@mohasinac/appkit 4.52.5 → 4.53.1

package/dist/features/stores/components/StoreHeader.js

@@ -3,7 +3,6 @@ import { Button, Div, Heading, RichText, Row, Section, Span, Text, } from "../..
 import { MediaImage } from "../../media/MediaImage.js";
 import { normalizeRichTextHtml } from "../../../utils/string.formatter.js";
 import { ShareButton } from "../../products/components/ShareButton.js";
-import { StoreScopedSearch } from "./StoreScopedSearch.js";
 import { SellerTrustBadge } from "../../scams/components/SellerTrustBadge.js";
 const __O = {
     hidden: "overflow-hidden",
@@ -15,5 +14,5 @@ const CLS_WARN_BANNER = "mt-3 rounded-lg bg-warning-surface dark:bg-warning-surf
 export function StoreHeader({ store, labels = {}, onFollow, className = "", trust, }) {
     return (_jsxs(Section, { surface: "default", border: "bottom", className: className, children: [store.storeBannerURL && (_jsx(Div, { className: `relative h-40 md:h-56 ${__O.hidden} bg-[var(--appkit-color-surface)] bg-[var(--appkit-color-surface-elevated)]`, children: _jsx(MediaImage, { src: store.storeBannerURL, alt: `${store.storeName} banner`, size: "banner" }) })), _jsxs(Div, { paddingX: "x-page", className: "max-w-7xl mx-auto", padding: "y-md", children: [_jsxs(Row, { align: "end", gap: "md", children: [store.storeLogoURL ? (_jsx(Div, { className: "relative -mt-8 h-16 w-16 border-2 border-white", rounded: "xl", shadow: "sm", overflow: "hidden", children: _jsx(MediaImage, { src: store.storeLogoURL, alt: store.storeName, size: "avatar" }) })) : (_jsx(Div, { className: CLS_AVATAR, children: store.storeName[0]?.toUpperCase() })), _jsxs(Div, { className: "flex-1 min-w-0", children: [_jsxs(Row, { className: "mb-0.5", align: "center", gap: "sm", wrap: true, children: [_jsx(Heading, { level: 1, className: "text-[var(--appkit-color-text)]", size: "xl", weight: "bold", children: store.storeName }), store.averageRating != null && store.averageRating > 0 && (_jsxs(Span, { size: "sm", weight: "medium", className: CLS_STARS, children: ["\u2605 ", store.averageRating.toFixed(1)] })), trust && _jsx(SellerTrustBadge, { trust: trust })] }), _jsxs(Row, { textSize: "xs", className: "text-[var(--appkit-color-text-muted)] mb-0.5", gap: "3", children: [store.category && _jsx(Span, { transform: "capitalize", children: store.category }), store.totalProducts != null && store.totalProducts > 0 && (_jsxs(Span, { children: [store.totalProducts, " ", labels.products ?? "products"] })), store.totalReviews != null && store.totalReviews > 0 && (_jsxs(Span, { children: [store.totalReviews, " ", labels.reviews ?? "reviews"] })), store.itemsSold != null && store.itemsSold > 0 && (_jsxs(Span, { children: [store.itemsSold, " ", labels.sold ?? "sold"] }))] }), store.storeDescription && (_jsx(RichText, { html: normalizeRichTextHtml(store.storeDescription), copyableCode: true, className: "mt-0.5" }))] }), _jsxs(Row, { gap: "sm", align: "center", className: "shrink-0", children: [_jsx(ShareButton, { title: store.storeName }), onFollow && (_jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: () => onFollow(store.storeSlug), className: CLS_FOLLOW_BTN, children: labels.follow ?? "Follow" }))] })] }), store.isVacationMode && (_jsx(Text, { className: CLS_WARN_BANNER, children: store.vacationMessage ??
                             labels.vacationMode ??
-                            "Store is on vacation mode" })), _jsx(Div, { className: "mt-3", children: _jsx(StoreScopedSearch, { storeId: store.storeSlug, storeName: store.storeName }) })] })] }));
+                            "Store is on vacation mode" }))] })] }));
 }

package/dist/features/stores/components/StoreNavTabs.js

@@ -1,7 +1,7 @@
 "use client";
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 import { useRouter } from "next/navigation.js";
-import { TabBarButton, TabBarShell, TabsNavSelect, TextLink } from "../../../ui/index.js";
+import { OverflowRow, TabBarButton, TabBarShell, TextLink } from "../../../ui/index.js";
 export function StoreNavTabs({ tabs, dropdownTabs = [], dropdownPlaceholder = "Browse listings", activeValue, onTabChange, renderTabBar, className = "", }) {
     const router = useRouter();
     const handleChange = (v) => onTabChange?.(v);
@@ -25,7 +25,22 @@ export function StoreNavTabs({ tabs, dropdownTabs = [], dropdownPlaceholder = "B
      * the wrong element for sizing utilities (Root Cause #29); those now live
      * on `.appkit-tabs-dropdown` in Tabs.style.css.
      */
-    const leading = dropdownTabs.length > 0 ? (_jsx(TabsNavSelect, { ariaLabel: dropdownPlaceholder, options: dropdownTabs.map((tab) => ({ value: tab.value, label: tab.label })), value: activeDropdownTab?.value ?? "", placeholder: activeDropdownTab ? undefined : dropdownPlaceholder, selected: Boolean(activeDropdownTab), onValueChange: handleDropdownChange })) : undefined;
+    /*
+     * `alwaysCollapsed` — this one is a dropdown BY DESIGN, not by measurement.
+     * It is the listing-type picker, deliberately collapsed however much room
+     * the bar has, so adding a tenth listing type can never push the store's
+     * Reviews and About tabs off the edge. That is a product decision about what
+     * belongs in a row, which no width measurement can make.
+     *
+     * It replaced a native `<select>`, so it is now searchable and keyboard
+     * navigable — which matters here because the option set grows with every
+     * listing type the platform adds.
+     */
+    const leading = dropdownTabs.length > 0 ? (_jsx(OverflowRow, { items: dropdownTabs.map((tab) => ({
+            id: tab.value,
+            label: tab.label,
+            onSelect: () => handleDropdownChange(tab.value),
+        })), ariaLabel: dropdownPlaceholder, activeId: activeDropdownTab?.value, placeholder: dropdownPlaceholder, searchPlaceholder: "Search listing types\u2026", alwaysCollapsed: true })) : undefined;
     /*
      * Triggers carry `.appkit-tabs-trigger` and NOTHING else — no padding /
      * size / weight props, no conditional colour classes. `important: true` is

package/dist/features/stores/components/StoreSparesPageView.d.ts

@@ -0,0 +1,27 @@
+import React from "react";
+type SearchParams = Record<string, string | string[]>;
+export interface StoreSparesPageViewProps {
+    storeSlug: string;
+    searchParams?: SearchParams;
+}
+/**
+ * One store's spares tab.
+ *
+ * 🛑 This page EXISTS because `STORE_PAGE_TABS` is derived from the plugin
+ * registry: the Spares tab appeared on every store page the moment the plugin
+ * landed, and a missing folder here is a clickable 404 that no audit covers.
+ * It is the named risk in the Part Two plan and the reason this ships in the
+ * same change as the route key.
+ *
+ * 🛑 It reuses `ProductsIndexListing` with a `storeId` rather than adding a
+ * seventh hand-written `Store<Type>Listing`. Six of those exist, ~140 lines
+ * each of identical toolbar/availability/pagination/grid scaffolding — already
+ * past the Duplication Framework's Rule of Three. Consolidating them is its own
+ * session; declining to make it worse cost one prop.
+ *
+ * `typeTabs={[]}` suppresses the listing-type facet: this page spans exactly
+ * one type, so the facet would render a single checkbox that changes nothing.
+ * `ProductFilters` already guards on an empty option list.
+ */
+export declare function StoreSparesPageView({ storeSlug, searchParams }: StoreSparesPageViewProps): Promise<React.JSX.Element | null>;
+export {};

package/dist/features/stores/components/StoreSparesPageView.js

@@ -0,0 +1,48 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { PRODUCT_FIELDS } from "../../../constants/field-names.js";
+import { sortBy } from "../../../constants/sort.js";
+import { listStoreProducts } from "../../../_internal/server/features/products/list-public.js";
+import { getStoreBySlug } from "./StoreDetailLayoutView.js";
+import { ProductsIndexListing } from "../../products/components/ProductsIndexListing.js";
+const LISTING_TYPES = ["spares"];
+const DEFAULT_PAGE_SIZE = 24;
+const DEFAULT_SORT = sortBy(PRODUCT_FIELDS.CREATED_AT);
+/**
+ * One store's spares tab.
+ *
+ * 🛑 This page EXISTS because `STORE_PAGE_TABS` is derived from the plugin
+ * registry: the Spares tab appeared on every store page the moment the plugin
+ * landed, and a missing folder here is a clickable 404 that no audit covers.
+ * It is the named risk in the Part Two plan and the reason this ships in the
+ * same change as the route key.
+ *
+ * 🛑 It reuses `ProductsIndexListing` with a `storeId` rather than adding a
+ * seventh hand-written `Store<Type>Listing`. Six of those exist, ~140 lines
+ * each of identical toolbar/availability/pagination/grid scaffolding — already
+ * past the Duplication Framework's Rule of Three. Consolidating them is its own
+ * session; declining to make it worse cost one prop.
+ *
+ * `typeTabs={[]}` suppresses the listing-type facet: this page spans exactly
+ * one type, so the facet would render a single checkbox that changes nothing.
+ * `ProductFilters` already guards on an empty option list.
+ */
+export async function StoreSparesPageView({ storeSlug, searchParams }) {
+    const store = await getStoreBySlug(storeSlug);
+    const storeId = store?.id;
+    if (typeof storeId !== "string" || !storeId)
+        return null;
+    // The shared query — never `productRepository.list()` with an inline filter
+    // string swallowed by `.catch(() => null)`, which is how the six older store
+    // tabs rendered empty with nothing logged when an index was missing.
+    const result = await listStoreProducts(storeId, LISTING_TYPES, searchParams ?? {}, {
+        pageSize: DEFAULT_PAGE_SIZE,
+        sorts: DEFAULT_SORT,
+    });
+    return (_jsx(ProductsIndexListing
+    // `undefined`, not `null` — React Query treats `null` as defined data, so
+    // a failed query would freeze an empty grid under `staleTime: Infinity`.
+    , { 
+        // `undefined`, not `null` — React Query treats `null` as defined data, so
+        // a failed query would freeze an empty grid under `staleTime: Infinity`.
+        initialData: result ?? undefined, listingTypes: LISTING_TYPES, typeTabs: [], storeId: storeId, searchPlaceholder: "Search this store's spares..." }));
+}

package/dist/features/stores/manifest.js

@@ -4,10 +4,14 @@ export const manifest = {
     envKeys: [],
     routes: [
         { segment: "[locale]/stores", exports: { default: "StoresIndexPageView" } },
-        {
-            segment: "[locale]/stores/[storeSlug]",
-            exports: { default: "StoreStorefrontView" },
-        },
+        /*
+         * `[locale]/stores/[storeSlug]` is deliberately ABSENT. It is a bare
+         * `redirect()` to the products tab and renders no view at all, so there is
+         * no appkit export to name — and naming one is exactly how
+         * `StoreStorefrontView` (an alias of the orphaned `SellerStoreView` slot
+         * shell) kept reading as wired for as long as it did. The storefront chrome
+         * lives in the segment's own layout; the tabs below are the real views.
+         */
         {
             segment: "[locale]/stores/[storeSlug]/products",
             exports: { default: "StoreProductsView" },

package/dist/features/stores/schemas/firestore.d.ts

@@ -174,6 +174,25 @@ export interface StoreDocument extends BaseDocument {
      * products they want converted — see `ProductRepository`.
      */
     pricesIncludeGst?: boolean;
+    /**
+     * The seller's own 15-character GSTIN, when they have one.
+     *
+     * Absent/empty means unregistered, and the order then carries the
+     * platform's GSTIN. Validate with the existing `isValidGstin` (shape AND
+     * base-36 checksum) — never a second regex.
+     */
+    gstin?: string;
+    /**
+     * Registered legal name, when it differs from `storeName`.
+     *
+     * "Beyblade Arena" is a storefront; "Arena Collectibles Pvt Ltd" is who
+     * issues the invoice. Absent means the platform's legal name is used
+     * alongside the platform GSTIN — the two always travel together, because a
+     * GSTIN under the wrong legal name is a worse invoice than neither.
+     */
+    legalName?: string;
+    /** Registered address as it should appear on the invoice. */
+    registeredAddress?: string;
     /**
      * How this store PRICES shipping — C5b. Absent means `free`.
      *

package/dist/features/support/repository/support.repository.d.ts

@@ -1,8 +1,7 @@
 import { BaseRepository } from "../../../providers/db-firebase";
 import type { FirebaseSieveFields, FirebaseSieveResult, SieveModel } from "../../../providers/db-firebase";
 import type { JsonValue } from "../../../schemas/types";
-import type { DocumentSnapshot } from "firebase-admin/firestore";
-import { type SupportTicketDocument, type SupportTicketCreateInput, type SupportTicketUpdateInput, type TicketMessage, type TicketStatus } from "../schemas/firestore";
+import { type SupportTicketDocument, type SupportTicketPlain, type SupportTicketCreateInput, type SupportTicketUpdateInput, type TicketMessage, type TicketStatus } from "../schemas/firestore";
 import { type HistoryActor } from "../../../_internal/shared/history/index";
 /** Who/why for a write that lands in `statusHistory`. */
 export interface TicketWriteContext {
@@ -33,7 +32,19 @@ export declare class SupportRepository extends BaseRepository<SupportTicketDocum
      */
     protected buildSearchTxtFor(data: Record<string, JsonValue>): string[] | null;
     /** Decrypt on read so callers see the shape they wrote. */
-    protected mapDoc<D = SupportTicketDocument>(snap: DocumentSnapshot): D;
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealTicket(doc: SupportTicketDocument): SupportTicketPlain;
+    /** As `revealTicket`, for a list read. */
+    revealTickets(docs: readonly SupportTicketDocument[]): SupportTicketPlain[];
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedTicket(doc: SupportTicketDocument): SupportTicketPlain;
+    /** As `maskedTicket`, for a list read. */
+    maskedTickets(docs: readonly SupportTicketDocument[]): SupportTicketPlain[];
     createTicket(input: SupportTicketCreateInput): Promise<SupportTicketDocument>;
     getUserTickets(userId: string, page?: number, pageSize?: number): Promise<FirebaseSieveResult<SupportTicketDocument>>;
     /**

package/dist/features/support/repository/support.repository.js

@@ -4,9 +4,9 @@ import { normalizeError } from "../../../errors/normalize.js";
 import { DatabaseError } from "../../../errors/index.js";
 import { SUPPORT_TICKET_FIELDS } from "../../../constants/field-names.js";
 import { buildSearchTxt } from "../../../utils/search-txt.js";
-import { planSearchTxt, emptySearchResult } from "../../../utils/search-txt-query.js";
+import { planSearchTxt, emptySearchResult, beginSearchWindow, } from "../../../utils/search-txt-query.js";
 import { sieveAnd, sieveFilter, SIEVE_OP } from "../../../utils/sieve-builder.js";
-import { decryptPiiFields } from "../../../security/pii-encrypt.js";
+import { maskPii, revealPii } from "../../../security/pii-accessors.js";
 import { SUPPORT_TICKET_COLLECTION, SUPPORT_TICKET_PII_FIELDS, SUPPORT_TICKET_TRACKED_FIELDS, TicketStatusValues, ACTIVE_TICKET_STATUSES, } from "../schemas/firestore.js";
 import { withHistory } from "../../../_internal/shared/history/index.js";
 export class SupportRepository extends BaseRepository {
@@ -35,9 +35,38 @@ export class SupportRepository extends BaseRepository {
         return subject ? buildSearchTxt([subject]) : null;
     }
     /** Decrypt on read so callers see the shape they wrote. */
-    mapDoc(snap) {
-        const raw = super.mapDoc(snap);
-        return decryptPiiFields(raw, [...SUPPORT_TICKET_PII_FIELDS]);
+    /*
+     * 🛑 `mapDoc` is NOT overridden, and that absence IS the change.
+     *
+     * It used to decrypt on every read, so ciphertext never left the database
+     * and every caller handled plaintext without ever saying so. Following
+     * `SiteSettingsRepository`: reads return what Firestore holds, and plaintext
+     * requires one of the two named methods below.
+     *
+     * A convention would not hold this. `SupportTicketDocument`'s PII fields are
+     * `Encrypted<string>`, assignable to nothing that wants a plain `string`, so
+     * a reader that skips both accessors is a compile error naming file and line.
+     */
+    /** Plaintext PII. **Opt-in and named** — shows up in review and in a grep. */
+    revealTicket(doc) {
+        return revealPii(doc, SUPPORT_TICKET_PII_FIELDS);
+    }
+    /** As `revealTicket`, for a list read. */
+    revealTickets(docs) {
+        return docs.map((d) => this.revealTicket(d));
+    }
+    /**
+     * Masked PII — **the default for any surface that only needs to identify a
+     * row to a human.** Decrypts first, then masks: the mask helpers refuse
+     * ciphertext by design, so passing a stored field straight in would return
+     * "Anonymous" for every row.
+     */
+    maskedTicket(doc) {
+        return maskPii(doc, SUPPORT_TICKET_PII_FIELDS);
+    }
+    /** As `maskedTicket`, for a list read. */
+    maskedTickets(docs) {
+        return docs.map((d) => this.maskedTicket(d));
     }
     async createTicket(input) {
         try {
@@ -50,6 +79,9 @@ export class SupportRepository extends BaseRepository {
                 createdAt: now,
                 updatedAt: now,
             };
+            // Plaintext in; `create` encrypts via the write hook. This used to be
+            // `as unknown as SupportTicketDocument` — a double cast that claimed the
+            // freshly-built literal was already ciphertext.
             return this.create(data);
         }
         catch (err) {
@@ -77,9 +109,9 @@ export class SupportRepository extends BaseRepository {
         /*
          * The term is tokenised the same way the index was built, and only the
          * FIRST token is pushed down — Firestore allows one `array-contains` per
-         * query. The rest are applied in memory by `sieveQuery`'s own pass, which
-         * is what keeps a two-word search from silently matching on the first word
-         * alone (the partial-pushdown trap in Root Cause #62).
+         * query. The rest are AND-refined in memory by `beginSearchWindow` /
+         * `finish` below, which is what keeps a two-word search from matching on
+         * one word alone (the partial-pushdown trap in Root Cause #62).
          */
         const clauses = [
             sieveFilter(SUPPORT_TICKET_FIELDS.STORE_ID, SIEVE_OP.EQ, storeId),
@@ -101,13 +133,29 @@ export class SupportRepository extends BaseRepository {
         if (plan.head) {
             baseQuery = baseQuery.where(SUPPORT_TICKET_FIELDS.SEARCH_TXT, "array-contains", plan.head);
         }
+        /*
+         * 🛑 The comment above used to claim `sieveQuery` applied the remaining
+         * terms "in memory by its own pass". It does not and never did — nothing
+         * read `plan.rest`, so a two-word search returned every ticket matching
+         * the LONGEST word, with `truncated` unset so the pager also claimed the
+         * result was complete. The claim was the only thing standing where the
+         * refine should have been (Root Cause #50's shape: a named guarantee with
+         * no implementation behind it).
+         *
+         * `beginSearchWindow` is the three-part conversion, and all three parts
+         * have to happen together — fetch a window, RAISE `maxPageSize` to it, and
+         * hand `finish` the page to slice. Doing one and three without two leaves
+         * Sieve clamping the window back to a page, which reads exactly like a
+         * working conversion and silently no-ops.
+         */
+        const win = beginSearchWindow({ page, pageSize }, plan);
         const model = {
             filters: sieveAnd(...clauses.slice(1)),
             sorts: "-createdAt",
-            page,
-            pageSize,
+            ...win.model,
         };
-        return this.sieveQuery(model, SupportRepository.SIEVE_FIELDS, { defaultPageSize: pageSize, maxPageSize: 50, baseQuery });
+        const result = await this.sieveQuery(model, SupportRepository.SIEVE_FIELDS, { defaultPageSize: pageSize, maxPageSize: win.maxPageSize(50), baseQuery });
+        return win.finish(result);
     }
     async getTicketById(ticketId) {
         return this.findById(ticketId);
@@ -158,6 +206,8 @@ export class SupportRepository extends BaseRepository {
      */
     async updateTicketStatus(ticketId, update, ctx, prior) {
         const current = prior !== undefined ? prior : await this.getTicketById(ticketId);
+        // Plain in, ciphertext out: `this.update` runs the write hook over
+        // `piiFields`, which is what encrypts `assignedToName` on the way down.
         const patch = {
             ...update,
             ...this.resolutionStamps(current, update.status),
@@ -177,6 +227,12 @@ export class SupportRepository extends BaseRepository {
      * Never fabricated for a ticket resolved before this existed — that one
      * renders an em-dash, the same rule the offer timeline follows.
      */
+    /*
+     * Returns the PLAIN shape. It only ever emits two Date fields, neither of
+     * them PII — but it is SPREAD into a plaintext patch, and a return typed
+     * against the document would poison that patch's inferred type with
+     * `Encrypted<string>` members it never actually sets.
+     */
     resolutionStamps(current, next) {
         if (!next || next === current?.status)
             return {};
@@ -188,6 +244,14 @@ export class SupportRepository extends BaseRepository {
         return {};
     }
     /** Append a timeline entry when the patch touches a tracked field. */
+    /*
+     * Takes and returns the PLAIN shape.
+     *
+     * It only threads a patch through `withHistory` and casts both sides to
+     * `FirestoreDocument` anyway, so it is indifferent to whether the PII in it
+     * is ciphertext — and its callers hold plaintext, because encryption happens
+     * in `this.update`'s write hook downstream.
+     */
     withTicketHistory(current, patch, ctx, defaultTrigger) {
         const withEntry = withHistory(current, patch, {
             tracked: SUPPORT_TICKET_TRACKED_FIELDS,
@@ -233,9 +297,25 @@ export class SupportRepository extends BaseRepository {
             throw new DatabaseError("Failed to add message to ticket", err);
         }
     }
-    async assignTicket(ticketId, assignedTo, assignedToName, ctx, prior) {
+    async assignTicket(ticketId, assignedTo, 
+    /*
+     * PLAINTEXT. `BaseRepository.update` runs `encryptPiiFields` over
+     * `piiFields`, which includes `assignedToName`, so the value is encrypted
+     * on the way down — the parameter is honest about what the caller holds.
+     * `asEncrypted` here would be the misuse its own docstring forbids:
+     * labelling plaintext as ciphertext.
+     */
+    assignedToName, ctx, prior) {
         const current = prior !== undefined ? prior : await this.getTicketById(ticketId);
-        return this.update(ticketId, this.withTicketHistory(current, { assignedTo, assignedToName, updatedAt: new Date() }, ctx, "assignTicket"));
+        return this.update(ticketId, this.withTicketHistory(current, {
+            assignedTo,
+            // No cast: `withTicketHistory` takes the PLAIN shape, and this
+            // parameter is plaintext (the write hook encrypts downstream). The
+            // cast that used to sit here existed only because the payload type
+            // claimed ciphertext.
+            assignedToName,
+            updatedAt: new Date(),
+        }, ctx, "assignTicket"));
     }
     async listAll(model) {
         return this.sieveQuery(model, SupportRepository.SIEVE_FIELDS, { defaultPageSize: 25, maxPageSize: 100 });

package/dist/features/support/schemas/firestore.d.ts

@@ -16,6 +16,7 @@
  */
 import type { BaseDocument } from "../../../_internal/shared/types/base-document";
 import type { StatusChangeEntry } from "../../../_internal/shared/history/types";
+import type { Encrypted, Plaintext } from "../../../security/encrypted";
 export declare const TicketCategoryValues: {
     readonly ORDER_ISSUE: "order_issue";
     readonly BILLING_PAYMENT: "billing_payment";
@@ -72,12 +73,22 @@ export interface TicketRelatedParties {
     productId?: string;
     bidId?: string;
 }
+/**
+ * `SupportTicketDocument` with its PII as plain `string` — what the named repository
+ * accessors return, and what a WRITE path accepts (the repository encrypts).
+ *
+ * `Plaintext<T>` is the one definition of this shape; see `security/encrypted.ts`.
+ * It is deliberately NOT distinguishable from a MASKED value — `maskPii`
+ * returns plain strings too, and no type can express "these characters are
+ * asterisks". The distinction is which named method you called.
+ */
+export type SupportTicketPlain = Plaintext<SupportTicketDocument>;
 export interface SupportTicketDocument extends BaseDocument {
     userId: string;
     /** Denormalized — for admin table display. */
-    userEmail: string;
+    userEmail: Encrypted<string>;
     /** Denormalized — for admin table display. */
-    userDisplayName: string;
+    userDisplayName: Encrypted<string>;
     category: TicketCategory;
     subject: string;
     /** Initial description written by the user when opening the ticket. */
@@ -109,7 +120,7 @@ export interface SupportTicketDocument extends BaseDocument {
     /** UID of the assigned employee. */
     assignedTo?: string;
     /** Denormalized display name of the assignee. */
-    assignedToName?: string;
+    assignedToName?: Encrypted<string>;
     /**
      * Internal-only notes visible only to admins/employees, never shown to the ticket author.
      * Append-only — never overwrite, always append with timestamp.
@@ -166,8 +177,8 @@ export declare const SUPPORT_TICKET_TRACKED_FIELDS: readonly ["status", "priorit
  * (`assignedTo`) and never the name.
  */
 export declare const SUPPORT_TICKET_PII_FIELDS: readonly ["userEmail", "userDisplayName", "assignedToName"];
-export type SupportTicketCreateInput = Pick<SupportTicketDocument, "userId" | "userEmail" | "userDisplayName" | "category" | "subject" | "description" | "orderId" | "storeId">;
-export type SupportTicketUpdateInput = Partial<Pick<SupportTicketDocument, "status" | "priority" | "assignedTo" | "assignedToName" | "internalNotes" | "relatedParties">>;
+export type SupportTicketCreateInput = Pick<SupportTicketPlain, "userId" | "userEmail" | "userDisplayName" | "category" | "subject" | "description" | "orderId" | "storeId">;
+export type SupportTicketUpdateInput = Partial<Pick<SupportTicketPlain, "status" | "priority" | "assignedTo" | "assignedToName" | "internalNotes" | "relatedParties">>;
 export declare const SUPPORT_TICKET_COLLECTION: "supportTickets";
 export declare const SUPPORT_TICKET_ID_PREFIX: "ticket-";
 export declare const SUPPORT_TICKET_INDEXED_FIELDS: readonly ["userId", "storeId", "searchTxt", "status", "category", "priority", "assignedTo", "orderId", "createdAt", "updatedAt"];

package/dist/features/tester/seed-data/authored/admin__events-raffles-spin.js

@@ -77,17 +77,32 @@ export const authored = {
         startPage: "/admin/events",
         steps: [
             "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open 'QA Event raffle-open' in the admin and read the entry list.",
-            "Trigger the raffle draw and read the winner named.",
+            "Open 'QA Event raffle-open' in the admin editor and read the entry list and the 'Pool size' readout in the raffle panel.",
+            "Press 'Trigger Raffle Now'. A CONFIRMATION DIALOG must appear first — read it, then confirm.",
+            "Read the winner named and the pool size reported.",
             "RELOAD and read the winner again.",
             "Read whether the winner's name and entry are both recorded on the event.",
-            "Sign in as the winning buyer and check they were notified.",
-            "Sign back in as admin and attempt to draw a second time, reading what happens.",
+            "Sign in as the winning buyer and open the notification bell; read the notification and follow its link.",
+            "Sign back in as admin, reopen the event, and read the button's label and enabled state. Then attempt a second draw.",
         ],
-        expectedBehaviour: "The draw picks once with real randomness, records the winner on the event, and notifies them. A second draw must be refused — redrawing replaces a winner who has already been told they won, and the notification cannot be recalled.",
-        expectedUiState: "The winner is named and survives the reload. The event records both the winner and their entry. The buyer has a notification. The second draw attempt is refused rather than producing a new winner.",
-        expectedData: { drawsPermitted: 1 },
-        endResult: "Delete the event afterwards. A second draw succeeding is the most serious failure on this page.",
+        expectedBehaviour: "The draw picks once with real randomness, records the winner on the event, and notifies them. A second draw must be refused — redrawing replaces a winner who has already been told they won, and the notification cannot be recalled. A pool size of 0 on an event that visibly has entries is itself the failure: it means the eligibility query and the entry writer disagree about which field marks an entry eligible.",
+        expectedUiState: "A confirmation dialog gates the draw. The winner is named and survives the reload. The event records both the winner and their entry. The buyer has one notification that deep-links to the event's winner page. On reopening, the button reads 'Already triggered' and is disabled; forcing a second draw is refused naming the existing winner, never with a generic failure.",
+        /*
+         * `drawsPermitted: 1` was already here and had never been exercised. The
+         * other three are the preconditions that made it unexercisable:
+         *   poolSizeNotZero       — the draw queried `status == "CONFIRMED"`, which
+         *                           nothing writes at entry time, so EVERY draw
+         *                           returned "no eligible entries"
+         *   winnerNotifications   — the winner was recorded and never told
+         *   confirmationDialogs   — an irreversible action with no confirmation
+         */
+        expectedData: {
+            drawsPermitted: 1,
+            poolSizeNotZero: true,
+            winnerNotifications: 1,
+            confirmationDialogs: 1,
+        },
+        endResult: "BEFORE: there was no confirmation dialog, the draw answered 'no eligible entries' on an event with entries (so no winner could ever be drawn), and on the rare path it did write a winner that person was never notified. AFTER: the dialog gates it, one winner is drawn and notified, and the second attempt is refused naming the existing winner. Delete the event afterwards. A second draw succeeding is the most serious failure on this page.",
     },
     "checklist-admin-events-raffles-spin-spin-wheel-create": {
         roles: ["admin", "buyer"],
@@ -98,13 +113,25 @@ export const authored = {
             "Define three prizes with labels and weights, set a maximum of 2 spins per user, and set a spin window covering today.",
             "Save, RELOAD, and read every prize, weight, the maximum and the window.",
             "Open the event's public page at /events/{its id} and read the wheel and its segments.",
-            "Check the wheel shows the prize labels and does NOT disclose their weights.",
+            "View SOURCE (or the network payload) for /events/{its id}/participate and search the response text for the string 'weight'. Then search it for 'couponId'.",
         ],
         inputs: { title: "QA Event spin-create", prizeCount: 3, maxPerUser: 2 },
         expectedBehaviour: "Prizes, weights, the per-user maximum and the window all round-trip. Weights are the odds and belong server-side — a public wheel that renders them tells every visitor which segment is worthless.",
-        expectedUiState: "After the reload all four groups of settings hold. The public wheel shows three labelled segments and no weight values anywhere on the page or in its source.",
-        expectedData: { weightsInPublicSource: 0 },
-        endResult: "Leave the event in place — the limits case reads it.",
+        expectedUiState: "After the reload all four groups of settings hold. The public wheel shows three labelled segments.",
+        /*
+         * 🛑 The last step searches the PAYLOAD, not the rendered wheel, and that
+         * is the whole case.
+         *
+         * It previously read "check the wheel does NOT disclose their weights" —
+         * and the rendered wheel has never shown a weight, so a tester looked at
+         * three labelled segments and passed. Meanwhile the participate page cast
+         * the stored prize array straight into a client prop, so every weight AND
+         * every internal coupon document id was sitting in the RSC payload of a
+         * public page. The case asserted `weightsInPublicSource: 0` and could not
+         * see the thing it was counting.
+         */
+        expectedData: { weightsInPublicSource: 0, couponIdsInPublicSource: 0 },
+        endResult: "BEFORE: the payload contained 'weight: 15', 'weight: 25', 'weight: 10' and a 'couponId' for any prize carrying a coupon. AFTER: neither string appears anywhere in it, while the three labels still render. Leave the event in place — the limits case reads it.",
     },
     "checklist-admin-events-raffles-spin-spin-wheel-limits-enforced": {
         roles: ["admin", "buyer"],
@@ -113,16 +140,31 @@ export const authored = {
             "Sign in as rehan.sheikh@gmail.com / TempPass123! and open 'QA Event spin-create'.",
             "Spin once and read the prize and the remaining count.",
             "Spin a second time and read the remaining count.",
-            "Attempt a third spin and read the refusal.",
-            "RELOAD the page and attempt another spin.",
+            "Attempt a third spin and read the refusal WORD FOR WORD.",
+            "RELOAD the page and read the Spin button's state before clicking anything.",
+            "An event is reachable by two URL spellings — its SLUG and its DOCUMENT ID. Note which one you have been using, then open the OTHER one as the same account and attempt a spin.",
             "Sign out and sign in as admin@letitrip.in / TempPass123!, then narrow the spin window so it is closed.",
-            "Sign back in as the buyer and attempt a spin, reading the refusal.",
+            "Sign back in as the buyer and attempt a spin, reading that refusal word for word too.",
         ],
         inputs: { maxPerUser: 2 },
-        expectedBehaviour: "The per-user cap and the window are both enforced server-side. A cap held in the browser resets on refresh and is no cap at all, and the two refusals must read differently — 'no spins left' and 'the window is closed' are different facts and a single generic message tells the buyer neither.",
-        expectedUiState: "The remaining count falls with each spin and the third is refused naming the limit. After the reload it is still refused. With the window closed the refusal names the window instead. A fresh spin available after a reload is the failure.",
-        expectedData: { spinsAfterReload: 0 },
-        endResult: "Delete the event afterwards.",
+        expectedBehaviour: "The per-user cap and the window are both enforced server-side, the cap is scoped to the PERSON rather than to the URL spelling, and the two refusals read differently — 'no spins left' and 'the window is closed' are different facts and a single generic message tells the buyer neither.",
+        expectedUiState: "The third attempt is refused naming the limit. After the reload the button is already disabled with the spent state shown, without a round trip. The other URL spelling is refused identically. With the window closed the refusal names the window instead.",
+        /*
+         * Three invariants, each of which was broken in a different way:
+         *   spinsAfterReload       — the cap itself
+         *   spinsViaOtherUrlForm   — the guest/identity hash was scoped to the
+         *                            SLUG while enterEvent scoped it to the doc id,
+         *                            so the two URL spellings were two identities
+         *                            and the other one handed out a fresh allowance
+         *   distinctRefusalMessages — both refusals were the same sentence
+         */
+        expectedData: {
+            maxPerUser: 2,
+            spinsAfterReload: 0,
+            spinsViaOtherUrlForm: 0,
+            distinctRefusalMessages: 2,
+        },
+        endResult: "BEFORE: every refusal on this page read 'Spin failed. Please try again.', the button stayed enabled after a reload so the cap cost a round trip to discover, and the other URL spelling granted a fresh set of spins. AFTER: 'You've already used your spins for this event.' and 'The spin window isn't open right now.' are distinct, the button is pre-disabled, and both URL spellings share one allowance. Delete the event afterwards.",
     },
     "checklist-admin-events-raffles-spin-event-entries-admin-view": {
         roles: ["admin"],

package/dist/features/tester/seed-data/authored/buying__browsing-search.js

@@ -284,12 +284,28 @@ export const authored = {
         steps: [
             "Open /.",
             "Scroll down looking for a 'Raffles' or 'Spin Wheels' strip.",
+            "Read the TYPE of EVERY card in that strip — open each one if the card does not say. Write down any card that is not a raffle or a spin wheel.",
             "Open /events in a new tab.",
             "Note which events have a raffle or spin-wheel type and are currently active.",
         ],
-        expectedBehaviour: "If any raffle or spin-wheel event is active on /events, the homepage shows a 'Raffles & Spin Wheels' strip containing those events. The strip is absent only when genuinely no raffle event is active.",
-        expectedUiState: "The homepage shows a 'Raffles & Spin Wheels' heading with at least one event card beneath it (e.g. 'Daily Beyblade Pull! Spin for a Prize'). The same event must also appear on /events.",
-        endResult: "Nothing is persisted.",
+        expectedBehaviour: "If any raffle or spin-wheel event is active on /events, the homepage shows a 'Raffles & Spin Wheels' strip containing those events AND NOTHING ELSE. The strip is absent only when genuinely no raffle or spin-wheel event is active.",
+        expectedUiState: "The homepage shows a 'Raffles & Spin Wheels' heading with at least one event card beneath it (e.g. 'Daily Beyblade Pull! Spin for a Prize'). Every card in the strip is a raffle or a spin wheel. The same events must also appear on /events.",
+        /*
+         * 🛑 Step 3 — reading each card's TYPE — is the case.
+         *
+         * The strip filtered on `hasRaffle`, which was not in the events repository's
+         * SIEVE_FIELDS. The Sieve adapter runs with `throwExceptions: false`, so an
+         * unallowlisted field does not raise: the clause was SILENTLY DISCARDED and
+         * the query degraded to `status == active` sorted by start date. The strip
+         * rendered the six most recently-started active events of any type — sales,
+         * polls, feedback forms — under a heading promising raffles.
+         *
+         * Every card was a real, live, correctly-rendered event, which is exactly
+         * why this read as working. Only the heading was false, and the old case
+         * asked for "at least one event card", which that satisfied.
+         */
+        expectedData: { nonPrizeEventsInStrip: 0 },
+        endResult: "BEFORE: the strip listed active events of ANY type — a clearance sale and a poll appeared under 'Raffles & Spin Wheels' — because the raffle filter was being dropped before the query ran. AFTER: every card in the strip is a raffle or a spin wheel. Nothing is persisted.",
     },
     "checklist-buying-browsing-search-homepage-prize-draws-section": {
         roles: ["guest"],

package/dist/features/tester/seed-data/authored/buying__spares-and-groups.d.ts

@@ -0,0 +1,2 @@
+import type { AuthoredCase } from "./_types";
+export declare const authored: Record<string, AuthoredCase>;