@mohasinac/appkit 4.58.0 → 4.60.0

package/dist/features/tester/seed-data/authored/admin__content-marketing.js

@@ -1,188 +0,0 @@
-/*
- * WHY: Authored six-part procedures for the admin/content-marketing page.
- * WHAT: 7 case(s), keyed by full checklist id.
- *
- * Written by hand, case by case, against the label each one states. There is no
- * generator: the authoring scripts were deleted once it was clear they were
- * scaffolding around work that is simply writing.
- *
- * 🛑 THE ADS SETTINGS WERE WRITTEN BY THE ADMIN FORM WHILE UNDECLARED ON THE
- * SETTINGS TYPE, which is how a whole group escapes every type-driven review —
- * provider credentials and every draft, paused and scheduled ad went out through
- * an unauthenticated public endpoint, unmasked and invisible to any reader
- * checking the interface. Two cases here read the PUBLIC response rather than the
- * admin form.
- *
- * VERIFIED FIXED 2026-09-29 before asserting it: `adSettings` is now in
- * `PRIVATE_SITE_SETTINGS_FIELDS`, and `/api/ads` serves the public view behind
- * `if (String(item.status || "") !== "active") return false`. So the ads case
- * should PASS; it is kept because the leak was invisible from the admin seat.
- *
- * 🛑 THE NAVIGATION EDITOR REACHES NO PUBLIC SURFACE.
- *
- * `AdminNavigationView` reads and writes `siteSettings.navbarConfig.navItems`
- * through /api/admin/navigation. The public navbar renders `MAIN_NAV_ITEMS`
- * from `src/constants/navigation.tsx` — a static array, filtered only by the
- * listing-type toggles. A repo-wide grep for `navbarConfig` finds the two admin
- * routes, the `/api/admin/site` field list, the seed and the projection, and
- * **no renderer at all**. So it is a complete CRUD surface over data nothing
- * displays, and the projection lists `navbarConfig` as private with the reason
- * "rendered server-side" — which is not true of anything. Recorded in
- * OUTOFSCOPE; the case below now expects the public half to fail.
- *
- * 🛑 THERE IS NO FEATURE-FLAGS SURFACE. The `featureFlags` group was DELETED on
- * 2026-08-29 — "11 of its 14 keys had zero readers, and the survivors were not
- * flags at all". The survivors moved: listing and category types to the
- * `listings` tab (a PRODUCT CONTROL, per that schema comment), and
- * `smsVerification` / `adminCheckoutBypass` to the `payment` group. The last
- * case is rewritten onto the control that actually exists and actually reaches
- * public behaviour.
- *
- * /admin/site has TWENTY tabs, not nineteen: about, branding, appearance,
- * themes, announcement, seo, contact, watermark, fees, procurement, emi, gst,
- * listings, integrations, shipping, auction, limits, whatsapp, notifications,
- * legal.
- *
- * @tag domain:tester
- * @tag layer:seed
- * @tag pattern:none
- * @tag access:server-only
- * @tag consumers:seed-data/authored/index.ts
- * @tag sideEffects:none
- */
-export const authored = {
-    "checklist-admin-content-marketing-ads-crud-preview": {
-        roles: ["admin", "guest"],
-        startPage: "/admin/ads",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/ads and read every existing ad, its status and its placement.",
-            "In the provider settings, read how 'AdSense client id' and 'Third-party script URL' are presented — whether a stored value is shown or only a masked placeholder.",
-            "Create an ad named 'QA Ad crud-preview' in a DRAFT state with a placement selected.",
-            "Save, RELOAD, and read every field.",
-            "Use the preview and read what it renders.",
-            "Sign out, open /, and check the draft ad is NOT rendered anywhere.",
-            "View that page's source and search it for 'QA Ad crud-preview' and for any AdSense client id.",
-            "Open /api/ads signed out and check the draft is absent from the response.",
-            "Sign back in and delete the ad.",
-        ],
-        // audit-hardcoded-api-routes-ok: a URL the tester opens by hand, not a call site.
-        inputs: { name: "QA Ad crud-preview", status: "draft", publicEndpoint: "/api/ads" },
-        expectedBehaviour: "A draft ad is invisible publicly and its provider credentials never leave the server. The ads group was written by the admin form while undeclared on the settings type, so it was published wholesale by an unauthenticated endpoint — including drafts and unmasked credentials — and nothing type-driven could see it.",
-        expectedUiState: "The ad round-trips. Provider credentials appear only as masked placeholders in the admin form, never as editable stored values. The public page does not render the draft, its source contains neither the ad's name nor an AdSense id, and /api/ads omits it — that endpoint keeps only `status === \"active\"`. A draft appearing publicly, or a credential in the source, is a leak rather than a display bug.",
-        expectedData: { credentialInPublicSource: 0, draftInPublicAdsResponse: false },
-        endResult: "The ad is deleted by the final step.",
-    },
-    "checklist-admin-content-marketing-newsletter-export-admin": {
-        roles: ["admin"],
-        startPage: "/admin/newsletter",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/newsletter and read the subscriber count and the rows.",
-            "Read whether subscriber email addresses are shown in full or masked.",
-            "Click 'Export CSV' and read what the page does IMMEDIATELY — whether it returns at once with a job accepted, or blocks.",
-            "Navigate to /admin and back to /admin/newsletter, then read whether the export's progress is still reported.",
-            "Wait for it to finish and open the exported file.",
-            "Compare the file's row count against the subscriber count shown.",
-        ],
-        inputs: { action: "Export CSV" },
-        expectedBehaviour: "The export runs as a background job rather than inside the request — an unbounded scan of every subscriber is exactly the shape that dies at the ten-second function ceiling in production while a small local list passes. The page subscribes to the job's progress instead of waiting on a response.",
-        expectedUiState: "The export returns immediately with a job accepted rather than freezing the page. Progress survives navigating away and back. The finished file's row count matches the subscriber count. A request that hangs and then times out is the failure.",
-        endResult: "An export file exists. Note whether subscriber emails are exposed in the LIST as well as in the file — the file is expected to carry them, the list is a judgement.",
-    },
-    "checklist-admin-content-marketing-contact-submissions-admin": {
-        roles: ["admin", "guest"],
-        startPage: "/contact",
-        steps: [
-            "Signed out, open /contact and submit a message: name 'QA Contact submissions-admin', email qa-contact-admin@mailnull.com, subject 'Checklist submission', message 'Sent by the tester checklist.'.",
-            "Sign in as admin@letitrip.in / TempPass123! and open /admin/contact.",
-            "Find that message and read its status — a new submission reads 'new'.",
-            "Open the row menu and use its View action, then read every field in the drawer and confirm the full message body is there rather than a truncated preview.",
-            "Use the row menu's mark-read action, RELOAD, and read the status.",
-            "Use the row menu's archive action, RELOAD, and read the status again.",
-            "Search zzzznope and read the result count.",
-        ],
-        inputs: {
-            name: "QA Contact submissions-admin",
-            email: "qa-contact-admin@mailnull.com",
-            message: "Sent by the tester checklist.",
-        },
-        expectedBehaviour: "A submitted message arrives in the admin surface with its full body readable. This is the round trip the contact form's own case cannot prove — a form that shows a confirmation and delivers nothing looks identical to one that works, from the sender's side.",
-        expectedUiState: "The submission appears with its name, email, subject and full body. The View action opens a drawer rather than only offering mutations — a row you can act on but not read is the acting-blind shape. Status moves new → read → resolved and each survives a reload. 'zzzznope' returns zero rows rather than the full list.",
-        expectedData: { nonsenseResultCount: 0 },
-        endResult: "The submission remains, marked handled. Its arrival is the assertion — a missing message means the contact form delivers nowhere.",
-    },
-    "checklist-admin-content-marketing-media-library-admin": {
-        roles: ["admin"],
-        startPage: "/admin/media",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/media and read the grid.",
-            "Check every tile renders its image rather than an empty bordered box.",
-            "Read the filter and sort controls and use each, confirming the results change.",
-            "Search for a known filename, then search zzzznope and read the count.",
-            "Open one item and read its detail — filename, dimensions, where it is used.",
-            "Read whether any stored URL shown is a proxy path rather than a raw bucket URL.",
-        ],
-        inputs: { nonsenseQuery: "zzzznope" },
-        expectedBehaviour: "The library lists stored media with working previews. Every tile is a clickable image inside a control, which is the exact shape that collapses to nothing when a shrink-to-fit wrapper sits between the button and the image — the tile renders as an empty box while the control still works.",
-        expectedUiState: "Every tile shows its image at the same size as its neighbours. Filters and sorts change the grid and 'zzzznope' returns none. Stored URLs are proxy paths, since a raw bucket URL bypasses the watermark and the private-bucket guarantee.",
-        expectedData: { nonsenseResultCount: 0 },
-        endResult: "Read-only; nothing persists beyond the URL.",
-    },
-    "checklist-admin-content-marketing-navigation-editor-admin": {
-        roles: ["admin", "guest"],
-        startPage: "/admin/navigation",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/navigation and write down every nav item, its label, its destination and its order.",
-            "Create one labelled 'QA Nav navigation-editor' pointing at /about, and save.",
-            "RELOAD the editor and read every field of it — this half is the editor's own round trip.",
-            "Sign out and open /. Read the public navbar and record every item it shows.",
-            "Compare that list against the editor's: is 'QA Nav navigation-editor' there, and do the two lists agree at all?",
-            "Sign back in, reorder two items, save, reload, then sign out and check whether the public navbar order followed.",
-            "Sign back in, delete the item, restore the original order, and confirm the editor matches what was written down in step 2.",
-        ],
-        inputs: { label: "QA Nav navigation-editor", href: "/about" },
-        expectedBehaviour: "An editor that saves is not an editor that reaches anything. The claim under test is that /admin/navigation is the source of the public navbar — a create, a reorder and a delete should all show up there.",
-        expectedUiState: "🛑 EXPECT THE PUBLIC HALF TO FAIL, AND RECORD IT AS A FAILURE. The editor round trip should work: the item saves and survives a reload. But the public navbar is `MAIN_NAV_ITEMS`, a static array in src/constants/navigation.tsx filtered only by the listing-type toggles, and nothing anywhere reads `navbarConfig.navItems` — so expect the new item to be absent from /, the reorder to change nothing publicly, and the two lists to disagree. Record both lists side by side; that comparison is the finding.",
-        expectedData: { savedInEditor: true, appearsInPublicNavbar: false },
-        endResult: "The item is deleted and the original order restored, so the editor matches step 2 again. Keep the halves apart: the editor persisting correctly and reaching nothing is a different defect from an editor that fails to save.",
-    },
-    "checklist-admin-content-marketing-settings-navigation-actions": {
-        roles: ["admin"],
-        startPage: "/admin/site",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/site and read every tab in the strip — there should be twenty: about, branding, appearance, themes, announcement, seo, contact, watermark, fees, procurement, emi, gst, listings, integrations, shipping, auction, limits, whatsapp, notifications, legal.",
-            "Open the header search and type 'fees'.",
-            "Click the result and read which tab opens.",
-            "Read the URL and check it names the tab rather than being bare /admin/site.",
-            "Copy that URL, open it in a new browser tab, and confirm it opens on the same settings tab.",
-            "Open /admin/site?tab=zzzznope and read what happens.",
-        ],
-        inputs: { searchTerm: "fees", expectedTab: "fees", unknownTab: "zzzznope", tabCount: 20 },
-        expectedBehaviour: "Settings are reachable by deep link and by search, and search reaches individual tabs rather than only the page. Landing on the first of twenty tabs and leaving the admin to hunt is a fail rather than a partial pass, and an unknown tab value falls back quietly because the realistic cause is a stale bookmark.",
-        expectedUiState: "The search result opens the named tab, the URL carries it, and the copied URL reopens the same tab. An unknown value opens the default with no error banner and no blank panel.",
-        expectedData: { tabCount: 20 },
-        endResult: "Read-only; nothing is saved.",
-    },
-    "checklist-admin-content-marketing-features-feature-flags-admin": {
-        roles: ["admin", "guest"],
-        startPage: "/admin/site",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/site, then its 'Listings' tab, and write down the state of every listing-type and category-type toggle.",
-            "Turn the auction listing type OFF and save.",
-            "RELOAD the tab and check that ONLY that toggle changed.",
-            "Sign out and open /: the Auctions item must be gone from the main navbar. Then open /auctions and read what is shown.",
-            "Sign back in, turn the auction type back ON, save, sign out, and confirm the navbar item and /auctions both return.",
-            "Signed out, open /api/site-settings and search the response for 'adminCheckoutBypass', 'smsVerification' and 'commissions'.",
-        ],
-        inputs: { tab: "listings", toggled: "auction" },
-        expectedBehaviour: "A product control reaches the behaviour it names, in both directions, and saving one leaves the others alone — a disabled listing type is hidden from every listing surface and rejected on create and add-to-cart. The public settings response is an ALLOW-LIST projection: an operational setting such as the admin checkout bypass has no business being readable by an anonymous caller, and such settings were published for a long time because the response was built by spreading the document and deleting three keys.",
-        expectedUiState: "Only the toggled type changes after the reload. With auctions off the navbar drops its Auctions item; with them on it returns. The public settings response contains no operational setting — nothing naming a checkout bypass, an SMS-verification switch or the commission economics.",
-        expectedData: { operationalSettingsInPublicResponse: 0 },
-        endResult: "Every toggle is back in its original state and the navbar shows Auctions again. A setting visible in the public response is a projection leak rather than a settings bug. Note this page has NO 'feature flags' surface: that group was deleted in favour of this one, because 11 of its 14 keys had no readers at all.",
-    },
-};

package/dist/features/tester/seed-data/authored/admin__coupons.d.ts

@@ -1,2 +0,0 @@
-import type { AuthoredCase } from "./_types";
-export declare const authored: Record<string, AuthoredCase>;

package/dist/features/tester/seed-data/authored/admin__coupons.js

@@ -1,215 +0,0 @@
-/*
- * WHY: Authored six-part procedures for the admin/coupons page.
- * WHAT: 11 case(s), keyed by full checklist id.
- *
- * Written by hand, case by case, against the label each one states. There is no
- * generator: the authoring scripts were deleted once it was clear they were
- * scaffolding around work that is simply writing.
- *
- * 🛑 THIS ROUTE ONCE ACCEPTED EVERY EDIT AND WROTE NOTHING. The handler returned a
- * 200 echoing the submission back while only activate and deactivate reached a
- * repository write — so a changed name, discount, limit or validity looked saved,
- * looked correct on screen, and was gone on reload. That is why
- * coupon-admin-edit-actually-saves exists and why nearly every case here ends in
- * a reload rather than a confirmation message.
- *
- * @tag domain:tester
- * @tag layer:seed
- * @tag pattern:none
- * @tag access:server-only
- * @tag consumers:seed-data/authored/index.ts
- * @tag sideEffects:none
- */
-export const authored = {
-    "checklist-admin-coupons-coupon-create-percentage": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons and create a percentage coupon coded QAADMIN15 at 15%, maximum discount 200, minimum purchase 500, valid for a week.",
-            "Save, RELOAD, and read every field.",
-            "Sign out and sign in as vivaan.kapoor@gmail.com / TempPass123!.",
-            "Add product-beyblade-original-driger-v (₹1,799) to the cart and reach the checkout coupon step.",
-            "Apply QAADMIN15 and read the discount amount.",
-            "Compare it against 15% of ₹1,799 and against the ₹200 cap.",
-        ],
-        inputs: { code: "QAADMIN15", percent: 15, maxDiscount: 200, minPurchase: 500, itemPrice: 1799 },
-        expectedBehaviour: "A percentage coupon applies its rate and then its cap. 15% of ₹1,799 is ₹269.85, above the ₹200 maximum, so the cap is what the buyer receives — a cap that is stored and not applied is invisible until a large enough cart reaches it.",
-        expectedUiState: "After the reload every field holds. At checkout the discount is ₹200.00, not ₹269.85. A discount of ₹269.85 means the cap was ignored.",
-        expectedData: { appliedDiscount: 200 },
-        endResult: "Leave the coupon in place — later cases read it.",
-    },
-    "checklist-admin-coupons-coupon-create-fixed-freeship-bxgy": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons and read every coupon TYPE the form offers.",
-            "Create a fixed-amount coupon coded QAFIXED100 at ₹100 off with no minimum, and save.",
-            "Create a free-shipping coupon coded QAFREESHIP with no minimum, and save.",
-            "Create a buy-X-get-Y coupon coded QABXGY if the form offers that type, and save.",
-            "RELOAD each and read its type and settings.",
-            "As vivaan.kapoor@gmail.com / TempPass123!, apply each in turn at checkout and read what each changes.",
-            "Delete all three.",
-        ],
-        inputs: { fixedCode: "QAFIXED100", fixedAmount: 100, freeShipCode: "QAFREESHIP", bxgyCode: "QABXGY" },
-        expectedBehaviour: "Each type does something different at checkout: fixed reduces the subtotal by a flat amount, free shipping zeroes the shipping line specifically, and buy-X-get-Y discounts by quantity. A type that saves but behaves identically to another has not been implemented, only listed.",
-        expectedUiState: "The fixed coupon reduces the subtotal by ₹100. The free-shipping one zeroes the SHIPPING line rather than the subtotal — a free-shipping coupon that takes its value off the subtotal is the failure worth naming. Buy-X-get-Y changes the total by quantity.",
-        endResult: "All three coupons are deleted by the final step.",
-    },
-    "checklist-admin-coupons-coupon-per-user-limit-enforced": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons, find ARENAVIP, and read its per-user limit (1), total limit (50) and current usage (12).",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as vivaan.kapoor@gmail.com / TempPass123! and place an order of 2 × product-beyblade-original-dranzer-s (₹2,998, above ARENAVIP's ₹2,000 minimum) applying ARENAVIP.",
-            "Attempt a second order applying it again and read the refusal.",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as rehan.sheikh@gmail.com / TempPass123! and apply ARENAVIP at checkout on the same two items.",
-            "Sign back in as admin and read the usage count.",
-        ],
-        inputs: { code: "ARENAVIP", perUserLimit: 1 },
-        expectedBehaviour: "ARENAVIP is one use per user, and its total limit of 50 has 38 uses left — so exhausting it for one buyer must leave it usable by the next. Enforcing a per-user limit as if it were global withdraws the coupon from everybody after a single redemption.",
-        expectedUiState: "The same buyer's second attempt is refused with a limit message. A DIFFERENT buyer's attempt is accepted. The admin usage count has risen by the number of redemptions, and the coupon still reads as active.",
-        expectedData: { perUserLimit: 1 },
-        endResult: "The cross-account half is the case — the same-account half alone passes under either reading.",
-    },
-    "checklist-admin-coupons-coupon-min-max-discount": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123! and confirm QAADMIN15 has a minimum purchase of 500 and a maximum discount of 200.",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as vivaan.kapoor@gmail.com / TempPass123!.",
-            "Add product-beyblade-metal-storm-pegasus (₹99) to the cart alone and apply QAADMIN15 at checkout.",
-            "Read the refusal and whether it names the required amount.",
-            "Add product-beyblade-original-driger-v (₹1,799) so the subtotal clears the minimum, and apply again.",
-            "Read the discount amount.",
-            "Type 799.50 into a money field elsewhere in the coupon form and check a decimal is accepted.",
-        ],
-        inputs: { code: "QAADMIN15", minPurchase: 500, maxDiscount: 200 },
-        expectedBehaviour: "The minimum gates whether the coupon applies at all and the maximum caps what it gives. The minimum is measured against the items the coupon could actually discount rather than the whole cart, and money is decimal rupees throughout — a validator rejecting 799.50 as a non-integer is a leftover from the old whole-number storage.",
-        expectedUiState: "Below the minimum the coupon is refused with a message naming the REASON — today 'Minimum purchase requirement not met', which names the reason but NOT the amount, and the missing amount is a known gap recorded against content-discovery/coupons rather than a fresh finding here. What must not appear is a bare 'Invalid coupon', which would tell the buyer nothing about how much more to add. Above it the discount is capped at ₹200.00. A decimal amount is accepted in the coupon form.",
-        endResult: "Nothing is ordered; leave checkout without placing.",
-    },
-    "checklist-admin-coupons-coupon-scope-admin-vs-seller": {
-        roles: ["admin"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons and read the scope shown on every row.",
-            "Filter or sort by scope if the list offers it, and read the results.",
-            "Open a seller-scoped coupon and read which store it belongs to.",
-            "Open an admin-scoped coupon and read whether it names a store at all.",
-            "Read whether the admin can change a coupon's scope after creation.",
-        ],
-        expectedBehaviour: "There are exactly two scopes and no third: platform-wide with no store, or seller-scoped to one store. The distinction decides which stacking bucket a coupon occupies at checkout, so a row that does not show its scope hides the one field that determines its behaviour.",
-        expectedUiState: "Every row shows its scope. Seller-scoped coupons name their store; admin-scoped ones do not name any. Any scope filter returns rows for both values.",
-        endResult: "Read-only; nothing persists beyond the URL.",
-    },
-    "checklist-admin-coupons-coupon-expire-reject": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons, open SEALED20, and write down its end date.",
-            "Set its end date to yesterday and LEAVE the Active toggle ON, then save — it is now past its end date while still flagged active.",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as vivaan.kapoor@gmail.com / TempPass123! and apply SEALED20 at checkout.",
-            "Read the exact wording of the refusal.",
-            "Sign back in as admin, deactivate BLADER50 without touching its dates, and apply that one as the buyer.",
-            "Compare the two refusal messages.",
-            "Sign back in as admin, restore SEALED20's end date and reactivate BLADER50.",
-        ],
-        inputs: { expiredCode: "SEALED20", deactivatedCode: "BLADER50" },
-        expectedBehaviour: "Expiry and deactivation are two separate reasons and both refuse. SEALED20 is pushed past its end date while still flagged active precisely so the DATE check is exercised rather than the flag — a validator reading only the flag would accept it.",
-        expectedUiState: "The expired coupon is refused with a message naming expiry. The deactivated one is refused with a different message. Two identical generic refusals mean only one of the two checks is running.",
-        endResult: "SEALED20's end date is restored and BLADER50 is reactivated by the final step. Leaving either changed silently breaks every later case that applies them.",
-    },
-    "checklist-admin-coupons-coupon-admin-is-platform-wide": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123! and confirm QAADMIN15 is admin-scoped with no store.",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as vivaan.kapoor@gmail.com / TempPass123!.",
-            "Add product-beyblade-burst-regalia-genesis (₹1,399, Beyblade Arena) to the cart.",
-            "Add prizedraw-beyblade-original-vintage-vault (₹299, LetItRip Official) and set its quantity to 2.",
-            "Apply QAADMIN15 at checkout and read the discount.",
-            "Place the order and open both resulting orders in /user/orders.",
-            "Read the QAADMIN15 amount on each and add them together.",
-        ],
-        inputs: { code: "QAADMIN15", arenaSubtotal: 1399, officialSubtotal: 598 },
-        expectedBehaviour: "A platform coupon applies across the whole cart and is then prorated across the per-store orders by their share of the subtotal. The parts must reconcile exactly to what the buyer was shown, or the platform absorbed or overcharged the difference.",
-        expectedUiState: "The discount is computed against the combined subtotal rather than one store's. Both orders carry a share of it and the two shares sum to the single figure shown at checkout — not to more, and not to less.",
-        expectedData: { orderCount: 2 },
-        endResult: "Two orders exist, each with its prorated share. The reconciliation is the assertion.",
-    },
-    "checklist-admin-coupons-coupon-admin-no-stacking-toggle": {
-        roles: ["admin"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons and start creating a coupon.",
-            "Read every field and toggle the form offers.",
-            "Look for any control about combining with seller coupons or with other platform coupons.",
-            "Open an existing coupon's editor and look for the same.",
-        ],
-        expectedBehaviour: "Stacking is a platform rule, not a per-coupon setting — one coupon per store plus one platform-wide, unconditionally. The old combine-with-seller-coupons opt-out was removed because nothing read it, and a control that appears to configure a rule it cannot change is worse than no control at all.",
-        expectedUiState: "No stacking or combinability toggle is offered on either the create or the edit form. A toggle present here is the finding, whether or not it saves.",
-        endResult: "Read-only; leave the form without saving.",
-    },
-    "checklist-admin-coupons-coupon-admin-category-restriction-enforced": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Create a coupon coded QACATADMIN20 at 20%, restricted to the Beyblade Burst category, no minimum.",
-            "Save, RELOAD, and confirm the restriction persisted.",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as vivaan.kapoor@gmail.com / TempPass123!.",
-            "Add product-beyblade-metal-storm-pegasus (₹1,299, Metal Fight) alone and apply QACATADMIN20 — read the refusal.",
-            "Add product-beyblade-burst-regalia-genesis (₹1,399, Burst) and apply again.",
-            "Read the discount and compare it against 20% of ₹1,399.",
-            "Sign back in as admin and delete the coupon.",
-        ],
-        inputs: { code: "QACATADMIN20", percent: 20, burstPrice: 1399, metalPrice: 1299 },
-        expectedBehaviour: "The restriction is tested by set intersection against each product's full category chain, and the discount covers only the eligible items. The category is fetched lazily — the cart snapshots none — so the lookup fires only when a coupon actually carries a restriction, and the common case costs no extra reads.",
-        expectedUiState: "The Metal-only cart is refused with a message naming the category. With the Burst item added the coupon applies at about ₹279.80 — 20% of ₹1,399 — not 20% of the ₹2,698 combined subtotal.",
-        expectedData: { eligibleSubtotal: 1399 },
-        endResult: "The coupon is deleted by the final step.",
-    },
-    "checklist-admin-coupons-coupon-admin-edit-actually-saves": {
-        roles: ["admin"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons and open QAADMIN15's editor.",
-            "Write down every field: name, description, discount, maximum, minimum, usage limits and both validity dates.",
-            "Change the NAME and the discount percentage, and save.",
-            "Read the confirmation message.",
-            "RELOAD the editor and compare every field against what was written down.",
-            "Change only the validity end date, save, RELOAD, and check the start date is still there.",
-            "Use the deactivate action, then reactivate it, reloading after each.",
-        ],
-        inputs: { code: "QAADMIN15" },
-        expectedBehaviour: "🛑 This is the case the page exists for. The handler once returned a 200 echoing the submission while only activate and deactivate reached a repository write — so a changed name, discount, limit or date looked saved and was gone on reload, with no error to notice. The validity object must also MERGE rather than replace: sending one sub-field wholesale wipes the other date.",
-        expectedUiState: "After the reload the new name and discount are present. After the end-date edit the start date is unchanged. Deactivate and reactivate both persist. A success message followed by the ORIGINAL values after reload is the exact failure, and without the reload the screen looks identical either way.",
-        expectedData: { changesPersisted: true },
-        endResult: "Restore QAADMIN15's original name and percentage, or delete it. This case cannot be judged from the confirmation message — only from the reload.",
-    },
-    "checklist-admin-coupons-coupon-admin-usage-visible": {
-        roles: ["admin", "buyer"],
-        startPage: "/admin/coupons",
-        steps: [
-            "Sign in as admin@letitrip.in / TempPass123!.",
-            "Open /admin/coupons and read the usage figure on every row.",
-            "Note the figure for ARENA25.",
-            "Swap identity before this step: this case lists admin among its roles, so the harness resolves the whole batch to the ADMIN session. Copy tester/.tester-runs/session-buyer.json over session.json and CLOSE THE BROWSER — the MCP reads that file only at context creation. An admin can apply a coupon perfectly well, so without this the case passes while testing the wrong person. Then sign in as vivaan.kapoor@gmail.com / TempPass123! and place an order applying ARENA25.",
-            "Sign back in as admin and read ARENA25's usage figure again.",
-            "Open the coupon's detail and read whether it shows total usage, per-user usage, or both.",
-            "Reload and confirm the figure persists.",
-        ],
-        inputs: { code: "ARENA25" },
-        expectedBehaviour: "Redemption is counted at checkout, per user as well as globally, and the per-user record is written as a side effect of applying the coupon. That write is fire-and-forget, so a failure is silent — a usage figure that never moves is how you find out it failed.",
-        expectedUiState: "The usage figure is exactly one higher after the order and survives a reload. A figure that does not move means the usage write failed without anything surfacing it.",
-        expectedData: { usageIncrement: 1 },
-        endResult: "One order exists carrying the discount. Delete QAADMIN15 as the last action on this page.",
-    },
-};

package/dist/features/tester/seed-data/authored/admin__events-raffles-spin.d.ts

@@ -1,2 +0,0 @@
-import type { AuthoredCase } from "./_types";
-export declare const authored: Record<string, AuthoredCase>;