@mohasinac/appkit 4.58.0 → 4.59.0

package/dist/features/tester/seed-data/authored/content-discovery__site-wide-index.js

@@ -1,340 +0,0 @@
-/*
- * WHY: Authored six-part procedures for the site-wide search index cases
- *      added 2026-10-19 to the content-discovery/search page.
- * WHAT: 17 case(s), keyed by full checklist id.
- *
- * 🛑 EVERY CASE CARRIES A CONTROL. A search box that has stopped filtering
- * returns plausible rows for any real term and looks identical to one that
- * works — "zzzznope" returning zero is the only kind of assertion here that
- * cannot pass by accident. That is this directory's standing rule and it is
- * why the control is a STEP, not a footnote.
- *
- * 🛑 Several of these check the NETWORK PANEL rather than the page, and that
- * is deliberate. "Zero Firestore reads per keystroke" and "a guest issues no
- * authenticated request" are the two claims the whole design rests on, and
- * neither is visible on screen — a page that fetches per keystroke looks
- * exactly like one that does not.
- *
- * @tag domain:tester
- * @tag layer:seed
- * @tag pattern:none
- * @tag access:server-only
- * @tag consumers:seed-data/authored/index.ts
- * @tag sideEffects:none
- */
-export const authored = {
-    "checklist-content-discovery-search-search-finds-every-type": {
-        roles: ["guest"],
-        startPage: "/",
-        steps: [
-            "Open / in a private window with no session.",
-            "Click the header search and type dranzer.",
-            "Press Enter.",
-            "Read the URL in the address bar.",
-            "Count how many distinct section headings the results page shows.",
-            "Go back, type zzzznope, and press Enter.",
-            "Read what the page says.",
-        ],
-        inputs: { query: "dranzer", control: "zzzznope" },
-        expectedBehaviour: "Submitting navigates to the cross-resource results page and searches every indexed type at once, rather than redirecting to one browse route chosen by the type dropdown.",
-        expectedUiState: "The URL is /search?q=dranzer, not /products?q=dranzer. Results appear under several headings (for example Products, Categories, Parts, Articles), each with its own 'See all … →' link. For zzzznope the page says nothing matched and shows ZERO result rows — that control is the only assertion here that cannot pass by accident.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-finds-a-part": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=Rubber Flat in a private window.",
-            "Read every result row and note which section each sits under.",
-            "Change the query to RF and search again.",
-            "Compare the two result sets.",
-            "Click the part row and read the page it lands on.",
-        ],
-        inputs: { byName: "Rubber Flat", byCode: "RF" },
-        expectedBehaviour: "Parts are searchable by full name and by code. Before this they had no search tokens at all — all 752 were reachable only by drilling /parts into a classification and then a code.",
-        expectedUiState: "Both queries return the part under a Parts heading, and the row shows its classification on a second line underneath the name. Clicking it lands on a real /parts/<classification>/<code> page, not a 404.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-ambiguous-part-code": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=105 in a private window.",
-            "Count the rows under the Parts heading.",
-            "Read the second line of each row and write down the classification it names.",
-            "Click two different rows in turn and write down the URL each lands on.",
-        ],
-        inputs: { query: "105" },
-        expectedBehaviour: "A bare code is ambiguous across generations — 105 is a Metal Fight spin-track height while a bare number in Burst is a disc — so the engine must return all of them rather than picking one.",
-        expectedUiState: "SEVERAL rows, each naming a DIFFERENT classification, each linking to a different /parts/<classification>/105 URL. Exactly one row is the FAILURE: it means something chose a winner for the user.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-midword": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=ariza in a private window.",
-            "Read the result rows.",
-            "Change the query to zzzz and search again.",
-            "Read what the page says.",
-        ],
-        inputs: { midword: "ariza", control: "zzzz" },
-        expectedBehaviour: "The browser scans the whole index, so a fragment from the MIDDLE of a word matches. The Firestore path structurally cannot do this — its tokens are word-prefix only.",
-        expectedUiState: "'ariza' returns Charizard rows. 'zzzz' returns nothing — without that control a matcher returning everything for any fragment would also pass the first half.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-typo": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=dragon g in a private window.",
-            "Read the result rows.",
-            "Search again for Pegasis (note the spelling: 'sis', not 'sus').",
-            "Read the result rows.",
-        ],
-        inputs: { typo1: "dragon g", typo2: "Pegasis" },
-        expectedBehaviour: "Misspellings are expanded at INDEX time from a crawl of a counterfeit seller's real titles, on the measured insight that an evasion spelling is the same string a genuine buyer mistypes.",
-        expectedUiState: "'dragon g' returns Dragoon G. 'Pegasis' returns Storm Pegasus. Neither returns an empty state.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-normalised-away": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=!!! in a private window.",
-            "Read the message on the page word for word.",
-            "Count the result rows.",
-            "Now search zzzznope and read that message too.",
-            "Compare the two messages.",
-        ],
-        inputs: { punctuation: "!!!", nonsense: "zzzznope" },
-        expectedBehaviour: "A query that normalises to no searchable words must return NOTHING, never everything. The inverse of this bug shipped on /api/products once: a punctuation-only query produced no filter clause and returned the entire published catalogue as search results.",
-        expectedUiState: "'!!!' says the search had no searchable words in it. 'zzzznope' says nothing matched. The two messages are DIFFERENT — one means we could not form a query, the other means we ran one and found none. Any rows at all for '!!!' is the failure.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-zero-reads": {
-        roles: ["guest"],
-        startPage: "/",
-        steps: [
-            "Open / in a private window and open DevTools → Network.",
-            "Clear the network log.",
-            "Click into the header search and type d.",
-            "Wait for suggestions to appear, then type r, a, n, z, e, r one character at a time.",
-            "Read the network log and count the requests made after the first one.",
-        ],
-        inputs: { query: "dranzer" },
-        expectedBehaviour: "The index is fetched ONCE per page session and searched locally thereafter. Before this, every keystroke was a request to /api/search/suggestions, which was four parallel Firestore reads.",
-        expectedUiState: "The log shows ONE large .json fetch from firebasestorage (a few hundred KB) on the first focus or keystroke, and NOTHING further as you keep typing. A request per character is the failure even though the suggestions look identical either way.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-no-prices": {
-        roles: ["guest"],
-        startPage: "/",
-        steps: [
-            "Open / in a private window with no session.",
-            "Click the header search and type dranzer.",
-            "Read every suggestion row, including the small second line.",
-            "Press Enter and read every row on the results page.",
-            "Search the rendered page for the ₹ character.",
-        ],
-        inputs: { query: "dranzer" },
-        expectedBehaviour: "Prices are hidden from signed-out visitors so the catalogue cannot be read at scale without an account. The suggestion subtitle used to be the product's price, served from a route cached PUBLIC for 60 seconds — a live leak on every page of the site.",
-        expectedUiState: "Suggestion subtitles show the brand and category, e.g. 'Takara-Tomy · Attack Rings'. No ₹ appears anywhere in the dropdown or in the results, signed out.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-no-sandbox": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=sandbox in a private window with no session.",
-            "Read every result row.",
-            "Search again for tester and read every row.",
-            "Note any row whose title or detail names a tester or sandbox fixture.",
-        ],
-        inputs: { query1: "sandbox", query2: "tester" },
-        expectedBehaviour: "The index is ONE shared file every browser downloads, with no per-viewer filter anywhere after it is built — so a test-data row in it is published to the world for that version's whole lifetime, and an immutable object cannot be recalled.",
-        expectedUiState: "No row seeded as test data appears. Finding even one is a disclosure, not a cosmetic issue.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-freshness": {
-        roles: ["seller"],
-        startPage: "/store/products/new",
-        steps: [
-            "Create and PUBLISH a listing with a distinctive title, e.g. Freshness Probe Dranzer.",
-            "Write down the time.",
-            "Open /search in a private window and search that exact title.",
-            "If it is absent, wait and retry every few minutes for up to 20 minutes.",
-            "Once it appears, go back and UNPUBLISH the listing.",
-            "Search the same title again, retrying for up to 20 minutes.",
-        ],
-        inputs: { title: "Freshness Probe Dranzer" },
-        expectedBehaviour: "A content write marks the index stale and the scheduled job rebuilds within about 15 minutes. An unpublished listing still has a fresh updatedAt, so the incremental pass re-reads it, sees it fail the published filter, and removes it.",
-        expectedUiState: "The listing becomes findable within ~15 minutes of publishing and disappears within ~15 minutes of unpublishing. A row that NEVER appears and a row that never LEAVES are both failures, and both mean the rebuild has stopped — note which one you saw.",
-        endResult: "Delete the probe listing afterwards. Its absence from search within ~15 minutes is itself the final check.",
-    },
-    "checklist-content-discovery-search-search-facet-counts": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=beyblade in a private window.",
-            "Find the facet chips above the results and write down each chip's label and number.",
-            "Count the result rows actually shown for one type and compare it with that chip's number.",
-            "Click one chip.",
-            "Read the result rows again, and read the other chips' numbers again.",
-            "Click the same chip a second time to clear it.",
-        ],
-        inputs: { query: "beyblade" },
-        expectedBehaviour: "Facet counts are computed over the hits the current query produced, in memory. The Firestore path cannot afford this — it is one aggregation query per facet value, each needing its own composite index, and it returns no count at all when an index is missing.",
-        expectedUiState: "Chips show a number each. Clicking one narrows the results AND lowers the other chips' numbers to match. Clicking again restores both. A chip that does not change the results, or a number that disagrees with the rows you can count, is the failure.",
-        endResult: "Read-only; the selection is not persisted and is gone on reload.",
-    },
-    "checklist-content-discovery-search-search-guest-no-private": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open a private window with no session and open DevTools → Network.",
-            "Clear the network log.",
-            "Go to /search?q=order.",
-            "Read every request in the log.",
-            "Look specifically for any request whose path contains /api/search/scoped.",
-            "Read the page for any section headed 'Your …' or 'Admin'.",
-        ],
-        inputs: { query: "order" },
-        expectedBehaviour: "A signed-out visitor must make NO authenticated request at all — not a 401, not an empty 200. The client gate, the route's auth requirement and the empty source list are three independent gates, because the expensive failure is not a guest seeing an error, it is a guest silently receiving someone's data.",
-        expectedUiState: "No /api/search/scoped request appears in the log in any form. No account or admin section renders on the page. A 401 in the log is still a FAIL — it means the request was issued.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-buyer-isolation": {
-        roles: ["buyer"],
-        startPage: "/search",
-        steps: [
-            "Sign in as one buyer.",
-            "From an admin session in another browser, find a DIFFERENT buyer's order and note a distinctive word from its product title.",
-            "Back in the first buyer's session, search that word on /search.",
-            "Read every row, including any under 'Your orders'.",
-            "Now open /api/search/scoped?q=<that word> directly in the same signed-in session.",
-            "Read the raw JSON response end to end.",
-        ],
-        expectedBehaviour: "Every scoped source carries an owner clause built from the verified session, so the QUERY itself cannot return another viewer's rows. The API half of this check is the half that matters.",
-        expectedUiState: "Neither the page nor the JSON contains the other buyer's order. A page that hides the row while the endpoint returns it is precisely the failure this case exists for, and only the second half can see it.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-seller-own-store": {
-        roles: ["seller"],
-        startPage: "/store/products/new",
-        steps: [
-            "Signed in as a seller, create a listing with a distinctive title and leave it as a DRAFT.",
-            "Go to /search and search that title.",
-            "Read which section the row appears under.",
-            "Note a draft title belonging to a DIFFERENT store (ask an admin for one).",
-            "Search that second title and read every row.",
-        ],
-        inputs: { ownDraft: "Isolation Probe Draft" },
-        expectedBehaviour: "A seller's own drafts are returned by the scoped tier. Published listings are deduped away because the public index already has them, so what survives in that section is exactly the drafts — which is why it is labelled as such.",
-        expectedUiState: "Your own draft appears under 'Your listings (incl. drafts)'. The other store's draft returns nothing at all.",
-        endResult: "Delete the probe draft afterwards.",
-    },
-    "checklist-content-discovery-search-search-listing-boxes-still-filter": {
-        roles: ["guest", "seller", "admin"],
-        startPage: "/stores",
-        steps: [
-            "Open /stores and type a real store name into the page's own search box.",
-            "Confirm the list narrows, then type zzzznope and confirm it empties.",
-            "Sign in as a seller, open /store/orders, and repeat both searches there.",
-            "Check the pager still works and the filter-drawer badge still shows the right count.",
-            "Sign in as an admin, open /admin/users, and repeat both searches there.",
-        ],
-        inputs: { control: "zzzznope" },
-        expectedBehaviour: "The per-collection boxes are a DIFFERENT system from site-wide search — they filter one table, carry URL state and feed real pagination — and nothing in the index work touches them. This case exists because that is a promise, and a promise with no check is a hope.",
-        expectedUiState: "All three boxes narrow on a real term and return zero on the control. Pagination still pages, and the filter-drawer badge still counts only drawer filters.",
-        endResult: "Read-only; the URL carries the query but nothing persists server-side.",
-    },
-    "checklist-content-discovery-search-search-support-ticket-two-words": {
-        roles: ["admin"],
-        startPage: "/admin/support-tickets",
-        steps: [
-            "Open /admin/support-tickets and read several ticket subjects.",
-            "Pick TWO words that appear together in exactly one subject, where the longer word also appears in others.",
-            "Type just the longer word into the search box and count the rows.",
-            "Now type both words and count the rows again.",
-            "Compare the two counts.",
-        ],
-        expectedBehaviour: "Both words must narrow the result. Before this the second word was discarded entirely — only the longest term reached the query — so a two-word search returned everything matching the longer word while looking like it was working.",
-        expectedUiState: "The two-word search returns FEWER rows than the one-word search, and every row it returns contains both words. Identical counts mean the second word is still being thrown away.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-parts-page-has-a-box": {
-        roles: ["guest"],
-        startPage: "/parts",
-        steps: [
-            "Open /parts in a private window.",
-            "Look above the grid of classifications for a search input.",
-            "Type RF and read the rows that appear.",
-            "Read the second line of each row.",
-            "Clear it and type zzzznope.",
-            "Scroll down and confirm the classification grid is still present.",
-        ],
-        inputs: { query: "RF", control: "zzzznope" },
-        expectedBehaviour: "Before this the page was browse-only: 752 parts reachable only by clicking a classification and then a code, with no search input anywhere on the surface.",
-        expectedUiState: "A search box sits above the grid. 'RF' returns the part with its classification on a second line; 'zzzznope' says no part matches. The classification grid is still there underneath — the box adds a way in, it does not replace browsing.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-facet-carries-through": {
-        roles: ["guest"],
-        startPage: "/search",
-        steps: [
-            "Open /search?q=beyblade in a private window.",
-            "Tick one facet chip, e.g. a brand.",
-            "Find that group's own 'See all →' link and read its href before clicking.",
-            "Click it.",
-            "Read the URL you land on and whether the listing page shows the same filter applied.",
-        ],
-        inputs: { query: "beyblade" },
-        expectedBehaviour: "The refinement a visitor builds on /search must survive the jump to the real browse page — losing it means re-doing work they already did.",
-        expectedUiState: "The destination URL carries the same filter (e.g. a brand query parameter), and the browse page opens already narrowed to it, not showing the unfiltered full list.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-admin-person-exact": {
-        roles: ["admin"],
-        startPage: "/admin/users",
-        steps: [
-            "Sign in as admin and open /admin/users.",
-            "Pick a real user and note their first name only.",
-            "Type just that first name into the search box.",
-            "Read the results.",
-            "Clear the box and type only the first 3-4 letters of that same first name — a prefix, not the whole word.",
-            "Read the results again.",
-        ],
-        expectedBehaviour: "The admin search resolves through a whole-WORD index, not a whole-STRING exact match. Typing a first name alone must find a user whose displayName is 'First Last' — before this it required the exact full string. A PREFIX of the word must find nobody: the index is whole-word only on purpose, so it cannot be unpicked by counting partial-match frequencies.",
-        expectedUiState: "The full first name returns the user. The 3-4 letter prefix returns an empty list — not the same user, not anybody else.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-search-no-plaintext-pii": {
-        roles: ["admin"],
-        startPage: "/admin/users",
-        steps: [
-            "With Firestore console access, open any `users` document.",
-            "Find the `nameTokensIndex` field and read its values.",
-            "Confirm every entry is an opaque hex string with an `hmac:` prefix, never a readable name fragment.",
-            "Separately, fetch the public search artifact's .json file (the one the header search downloads) and search its raw text for the word 'TokensIndex'.",
-        ],
-        needsReview: true,
-        reviewNote: "Needs Firestore console access, which an automated browser session does not have — flagged for a human or an admin-tooling pass rather than answered null.",
-        expectedBehaviour: "A blind index lets admin search without ever decrypting anyone's name. If the stored values are readable, or if the field reaches the public artifact (a deterministic per-person identifier published to every browser, cross-referenceable even unbroken), the whole design has failed regardless of what the UI shows.",
-        expectedUiState: "Every `nameTokensIndex` entry is an `hmac:`-prefixed digest. The public artifact's raw text contains no occurrence of 'TokensIndex' at all.",
-        endResult: "Read-only; nothing persists.",
-    },
-    "checklist-content-discovery-search-faq-punctuation-search": {
-        roles: ["guest"],
-        startPage: "/faqs",
-        steps: [
-            "Open /faqs in a private window.",
-            "Type !!! into the FAQ search box.",
-            "Read the message shown and count the FAQs displayed.",
-        ],
-        inputs: { punctuation: "!!!" },
-        expectedBehaviour: "GUARD CASE — pins behaviour that is already correct. A punctuation-only query has no searchable words, and must say so rather than silently falling through to 'no filter', which would return the entire FAQ catalogue disguised as search results.",
-        expectedUiState: "The page says the search had no searchable words. Zero FAQs are shown — not the full list.",
-        endResult: "Read-only; nothing persists.",
-    },
-};

package/dist/features/tester/seed-data/authored/content-discovery__store-reviews-aggregate.d.ts

@@ -1,2 +0,0 @@
-import type { AuthoredCase } from "./_types";
-export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/content-discovery__store-reviews-aggregate.js

@@ -1,88 +0,0 @@
-/*
- * WHY: Authored six-part procedures for content-discovery/store-reviews-aggregate.
- * WHAT: 4 cases, keyed by full checklist id.
- *
- * 🛑 THIS TAB ANSWERED 200 WITH ZERO REVIEWS FOR EVERY STORE, for as long as it
- * had existed, while 79 approved reviews sat in Firestore (Root Cause #100). It
- * selected "the store's top 20 products by `itemsSold`" and fanned out a review
- * query per product — and **no product carries `itemsSold`**, so Firestore's
- * `orderBy` excluded all 95 of them and the endpoint returned nothing.
- *
- * The only symptom was "this store has no reviews yet", which reads as a fact
- * about the store. That is why the first case names a store KNOWN to have
- * reviews rather than asking whether the tab renders.
- *
- * Fixing it then exposed the next layer: the route returned the raw document,
- * including the reviewer's name as `enc:v1:…` ciphertext and the HMAC blind
- * index beside it. Hence the privacy case.
- *
- * @tag domain:tester
- * @tag layer:seed
- * @tag pattern:none
- * @tag access:server-only
- * @tag consumers:seed-data/authored/index.ts
- * @tag sideEffects:none
- */
-export const authored = {
-    "checklist-content-discovery-store-reviews-aggregate-reviews-tab-not-empty": {
-        roles: ["guest"],
-        startPage: "/stores/store-beyblade-arena",
-        steps: [
-            "Open /stores/store-beyblade-arena — this store is known to have many approved reviews, which is the point of naming it.",
-            "Open its Reviews tab.",
-            "Wait for the content to finish loading before judging it.",
-            "Read how many reviews are reported and count the cards on the first page.",
-        ],
-        expectedBehaviour: "Reviews are fetched by the store they belong to. Routing the lookup through a sample of the store's products makes the result depend on a field those products may not have — and an ordering field that is absent silently excludes every document, returning an empty list rather than an error.",
-        expectedUiState: "Review cards are listed and a total is shown. NOT 'No reviews yet' and not an empty tab.",
-        expectedData: { totalReviewsAtLeast: 1 },
-        endResult: "Nothing is changed; this case only reads.",
-    },
-    "checklist-content-discovery-store-reviews-aggregate-average-matches-the-rows": {
-        roles: ["guest"],
-        startPage: "/stores/store-beyblade-arena",
-        steps: [
-            "Open the store's Reviews tab and write down the average rating and the total.",
-            "Read the star-distribution breakdown and write down the count beside each star level.",
-            "Add the five distribution counts together.",
-            "Compare that sum with the total.",
-            "Filter to 5-star reviews and compare the number of cards with the 5-star count from the breakdown.",
-        ],
-        expectedBehaviour: "The aggregate covers the whole store, not a sample of it. Computing it from an arbitrary subset of products leaves the average and the distribution quietly wrong — and those two numbers are what a buyer judges a seller on.",
-        expectedUiState: "The distribution counts sum to the total, and the 5-star filter returns as many reviews as the breakdown claims.",
-        expectedData: { distributionSumsToTotal: true },
-        endResult: "Clearing the filter restores the full list.",
-    },
-    "checklist-content-discovery-store-reviews-aggregate-reviewer-name-is-masked": {
-        roles: ["guest"],
-        startPage: "/stores/store-beyblade-arena",
-        steps: [
-            "Open the store's Reviews tab.",
-            "Read the reviewer name shown on the first three cards.",
-            "Open the browser network panel and reload.",
-            "Find the request that fetched the reviews and read its response body.",
-            "Search that body for the text enc:v1 and for the field names userNameIndex, searchTxt and userId.",
-        ],
-        expectedBehaviour: "A reviewer's name is PII, stored encrypted, and shown masked in public. The generic repository returns the document verbatim, so a route that does not go through the reviews repository serves ciphertext — and a payload built by spreading the document also carries the HMAC blind index, which lets a caller confirm a guessed name.",
-        expectedUiState: "Names render masked. maskName masks EVERY whitespace-separated word, and every seeded persona is literally 'Mock User N' — so the exact rendering is 'M*** U*** 3***', including the number. A two-word 'M*** U***' would mean the trailing word was dropped. No card shows a value beginning enc:v1.",
-        expectedData: { ciphertextInResponse: false, blindIndexInResponse: false },
-        endResult: "Nothing is changed; this case only reads.",
-    },
-    "checklist-content-discovery-store-reviews-aggregate-review-search-matches-body-text": {
-        roles: ["guest"],
-        startPage: "/stores/store-beyblade-arena",
-        steps: [
-            "Open the store's Reviews tab and read one review card in full.",
-            "Pick a distinctive word that appears in that review's BODY text but not in its title and not in the product name.",
-            "Type that word into the reviews search box.",
-            "Read the results.",
-            "Clear the box and search for zzzznope.",
-            "Read the results again.",
-        ],
-        inputs: { nonsenseQuery: "zzzznope" },
-        expectedBehaviour: "Search covers the review's body. The stored field for that text is `comment`; a filter reading a differently-named field matches nothing in the body and still returns rows via the title and the product name, so it looks like a working search that is merely strict.",
-        expectedUiState: "The body word returns at least the review it came from. 'zzzznope' returns an empty state rather than the unfiltered list.",
-        expectedData: { nonsenseResultCount: 0 },
-        endResult: "Clearing the box restores the full list.",
-    },
-};

package/dist/features/tester/seed-data/authored/cta-layout__checkout-bottom-bar.d.ts

@@ -1,2 +0,0 @@
-import type { AuthoredCase } from "./_types";
-export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/cta-layout__checkout-bottom-bar.js

@@ -1,78 +0,0 @@
-/*
- * WHY: Authored six-part procedures for the cta-layout/checkout-bottom-bar page.
- * WHAT: 2 case(s), keyed by full checklist id.
- *
- * Written by hand, case by case, against the label each one states. There is no
- * generator: the authoring scripts were deleted once it was clear they were
- * scaffolding around work that is simply writing.
- *
- * Both cases are layout checks with an explicit BEFORE in their own description,
- * so the procedure names the pixel symptom rather than asking whether the bar
- * "looks right". 320px is the narrowest viewport worth supporting and is where
- * every squeeze shows up first.
- *
- * 🛑 THE PAYMENT STEP DOES NOT OFFER PhonePe BY DEFAULT (corrected 2026-09-29).
- * CheckoutRouteClient defaults are showCashOption = true, showPhonePe = false,
- * showCod = false, and the payment branch picks the first ENABLED method in
- * that order — so the primary CTA on a default site reads 'Pay via UPI / Cash'.
- * The second case asserted 'Pay Online (PhonePe)' is shown complete, which on a
- * default site means asserting a button that is not there. It now reads whatever
- * CTA the enabled method produces and lists all four labels so the tester can
- * recognise which one they got:
- *
- *   showCashOption  'Pay via UPI / Cash'      (default ON, and the longest)
- *   showPhonePe     'Pay Online (PhonePe)'    (default OFF)
- *   showCod         'Cash on Delivery'        (default OFF)
- *   emiVisible      'Pay in EMI'
- *
- * 🛑 AND THE BUYER HAS NO SAVED ADDRESS. Three addresses are seeded, owned by
- * user-yugi-muto, user-seto-kaiba and user-admin-letitrip. rehan.sheikh has none,
- * so 'select the first saved address' cannot be followed on a fresh project. The
- * addresses collection is PRESERVE tier, so one may exist from an earlier run
- * — the step now covers both, because a case that assumes either is wrong half
- * the time.
- *
- * @tag domain:tester
- * @tag layer:seed
- * @tag pattern:none
- * @tag access:server-only
- * @tag consumers:seed-data/authored/index.ts
- * @tag sideEffects:none
- */
-export const authored = {
-    "checklist-cta-layout-checkout-bottom-bar-back-not-squeezed": {
-        roles: ["buyer"],
-        startPage: "/checkout",
-        steps: [
-            "Resize the browser window to 320 pixels wide.",
-            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
-            "Open /products/product-beyblade-burst-valkyrie and click 'Add to Cart'.",
-            "Open /checkout. Select a saved address if one is offered; if the list is empty, add one, since no address is seeded for this buyer.",
-            "Continue to the Extras step — checkout is Address, then Extras and fees, then Payment.",
-            "Read the two buttons in the bottom action bar and compare their widths.",
-        ],
-        inputs: { viewportWidth: 320 },
-        expectedBehaviour: "Each button is sized by its own label rather than by a fixed share of the row, so the shorter label takes less space and the longer one takes more. A fixed split gives a two-letter button the same width as an eight-word one.",
-        expectedUiState: "'Back' reads in full — not clipped to 'Ba' inside a roughly 44px box. 'Continue to payment' also reads in full and is visibly the wider of the two. Neither shows an ellipsis or a cut-off word.",
-        endResult: "Layout-only; nothing persists. Restore the window width afterwards so later cases are not run at 320px by accident.",
-    },
-    "checklist-cta-layout-checkout-bottom-bar-no-truncation-anywhere": {
-        roles: ["buyer"],
-        startPage: "/checkout",
-        steps: [
-            "Resize the browser window to 320 pixels wide.",
-            "Sign in as rehan.sheikh@gmail.com / TempPass123!.",
-            "Open /products/product-beyblade-burst-valkyrie and click 'Add to Cart'.",
-            "Open /checkout, supply an address if none is saved, and continue through Extras to the Payment step.",
-            "Read the primary button's label in full and write down which of the four it is: 'Pay via UPI / Cash', 'Pay Online (PhonePe)', 'Cash on Delivery' or 'Pay in EMI'.",
-            "Select each payment method the page offers in turn and read the primary label after each.",
-        ],
-        inputs: {
-            viewportWidth: 320,
-            defaultPrimaryCta: "Pay via UPI / Cash",
-        },
-        expectedBehaviour: "A label too long for one line makes its button taller rather than truncating. Height is cheap in a bottom bar; a clipped verb is not, because the buyer cannot tell what the button will do.",
-        expectedUiState: "Whichever CTA the enabled method produces is shown complete, wrapping onto two lines if it needs to. On a default site that is 'Pay via UPI / Cash' — the longest of the four, and therefore the one most likely to clip. An ellipsis anywhere in the bar is a failure, on any method. Do NOT record the absence of 'Pay Online (PhonePe)' as a defect: PhonePe is off by default and a separate admin case covers switching it on.",
-        endResult: "Layout-only; nothing persists. Restore the window width afterwards.",
-    },
-};

package/dist/features/tester/seed-data/authored/cta-layout__dialog-footers.d.ts

@@ -1,2 +0,0 @@
-import type { AuthoredCase } from "./_types";
-export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/cta-layout__dialog-footers.js

@@ -1,76 +0,0 @@
-/*
- * WHY: Authored six-part procedures for the cta-layout/dialog-footers page.
- * WHAT: 2 case(s), keyed by full checklist id.
- *
- * Written by hand, case by case, against the label each one states. There is no
- * generator: the authoring scripts were deleted once it was clear they were
- * scaffolding around work that is simply writing.
- *
- * These two pull in OPPOSITE directions on purpose — a dialog footer stays
- * compact while a mobile bar stretches — and that is exactly why they are one
- * page. A single rule applied to both is what makes one of them wrong.
- *
- * 🛑 /admin/products HAS NO DELETE ROW ACTION (corrected 2026-09-29). Its row
- * menu is Approve, Reject and Quick edit; nothing there opens a destructive
- * dialog, so the first case could not start. It now uses the bundle editor's
- * delete, which is a real ConfirmDeleteModal and names the record in its title.
- *
- * ConfirmDeleteModal's defaults are title 'Delete Item?', confirm 'Delete',
- * cancel 'Cancel'; the bundle editor overrides the title to 'Delete this
- * bundle?'. A dialog still reading the generic default IS the finding — a
- * confirmation that does not say what it will destroy is barely a confirmation.
- *
- * The drawer footer's labels are exact and come from FilterDrawer itself:
- * 'Reset all' (ghost) and 'Apply' (primary), which becomes 'Apply (N)' while
- * changes are pending. A tester seeing the count variant is looking at correct
- * behaviour, not a drifted label.
- *
- * @tag domain:tester
- * @tag layer:seed
- * @tag pattern:none
- * @tag access:server-only
- * @tag consumers:seed-data/authored/index.ts
- * @tag sideEffects:none
- */
-export const authored = {
-    "checklist-cta-layout-dialog-footers-modal-footer-stays-compact-on-desktop": {
-        roles: ["admin"],
-        startPage: "/admin/bundles",
-        steps: [
-            "Resize the browser window to 1280 pixels wide.",
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/bundles and open any bundle for editing.",
-            "Click its delete control to open the confirmation dialog. Do NOT confirm.",
-            "Read the dialog's title: it should name the record, not read 'Delete Item?'.",
-            "Read the two footer buttons, 'Cancel' and 'Delete', and where they sit horizontally.",
-            "Dismiss with Cancel.",
-        ],
-        inputs: {
-            viewportWidth: 1280,
-            dialogTitle: "Delete this bundle?",
-            genericDefault: "Delete Item?",
-        },
-        expectedBehaviour: "A dialog footer packs its buttons to the right at content width. A destructive dialog also has to HAVE a confirmation to open at all — every danger-kind action carries its confirmation copy in the action registry, and one without it executes immediately with no warning.",
-        expectedUiState: "'Cancel' and 'Delete' are each about as wide as their own label and sit together at the right edge of the dialog. They do not stretch edge to edge like banners. The title names the bundle rather than reading the component default 'Delete Item?' — a confirmation that does not say what it will destroy is barely a confirmation.",
-        endResult: "Cancel closes the dialog and nothing is deleted. The bundle is still in /admin/bundles after a reload — dismissing must not be a silent confirm.",
-    },
-    "checklist-cta-layout-dialog-footers-filter-drawer-footer-stacks-when-narrow": {
-        roles: ["guest"],
-        startPage: "/products",
-        steps: [
-            "Resize the browser window to 320 pixels wide.",
-            "Open /products.",
-            "Click 'Filters' to open the drawer.",
-            "Scroll to the drawer's footer.",
-            "Read both buttons and note whether they sit side by side or one per line.",
-        ],
-        inputs: {
-            viewportWidth: 320,
-            resetLabel: "Reset all",
-            applyLabel: "Apply",
-        },
-        expectedBehaviour: "Where a dialog footer stays compact, a drawer footer prefers legibility: if two buttons cannot both read at the available width they stack one per line rather than shrinking below their labels.",
-        expectedUiState: "'Reset all' and 'Apply' are both fully readable. If they cannot fit side by side at 320px they are stacked, one per line. Neither is crushed below its label and neither is truncated. The primary reads 'Apply (N)' once a facet has been changed but not yet applied, which is correct rather than a drifted label.",
-        endResult: "Layout-only; closing the drawer without applying changes nothing. Restore the window width afterwards.",
-    },
-};

package/dist/features/tester/seed-data/authored/cta-layout__editor-action-bar.d.ts

@@ -1,2 +0,0 @@
-import type { AuthoredCase } from "./_types";
-export declare const authored: Record<string, AuthoredCase>;