js

@@ -3,11 +3,14 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { normalizeError } from "../../../errors/normalize.js";
 import { useApiMutation } from "@mohasinac/appkit/client";
 import React, { useEffect } from "react";
+import { useTranslations } from "next-intl";
 import { useQuery } from "@tanstack/react-query";
 import { Alert, Button, Div, Grid, Heading, Input, Label, RichTextEditor, Row, Select, Stack, StackedViewShell, TagInput, Text, Textarea, Toggle, } from "../../../ui/index.js";
 import { FormShellContext, useFormShellState, applyZodIssues, FormErrorSummary } from "../../../ui/forms/index.js";
 import { apiClient } from "../../../http/index.js";
 import { ADMIN_ENDPOINTS } from "../../../constants/api-endpoints.js";
+import { ACTIONS } from "../../../_internal/shared/actions/action-registry.js";
+import { toUserMessage } from "../../../errors/error-display-map.js";
 import { ALL_EVENT_TYPES, EVENT_TYPE_LABELS } from "../types/index.js";
 import { SectionForm, useSectionFormNav } from "../../shell/index.js";
 import { eventDraftSchema } from "../schemas/event-form.js";
@@ -214,13 +217,16 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
     const [slugManual, setSlugManual] = React.useState(false);
     const [saveMessage, setSaveMessage] = React.useState(null);
     const [triggerMessage, setTriggerMessage] = React.useState(null);
+    // Root translator (no namespace) — `toUserMessage` passes fully-qualified
+    // `errors.codes.*` keys and resolves them itself. Same precedent as
+    // `PlaceBidFormClient` and `SpinWheelView`.
+    const t = useTranslations();
     const [raffleWinnerName, setRaffleWinnerName] = React.useState("");
     const [raffleEntryCount, setRaffleEntryCount] = React.useState(null);
     const [raffleGithubUrl, setRaffleGithubUrl] = React.useState("");
     const { shellCtx, setFieldError, validate } = useFormShellState(eventDraftSchema);
     useEffect(() => {
         validate(draft);
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [draft, validate]);
     const update = React.useCallback((partial) => {
         setDraft((prev) => ({ ...prev, ...partial }));
@@ -338,7 +344,20 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
                 setRaffleEntryCount(data.raffleEntryCount);
         },
         onError: (err) => {
-            setTriggerMessage(err instanceof Error ? err.message : "Trigger failed");
+            /*
+             * 🛑 `err.message` was printed straight into the panel — the shape Root
+             * Cause #86 is about, and the ternary was inverted besides: the authored
+             * sentence only showed when the value was NOT an Error, i.e. almost
+             * never, so the normal case rendered raw server text to an admin.
+             *
+             * The route now returns a stable `code` for every refusal, so the copy
+             * resolves through `errors.codes.*`. The one that matters is
+             * `RAFFLE_ALREADY_DRAWN` — "a winner has already been drawn" is a
+             * completely different instruction from the old generic failure, and it
+             * is what a second click gets now that the draw is transactional.
+             */
+            const e = normalizeError(err);
+            setTriggerMessage(toUserMessage(e.code, t, { fallback: "Could not draw a winner." }));
         },
     });
     const isLoading = saveMutation.isPending || eventQuery.isLoading;
@@ -392,7 +411,7 @@ export function AdminEventEditorView({ eventId, onSaved, embedded, allowedTypes,
                 const isRaffleType = values.type === "raffle" || values.type === "spin_wheel";
                 const showRaffleConfig = isRaffleType || values.hasRaffle;
                 const isSpinMode = values.type === "spin_wheel" || values.raffleType === "spin_wheel";
-                return (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Raffle & Spin Wheel" }), !isRaffleType && (_jsx(Toggle, { checked: values.hasRaffle, onChange: (v) => onChange({ hasRaffle: v }), label: "Attach a raffle to this event" })), !isRaffleType && !values.hasRaffle && (_jsx(Text, { size: "sm", color: "muted", children: "Enable the toggle above to attach a raffle draw to this event. Not applicable for this event type by default." })), showRaffleConfig && (_jsxs(Stack, { gap: "md", rounded: "xl", border: "default", padding: "md", children: [_jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(Select, { label: "Raffle type", value: values.type === "spin_wheel" ? "spin_wheel" : values.raffleType, options: RAFFLE_TYPE_OPTIONS, onChange: (e) => onChange({ raffleType: e.target.value }), disabled: values.type === "spin_wheel" }), _jsx(Input, { label: "Top N (for top-N raffle types)", type: "number", value: values.raffleTopN, onChange: (e) => onChange({ raffleTopN: e.target.value }), placeholder: "10" })] }), _jsx(Input, { label: "Prize description", value: values.rafflePrize, onChange: (e) => onChange({ rafflePrize: e.target.value }), placeholder: "\u20B92,000 store credit + exclusive Pikachu sticker" }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Coupon for winner (optional)" }), _jsx(CouponInlineSelect, { scope: "admin", value: values.rafflePrizeCouponId, onChange: (id) => onChange({ rafflePrizeCouponId: id ?? "" }), placeholder: "Search coupons\u2026", allowCreate: false })] }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Prize products (optional)" }), _jsx(ProductInlineSelect, { scope: "admin", multiple: true, value: values.rafflePrizeProductIds, onChange: (ids) => onChange({ rafflePrizeProductIds: ids }), placeholder: "Search products to feature as prizes\u2026" }), _jsx(Text, { size: "xs", color: "muted", className: "mt-1", children: "Products shown to winners or displayed as the prize showcase." })] }), isSpinMode && _jsx(SpinPrizesEditor, { values: values, onChange: onChange }), isEdit && (_jsxs(Stack, { gap: "xs", rounded: "lg", padding: "sm", className: CLS_RAFFLE_PANEL, children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", className: CLS_RAFFLE_HEADING, children: raffleWinnerName ? `Winner: ${raffleWinnerName}` : "Raffle not yet triggered" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", onClick: () => triggerRaffleMutation.mutate(), disabled: triggerRaffleMutation.isPending || Boolean(raffleWinnerName), children: triggerRaffleMutation.isPending ? "Triggering…" : raffleWinnerName ? "Already triggered" : "Trigger Raffle Now" })] }), raffleEntryCount !== null && _jsxs(Text, { size: "xs", className: CLS_RAFFLE_BODY, children: ["Pool size: ", raffleEntryCount] }), raffleGithubUrl && _jsxs(Text, { size: "xs", className: `break-all ${CLS_RAFFLE_BODY}`, children: ["Fairness proof: ", raffleGithubUrl] }), triggerMessage && _jsx(Text, { size: "xs", className: CLS_RAFFLE_HEADING, children: triggerMessage })] }))] }))] }));
+                return (_jsxs(Stack, { gap: "md", children: [_jsx(Heading, { level: 3, className: "mb-2", children: "Raffle & Spin Wheel" }), !isRaffleType && (_jsx(Toggle, { checked: values.hasRaffle, onChange: (v) => onChange({ hasRaffle: v }), label: "Attach a raffle to this event" })), !isRaffleType && !values.hasRaffle && (_jsx(Text, { size: "sm", color: "muted", children: "Enable the toggle above to attach a raffle draw to this event. Not applicable for this event type by default." })), showRaffleConfig && (_jsxs(Stack, { gap: "md", rounded: "xl", border: "default", padding: "md", children: [_jsxs(Grid, { cols: 2, gap: "sm", children: [_jsx(Select, { label: "Raffle type", value: values.type === "spin_wheel" ? "spin_wheel" : values.raffleType, options: RAFFLE_TYPE_OPTIONS, onChange: (e) => onChange({ raffleType: e.target.value }), disabled: values.type === "spin_wheel" }), _jsx(Input, { label: "Top N (for top-N raffle types)", type: "number", value: values.raffleTopN, onChange: (e) => onChange({ raffleTopN: e.target.value }), placeholder: "10" })] }), _jsx(Input, { label: "Prize description", value: values.rafflePrize, onChange: (e) => onChange({ rafflePrize: e.target.value }), placeholder: "\u20B92,000 store credit + exclusive Pikachu sticker" }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Coupon for winner (optional)" }), _jsx(CouponInlineSelect, { scope: "admin", value: values.rafflePrizeCouponId, onChange: (id) => onChange({ rafflePrizeCouponId: id ?? "" }), placeholder: "Search coupons\u2026", allowCreate: false })] }), _jsxs(Div, { children: [_jsx(Text, { size: "sm", weight: "medium", className: "mb-1", children: "Prize products (optional)" }), _jsx(ProductInlineSelect, { scope: "admin", multiple: true, value: values.rafflePrizeProductIds, onChange: (ids) => onChange({ rafflePrizeProductIds: ids }), placeholder: "Search products to feature as prizes\u2026" }), _jsx(Text, { size: "xs", color: "muted", className: "mt-1", children: "Products shown to winners or displayed as the prize showcase." })] }), isSpinMode && _jsx(SpinPrizesEditor, { values: values, onChange: onChange }), isEdit && (_jsxs(Stack, { gap: "xs", rounded: "lg", padding: "sm", className: CLS_RAFFLE_PANEL, children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", className: CLS_RAFFLE_HEADING, children: raffleWinnerName ? `Winner: ${raffleWinnerName}` : "Raffle not yet triggered" }), _jsx(Button, { type: "button", action: ACTIONS.EVENT["draw-raffle-winner"], size: "sm", onClick: () => triggerRaffleMutation.mutate(), disabled: triggerRaffleMutation.isPending || Boolean(raffleWinnerName), children: triggerRaffleMutation.isPending ? "Triggering…" : raffleWinnerName ? "Already triggered" : "Trigger Raffle Now" })] }), raffleEntryCount !== null && _jsxs(Text, { size: "xs", className: CLS_RAFFLE_BODY, children: ["Pool size: ", raffleEntryCount] }), raffleGithubUrl && _jsxs(Text, { size: "xs", className: `break-all ${CLS_RAFFLE_BODY}`, children: ["Fairness proof: ", raffleGithubUrl] }), triggerMessage && _jsx(Text, { size: "xs", className: CLS_RAFFLE_HEADING, children: triggerMessage })] }))] }))] }));
             },
         },
     ];

package/dist/features/events/components/AdminEventsView.js

@@ -10,7 +10,8 @@ import { ALL_EVENT_TYPES, EVENT_TYPE_LABELS } from "../types/index.js";
 import { toRecordArray, toRelativeDate, toStringValue, } from "../../admin/hooks/useAdminListingData.js";
 import { DataListingView } from "../../admin/components/DataListingView.js";
 import { AdminEventEditorView } from "./AdminEventEditorView.js";
-import { ADMIN_BULK_ACTIONS, ROW_ACTION_META } from "../../products/constants/action-defs.js";
+import { ADMIN_BULK_ACTIONS, ROW_ACTION_ID, ROW_ACTION_META } from "../../products/constants/action-defs.js";
+import { apiClient } from "../../../http/index.js";
 /**
  * Derived from the `EventType` union (2026-08-24).
  *
@@ -74,13 +75,36 @@ export function AdminEventsView({ children, ...props }) {
             label: "Add Event",
             onClick: ({ openCreatePanel }) => openCreatePanel(),
         },
-        // Rule #7: bulk-action array sourced from the ADMIN_BULK_ACTIONS preset.
-        buildBulkActions: (selection) => ADMIN_BULK_ACTIONS.events.map((id) => ({
-            id,
-            label: ROW_ACTION_META[id].label,
-            destructive: ROW_ACTION_META[id].destructive,
-            onClick: () => selection.clearSelection(),
-        })),
+        /*
+         * Rule #7: bulk-action array sourced from the ADMIN_BULK_ACTIONS preset.
+         *
+         * 🛑 This used to map every preset id to `onClick: () => clearSelection()`
+         * — so the bulk bar rendered a red "Delete" that selected rows, asked
+         * nothing, deleted nothing, and then cleared the checkboxes, which reads
+         * exactly like a successful delete until the list refreshes. A destructive
+         * control that silently no-ops is worse than an absent one (Rule #8).
+         *
+         * Wired self-contained against `DELETE /api/admin/events/[id]`, following
+         * `AdminBundlesView`; the `.filter` keeps `AdminFaqsView`'s discipline that
+         * an unwired preset id is OMITTED rather than shown inert, so the next id
+         * added to the preset cannot reintroduce this.
+         */
+        buildBulkActions: (selection) => {
+            const handlers = {
+                [ROW_ACTION_ID.DELETE]: async () => {
+                    await Promise.all(selection.selectedIds.map((id) => apiClient.delete(ADMIN_ENDPOINTS.EVENT_BY_ID(id))));
+                    selection.clearSelection();
+                },
+            };
+            return ADMIN_BULK_ACTIONS.events
+                .filter((id) => handlers[id])
+                .map((id) => ({
+                id,
+                label: ROW_ACTION_META[id].label,
+                destructive: ROW_ACTION_META[id].destructive,
+                onClick: handlers[id],
+            }));
+        },
         renderFilterPanel: ({ pendingFilters, setPendingFilters }) => (_jsxs(_Fragment, { children: [_jsx(FilterChipGroup, { label: "Status", tabs: ADMIN_EVENT_STATUS_TABS, value: pendingFilters.status ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, status: id })) }), _jsx(FilterChipGroup, { label: "Type", tabs: TYPE_OPTIONS, value: pendingFilters.type ?? "", onChange: (id) => setPendingFilters((p) => ({ ...p, type: id })) })] })),
         renderEditor: ({ editId, closePanel }) => (_jsx(AdminEventEditorView, { eventId: editId ?? undefined, onSaved: closePanel, embedded: true })),
         resolveEditorTitle: ({ isCreate }) => (isCreate ? "Add Event" : "Edit Event"),

package/dist/features/events/components/EventRafflesSection.d.ts

@@ -4,6 +4,39 @@ export interface EventRafflesSectionProps {
 }
 /**
  * Renders a live-raffle/spin-wheel strip on the homepage.
- * W1-38 (2026-05-23): fetches events with hasRaffle=true and renders the EventCard grid.
+ *
+ * ## It was showing the wrong events, and nothing could tell
+ *
+ * The filter was `hasRaffle == "true"` — and **`hasRaffle` is not in
+ * `EventRepository.SIEVE_FIELDS`**. `sieve.ts` sets `throwExceptions: false`,
+ * so an unallowlisted field does not raise: `findField` returns undefined and
+ * the clause is **silently discarded** (Root Cause #62, EMITTED_BUT_UNFILTERABLE).
+ *
+ * So this did not return zero rows and it did not disappear. It ran
+ * `status == active` sorted `-startsAt` and rendered **the six most
+ * recently-started active events of ANY type** — sales, polls, feedback forms —
+ * under a heading reading "Live Raffles & Spin Wheels". Every card was a real,
+ * live event, which is exactly why it never looked broken.
+ *
+ * ## Why `type`, and why one query
+ *
+ * `config.raffleType` is already `"raffle" | "spin_wheel" | "all"` — the config
+ * has always spoken the `type` vocabulary and already answers "both belong
+ * here", so the title is truthful and `type` is the honest field to match.
+ * `type` IS in `SIEVE_FIELDS` and is indexed `(type, status, startsAt DESC)`,
+ * so this needs no new composite index.
+ *
+ * 🛑 The `"all"` case is a PIPE-joined value, not `sieveMultiEq`. Sieve parses
+ * `type==a|b` as one OR-group, and the Firebase adapter upgrades a same-field
+ * OR-group of equalities into a single Firestore `in` query. `sieveMultiEq`
+ * comma-joins instead, and a comma is an AND: `type==raffle,type==spin_wheel`
+ * is two equalities on one field, which no document can satisfy (Root
+ * Cause #59).
+ *
+ * Accepted limitation, deliberately: `hasRaffle` is an optional bolt-on that
+ * *could* sit on a `sale` event, and such an event would not appear here. No
+ * seeded event is shaped that way — all three `hasRaffle: true` rows are
+ * already `type: "raffle"` — and a sale with a side raffle belongs in the sale
+ * strip. If that changes, the fix is a second clause, not a wider title.
  */
 export declare function EventRafflesSection({ config, }: EventRafflesSectionProps): Promise<import("react").JSX.Element | null>;