@mohasinac/appkit 4.71.0 → 4.72.0

package/dist/_internal/server/features/products/actions.d.ts

@@ -1,6 +1,6 @@
 import { type ActionResult } from "../../../shared/types/action-result";
 export declare function createProductAction(input: unknown): Promise<ActionResult<unknown>>;
-export declare function createAuctionAction(input: unknown): Promise<ActionResult<unknown>>;
+export declare function createCollectorDropAction(input: unknown): Promise<ActionResult<unknown>>;
 export declare function createPreOrderAction(input: unknown): Promise<ActionResult<unknown>>;
 export declare function updateProductAction(productId: string, input: unknown): Promise<ActionResult<unknown>>;
 export declare function deleteProductAction(productId: string): Promise<ActionResult<unknown>>;

package/dist/_internal/server/features/products/actions.js

@@ -14,8 +14,8 @@ import { wrapAction } from "../../../shared/types/action-result.js";
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers.js";
 import { isAdminUser } from "../../../../features/auth/role-predicates.js";
-import { productInputSchema, productUpdateSchema, auctionInputSchema, preOrderInputSchema, setFeaturedSchema, setStatusSchema } from "../../../shared/features/products/schema.js";
-import { assertProductOwnership, assertStatusTransition, assertPrizeDrawNotLocked, assertPrizeDrawWonItemsImmutable, } from "./service.js";
+import { productInputSchema, productUpdateSchema, collectorDropInputSchema, preOrderInputSchema, setFeaturedSchema, setStatusSchema } from "../../../shared/features/products/schema.js";
+import { assertProductOwnership, assertStatusTransition, assertClearanceNotLocked, assertClearanceWonItemsImmutable, } from "./service.js";
 import { ValidationError } from "../../../shared/errors/index.js";
 import { NotFoundError } from "../../../../errors/index.js";
 import { storeRepository } from "../../../../features/stores/repository/store.repository.js";
@@ -58,17 +58,17 @@ export async function createProductAction(input) {
         });
     });
 }
-export async function createAuctionAction(input) {
+export async function createCollectorDropAction(input) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["seller", "admin"]);
-        const parsed = auctionInputSchema.safeParse(input);
+        const parsed = collectorDropInputSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
         return productRepository.create({
             ...parsed.data,
             ...(await sellerStoreFields(user.uid)),
             status: "draft",
-            listingType: "auction",
+            listingType: "collector-drop",
             featured: false,
         });
     });
@@ -95,7 +95,7 @@ export async function updateProductAction(productId, input) {
         const parsed = productUpdateSchema.safeParse(input);
         if (!parsed.success)
             throw new ValidationError(parsed.error.issues[0]?.message ?? "Invalid input");
-        assertPrizeDrawWonItemsImmutable(product, parsed.data.prizeDrawItems);
+        assertClearanceWonItemsImmutable(product, parsed.data.prizeDrawItems);
         return productRepository.update(productId, parsed.data);
     });
 }
@@ -103,7 +103,7 @@ export async function deleteProductAction(productId) {
     return wrapAction(async () => {
         const user = await requireRoleUser(["seller", "admin"]);
         const product = await assertProductOwnership(productId, user.uid);
-        assertPrizeDrawNotLocked(product, "deleted");
+        assertClearanceNotLocked(product, "deleted");
         return productRepository.delete(productId);
     });
 }
@@ -116,7 +116,7 @@ export async function setProductStatusAction(input) {
         const product = await assertProductOwnership(parsed.data.productId, user.uid);
         assertStatusTransition(product.status, parsed.data.status);
         if (parsed.data.status !== "published") {
-            assertPrizeDrawNotLocked(product, "unpublished or archived");
+            assertClearanceNotLocked(product, "unpublished or archived");
         }
         // SB-UNI-O — live listings must be admin-verified before a seller can publish them.
         if (parsed.data.status === "published" &&

package/dist/_internal/server/features/products/data.js

@@ -179,9 +179,10 @@ export async function listSitemapProducts() {
             .map((doc) => {
             const data = doc.data();
             const rawListingType = data.listingType;
-            const listingType = rawListingType === "auction" ||
+            const listingType = rawListingType === "collector-drop" ||
+                rawListingType === "auction" ||
                 rawListingType === "pre-order" ||
-                rawListingType === "prize-draw"
+                rawListingType === "clearance"
                 ? rawListingType
                 : "standard";
             return {
@@ -210,10 +211,10 @@ function toRelatedItems(docs, currentProductId, settings) {
         isPubliclyVisible(r) &&
         /*
          * 🛑 A DISABLED listing type must not appear here. Related items are
-         * pure DISCOVERY — unlike a won auction sitting in the cart, nothing
+         * pure DISCOVERY — unlike a won collector drop sitting in the cart, nothing
          * here is an obligation the buyer already holds, so there is no reason
          * to surface a type the admin has switched off. Without this an
-         * auction card rendered on every related carousel with auctions
+         * collector drop card rendered on every related carousel with collector drops
          * disabled, and it was reachable by clicking it.
          */
         isListingTypeEnabled(normalizeListingType(r), settings) &&

package/dist/_internal/server/features/products/index.d.ts

@@ -1,6 +1,6 @@
 export { getProductForDetail, getReviewsForProduct, listSitemapProducts, type SitemapProduct, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, getReviewPageForProduct, type RelatedItemsResult, } from "./data";
 export { listPublicProducts, parsePublicProductParams, defaultAvailabilityForListingTypes, PUBLIC_PRODUCT_MAX_PAGE_SIZE, ANY_STATUS, type PublicProductListInput, type PublicProductListResult, type PublicProductListOptions, type PublicProductExecutor, type PublicProductQuery, type ExecutorResult, } from "./list-public";
 export { assertProductOwnership, assertStatusTransition, assertInStock, effectivePrice, isAvailableForPurchase, } from "./service";
-export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions";
+export { createProductAction, createCollectorDropAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions";
 export { PRODUCTS_PAGE_SIZE, PRODUCTS_FEATURED_LIMIT, PRODUCTS_RELATED_LIMIT, PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config";
 export { renderProductOgImage, renderProductOg, type ProductOgData, type OgOptions } from "./og";

package/dist/_internal/server/features/products/index.js

@@ -1,6 +1,6 @@
 export { getProductForDetail, getReviewsForProduct, listSitemapProducts, computeRelatedItems, toProductItem, toReview, getReviewItemsForProduct, getReviewPageForProduct, } from "./data.js";
 export { listPublicProducts, parsePublicProductParams, defaultAvailabilityForListingTypes, PUBLIC_PRODUCT_MAX_PAGE_SIZE, ANY_STATUS, } from "./list-public.js";
 export { assertProductOwnership, assertStatusTransition, assertInStock, effectivePrice, isAvailableForPurchase, } from "./service.js";
-export { createProductAction, createAuctionAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions.js";
+export { createProductAction, createCollectorDropAction, createPreOrderAction, updateProductAction, deleteProductAction, setProductStatusAction, setProductFeaturedAction, } from "./actions.js";
 export { PRODUCTS_PAGE_SIZE, PRODUCTS_FEATURED_LIMIT, PRODUCTS_RELATED_LIMIT, PRODUCTS_SITEMAP_LIMIT } from "../../../shared/features/products/config.js";
 export { renderProductOgImage, renderProductOg } from "./og.js";

package/dist/_internal/server/features/products/list-public.js

@@ -30,7 +30,7 @@
  * @tag layer:server-data
  * @tag pattern:none
  * @tag access:server-only
- * @tag consumers:ProductsIndexPageView,ArtStickersListView,AuctionsListView,PreOrdersListView,api/products
+ * @tag consumers:ProductsIndexPageView,ArtStickersListView,CollectorDropsListView,PreOrdersListView,api/products
  * @tag sideEffects:firestore-read
  */
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
@@ -126,6 +126,12 @@ const TYPE_FACET_FIELD = {
     [TABLE_KEYS.LIVE_SEX]: "liveItem.sex",
     [TABLE_KEYS.JURISDICTION]: "liveItem.jurisdictionAllowed",
     [TABLE_KEYS.LIVE_TRANSPORT_METHOD]: "liveItem.transport.method",
+    // 3B item 1b, toolbars subsystem (2026-11-05) — the first real consumer
+    // of ListingToolbar's admin-added-toggle mechanism. Not type-specific
+    // (unlike every entry above); the composite index below mirrors
+    // `isPartOfBundle`'s own existing (listingType, X) shape, the closest
+    // precedent for a general, non-type-scoped boolean product facet.
+    [TABLE_KEYS.IS_ON_SALE]: "isOnSale",
 };
 /** Every field path a per-type facet can filter on. Read by the wiring audit. */
 export const TYPE_FACET_FIELD_PATHS = Object.values(TYPE_FACET_FIELD);
@@ -182,9 +188,9 @@ function readAvailability(get, fallback) {
 export function parsePublicProductParams(params, defaults) {
     const get = (k) => first(params, k);
     // The type filter is a multi-select checkbox group, so its URL value is a
-    // pipe-joined set (`auction|pre-order`). Selected types NARROW the page's
+    // pipe-joined set (`collector drop|pre-order`). Selected types NARROW the page's
     // span; anything outside the span is discarded rather than allowed to widen
-    // it (an /art URL must not be able to ask for auctions). Nothing selected —
+    // it (an /art URL must not be able to ask for collector drops). Nothing selected —
     // or nothing valid selected — means the page's full span.
     const typeParam = get(TABLE_KEYS.LISTING_TYPE);
     const span = defaults?.listingTypes;
@@ -224,7 +230,7 @@ export function parsePublicProductParams(params, defaults) {
         // Now a plain drawer facet again. It used to double as the hide-ended
         // mechanism, which is why it only worked when exactly one listing type was
         // selected — `dateFieldFor` returns null otherwise, so /products silently
-        // showed ended auctions in its default view.
+        // showed ended collector drops in its default view.
         dateFrom: get(TABLE_KEYS.DATE_FROM) || undefined,
         dateTo: get(TABLE_KEYS.DATE_TO) || undefined,
         page: num(get(TABLE_KEYS.PAGE)) ?? DEFAULT_PAGE,
@@ -239,8 +245,8 @@ export function parsePublicProductParams(params, defaults) {
          * while the dropdown displayed the sort the user had picked.
          *
          * Measured against the live dev server — identical row order for
-         * `?sorts=auctionEndDate` and for no sort at all, versus a correctly
-         * ordered result for `?sort=auctionEndDate`.
+         * `?sorts=collectorDropEndDate` and for no sort at all, versus a correctly
+         * ordered result for `?sort=collectorDropEndDate`.
          *
          * It survived because the SSR paint IS correct: the listing views pass
          * `sorts` through `defaults`, and an anonymous visitor with `initialData`
@@ -273,7 +279,7 @@ export function parsePublicProductParams(params, defaults) {
 /**
  * Only clauses Firestore can satisfy alongside an arbitrary `orderBy`. Notably
  * ABSENT: `inStock` (a `stockQuantity` range) and, unless the sort matches, the
- * auction/pre-order date ranges. Firestore appends an inequality field to the
+ * collector drop/pre-order date ranges. Firestore appends an inequality field to the
  * orderBy implicitly, so pairing one with an unrelated sort demands a composite
  * index in an order nobody declares — it fails with FAILED_PRECONDITION, which
  * upstream reads as a bare "no results".
@@ -403,8 +409,8 @@ function buildFirestoreSafeFilters(input, opts) {
 function dateFieldFor(types) {
     if (!types || types.length !== 1)
         return null;
-    if (types[0] === PRODUCT_FIELDS.LISTING_TYPE_VALUES.AUCTION) {
-        return PRODUCT_FIELDS.AUCTION_END_DATE;
+    if (types[0] === PRODUCT_FIELDS.LISTING_TYPE_VALUES.COLLECTOR_DROP) {
+        return PRODUCT_FIELDS.COLLECTOR_DROP_END_DATE;
     }
     if (types[0] === PRODUCT_FIELDS.LISTING_TYPE_VALUES.PRE_ORDER) {
         return PRODUCT_FIELDS.PRE_ORDER_DELIVERY_DATE;
@@ -567,7 +573,7 @@ export async function listPublicProducts(input, opts) {
     ];
     const types = asListingTypes(input.listingTypes);
     // ── Path B: one type whose unavailability IS a pushable inequality, and the
-    //    caller is already sorting by that field. Ended auctions sorted by end
+    //    caller is already sorting by that field. Ended collector drops sorted by end
     //    date is the whole reason this branch exists — it gives the archive real,
     //    unbounded-depth Firestore pagination instead of a 50-row window.
     const pushdown = wantUnavailable && types.length === 1 && !hasDateRange
@@ -732,7 +738,7 @@ export async function listPublicProducts(input, opts) {
     // When a date range stays in memory, fetch in whichever direction front-loads
     // the rows that will PASS it: `dateFrom` (">=", still live) wants the most
     // future dates first; `dateTo` ("<=", ends by) wants the earliest first.
-    // Fetching in the client's own order instead is what made live auctions
+    // Fetching in the client's own order instead is what made live collector drops
     // invisible once ~50 had already ended.
     const fetchSorts = inMemory && hasDateRange && !canPushDate && dateField
         ? input.dateFrom
@@ -921,7 +927,7 @@ opts) {
  * 🛑 The `Date` branch is load-bearing. Without it a Date falls through to
  * `String(value)` — `"Wed Aug 30 2026 …"` — and a lexical compare of those
  * orders by WEEKDAY NAME. Every in-memory date sort was wrong: the "Sold &
- * Ended" tab ordered by `createdAt`/`auctionEndDate`, and now every per-type
+ * Ended" tab ordered by `createdAt`/`collectorDropEndDate`, and now every per-type
  * facet under "Oldest First". A Firestore Timestamp arrives here as a Date via
  * `mapDoc`, so the ISO-string case is only for a row that has already been
  * serialised; both are handled.

package/dist/_internal/server/features/products/listing-tab-counts.d.ts

@@ -57,7 +57,7 @@ export interface ListingTabCountResult {
  * Count every tab in `tabs` within `scope`, in one parallel batch.
  *
  * The listing-type buckets come from each tab's own `listingType` field — which
- * already carries `"art|stickers"` as a pipe OR-group — so this function never
+ * already carries pipe OR-groups like `"standard|spares"` — so this function never
  * enumerates the `ListingType` union itself and cannot drift from it.
  *
  * `stores` is not counted here: only the category page has that tab and it

package/dist/_internal/server/features/products/listing-tab-counts.js

@@ -139,18 +139,18 @@ async function unavailableByType(scope, types, now) {
          * must be its own field (Root Cause #59) — so that one clause does need
          * an index, which is exactly why `unknown` is tracked per type.
          *
-         * 🛑 THE AUCTION INDEXES ARE NOT DECLARED, deliberately. Until they are,
-         * the auction clause returns FAILED_PRECONDITION, `unknown` gains
-         * `auction`, and that ONE badge falls back to its total — every other
+         * 🛑 THE COLLECTOR_DROP INDEXES ARE NOT DECLARED, deliberately. Until they are,
+         * the collector drop clause returns FAILED_PRECONDITION, `unknown` gains
+         * `collector drop`, and that ONE badge falls back to its total — every other
          * type stays exact. Adding them to
          * `appkit/firebase/base/firestore.indexes.json` is only half the change:
          * an undeployed index file fails `audit-firebase-rules-deployed`, so the
          * three entries below and `npm run firebase -- deploy --only
          * firestore:indexes` belong in the same session.
          *
-         *   products: status ASC, categorySlugs CONTAINS, auctionEndDate DESC
-         *   products: brand  ASC, status ASC,             auctionEndDate DESC
-         *   products: storeId ASC, status ASC,            auctionEndDate DESC
+         *   products: status ASC, categorySlugs CONTAINS, collectorDropEndDate DESC
+         *   products: brand  ASC, status ASC,             collectorDropEndDate DESC
+         *   products: storeId ASC, status ASC,            collectorDropEndDate DESC
          *
          * One per scope the tab bars count in, because `buildScopedQuery` leads
          * with a different equality for each.
@@ -215,7 +215,7 @@ async function unavailableByType(scope, types, now) {
     }
     return { byType, unknown };
 }
-/** The listing types one tab spans — `"art|stickers"` is a pipe OR-group. */
+/** The listing types one tab spans — `"standard|spares"` is a pipe OR-group. */
 function typesOf(tab) {
     return String(tab.listingType).split("|").filter(Boolean);
 }
@@ -223,7 +223,7 @@ function typesOf(tab) {
  * Count every tab in `tabs` within `scope`, in one parallel batch.
  *
  * The listing-type buckets come from each tab's own `listingType` field — which
- * already carries `"art|stickers"` as a pipe OR-group — so this function never
+ * already carries pipe OR-groups like `"standard|spares"` — so this function never
  * enumerates the `ListingType` union itself and cannot drift from it.
  *
  * `stores` is not counted here: only the category page has that tab and it

package/dist/_internal/server/features/products/og.js

@@ -14,7 +14,7 @@ export function renderProductOg(doc, opts) {
 export function renderProductOgImage(data, siteName) {
     // 🛑 No money in the accent slot. An OG image is a PUBLIC image URL anyone can
     // fetch directly, with the amount burned into the pixels — no gate reaches it,
-    // and no paywall markup describes it. The auction and pre-order OGs already
+    // and no paywall markup describes it. The collector drop and pre-order OGs already
     // use a non-money accent (end date / release date); this matches them.
     return renderOgLayout({
         title: data.title,

package/dist/_internal/server/features/products/service.d.ts

@@ -4,34 +4,71 @@ export declare function assertProductOwnership(productId: string, sellerId: stri
 /** Validate that a status transition is allowed. */
 export declare function assertStatusTransition(from: string, to: string): void;
 /**
- * Anti-scam guard — once a prize draw has at least one paid entry, the
+ * Anti-scam guard — once a clearance draw has at least one paid entry, the
  * seller can no longer take it down (unpublish/archive/delete). Prevents a
  * seller from dodging shipment of an expensive won prize by pulling the
  * listing after the fact.
  */
-export declare function assertPrizeDrawNotLocked(product: Pick<ProductDocument, "listingType" | "prizeCurrentEntries">, action: string): void;
+export declare function assertClearanceNotLocked(product: Pick<ProductDocument, "listingType" | "prizeCurrentEntries">, action: string): void;
 /**
- * Anti-scam guard — once a prize item has been won, its title/images/
- * description/condition/estimatedValue become immutable server-side (the
- * client editor already locks this visually via PrizeDrawItemsEditor's
- * `locked` state, but that's UI-only — this is the enforcement). Prevents a
- * seller from swapping in a cheaper item after a buyer has already won.
+ * Anti-scam guard — a won prize item is immutable, and **no seller may set or
+ * clear an allocation.**
+ *
+ * The client editor also locks won rows visually (`ClearanceItemsEditor`'s
+ * `locked` state), but that is UI-only; this is the enforcement, and it runs
+ * on all three product-update paths (seller action, admin action, API).
+ *
+ * ## 🛑 Three holes this closes (found auditing 1.35, 2026-11-07)
+ *
+ * The original guard only compared the DESCRIPTIVE fields of items that were
+ * already `isWon` in the stored document. `isWon` and `wonByOrderId` — the
+ * allocation itself — were accepted straight from seller input
+ * (`prizeDrawItems[].isWon` is `z.boolean()` in the product input schema), and
+ * the loop skipped anything it could not match. So a seller could:
+ *
+ *  1. **Delete a won item.** `if (!incoming) continue` passed a payload that
+ *     simply omitted prize #3 — the won prize left the pool entirely, taking
+ *     the record of what the buyer was owed with it. This was the worst of the
+ *     three, because it looked like the guard's "unchanged" case.
+ *  2. **Un-win a won item** by sending `isWon: false`, freeing an
+ *     already-allocated prize to be handed to someone else.
+ *  3. **Invent a win** by sending `isWon: true` (and any `wonByOrderId`) on an
+ *     item the platform never picked — removing it from the RNG's candidate
+ *     pool, or making an order appear to have won something it did not.
+ *
+ * Every one of those defeats the stated purpose of the mechanic: *"no seller
+ * can say you got a trash item when in reality you got the prize."* An
+ * auditable random allocation is worth nothing if the seller can edit the
+ * result afterwards.
+ *
+ * The allocation engine (`clearanceAssignWinner`) is unaffected: it writes the
+ * array through a Firestore transaction on the raw document and never passes
+ * through this action layer. This guard therefore constrains exactly the
+ * human-reachable paths, which is the intent — the engine is the only writer
+ * of `isWon`.
+ *
+ * ## Compares VALUES, never key presence
+ *
+ * Same reasoning as `assertCollectorDropTermsMutable`: the seller editor
+ * round-trips the whole array, so every save resubmits each item unchanged.
+ * Rejecting on presence would make a draw with one won prize entirely
+ * unsaveable and the seller could not fix so much as a typo on an unwon row.
  */
-export declare function assertPrizeDrawWonItemsImmutable(currentProduct: Pick<ProductDocument, "prizeDrawItems">, input: unknown): void;
+export declare function assertClearanceWonItemsImmutable(currentProduct: Pick<ProductDocument, "prizeDrawItems">, input: unknown): void;
 /**
- * Anti-scam guard — an auction's economic terms (starting bid, reserve, close
+ * Anti-scam guard — a collector drop's economic terms (starting bid, reserve, close
  * time) stop being editable the moment a real bid exists. Moving the goalposts
- * under a live bidder is the one auction edit that must never pass.
+ * under a live bidder is the one collector drop edit that must never pass.
  *
  * 🛑 It compares VALUES, not key presence. The seller editor round-trips the
- * whole draft, so every save resubmits `startingBid` and `auctionEndDate`
- * unchanged — rejecting on presence alone would make a live auction entirely
+ * whole draft, so every save resubmits `startingBid` and `collectorDropEndDate`
+ * unchanged — rejecting on presence alone would make a live collector drop entirely
  * unsaveable, and the seller could no longer fix so much as a typo.
  */
-export declare function assertAuctionTermsMutable(existing: Pick<ProductDocument, "listingType" | "bidsHaveStarted" | "bidCount" | "startingBid" | "reservePrice" | "auctionEndDate">, input: unknown): void;
+export declare function assertCollectorDropTermsMutable(existing: Pick<ProductDocument, "listingType" | "bidsHaveStarted" | "bidCount" | "startingBid" | "reservePrice" | "collectorDropEndDate">, input: unknown): void;
 /** Assert the product has available stock for a purchase. */
 export declare function assertInStock(product: ProductDocument, quantity?: number): void;
-/** Derive effective price (respects currentBid for auctions, base price otherwise). */
+/** Derive effective price (respects currentBid for collector drops, base price otherwise). */
 export declare function effectivePrice(product: ProductDocument): number;
 /** Compute whether a product is still available for purchase. */
 export declare function isAvailableForPurchase(product: ProductDocument): boolean;

package/dist/_internal/server/features/products/service.js

@@ -1,5 +1,5 @@
 import { productRepository } from "../../../../features/products/repository/products.repository.js";
-import { isAuctionListing, isPreOrderListing, } from "../../../../features/products/utils/listing-type.js";
+import { isCollectorDropListing, isPreOrderListing, } from "../../../../features/products/utils/listing-type.js";
 import { ProductNotFoundError, ProductOwnershipError, ProductStatusError, ProductStockError, } from "../../../shared/features/products/errors.js";
 import { ValidationError } from "../../../shared/errors/index.js";
 const ALLOWED_STATUS_TRANSITIONS = {
@@ -27,35 +27,78 @@ export function assertStatusTransition(from, to) {
     }
 }
 /**
- * Anti-scam guard — once a prize draw has at least one paid entry, the
+ * Anti-scam guard — once a clearance draw has at least one paid entry, the
  * seller can no longer take it down (unpublish/archive/delete). Prevents a
  * seller from dodging shipment of an expensive won prize by pulling the
  * listing after the fact.
  */
-export function assertPrizeDrawNotLocked(product, action) {
-    if ((product.listingType ?? "standard") !== "prize-draw")
+export function assertClearanceNotLocked(product, action) {
+    if ((product.listingType ?? "standard") !== "clearance")
         return;
     if ((product.prizeCurrentEntries ?? 0) <= 0)
         return;
-    throw new ValidationError(`This prize draw has active entries and cannot be ${action} — buyers have already purchased tickets. The draw must run its course.`);
+    throw new ValidationError(`This clearance draw has active entries and cannot be ${action} — buyers have already purchased tickets. The draw must run its course.`);
 }
 /**
- * Anti-scam guard — once a prize item has been won, its title/images/
- * description/condition/estimatedValue become immutable server-side (the
- * client editor already locks this visually via PrizeDrawItemsEditor's
- * `locked` state, but that's UI-only — this is the enforcement). Prevents a
- * seller from swapping in a cheaper item after a buyer has already won.
+ * Anti-scam guard — a won prize item is immutable, and **no seller may set or
+ * clear an allocation.**
+ *
+ * The client editor also locks won rows visually (`ClearanceItemsEditor`'s
+ * `locked` state), but that is UI-only; this is the enforcement, and it runs
+ * on all three product-update paths (seller action, admin action, API).
+ *
+ * ## 🛑 Three holes this closes (found auditing 1.35, 2026-11-07)
+ *
+ * The original guard only compared the DESCRIPTIVE fields of items that were
+ * already `isWon` in the stored document. `isWon` and `wonByOrderId` — the
+ * allocation itself — were accepted straight from seller input
+ * (`prizeDrawItems[].isWon` is `z.boolean()` in the product input schema), and
+ * the loop skipped anything it could not match. So a seller could:
+ *
+ *  1. **Delete a won item.** `if (!incoming) continue` passed a payload that
+ *     simply omitted prize #3 — the won prize left the pool entirely, taking
+ *     the record of what the buyer was owed with it. This was the worst of the
+ *     three, because it looked like the guard's "unchanged" case.
+ *  2. **Un-win a won item** by sending `isWon: false`, freeing an
+ *     already-allocated prize to be handed to someone else.
+ *  3. **Invent a win** by sending `isWon: true` (and any `wonByOrderId`) on an
+ *     item the platform never picked — removing it from the RNG's candidate
+ *     pool, or making an order appear to have won something it did not.
+ *
+ * Every one of those defeats the stated purpose of the mechanic: *"no seller
+ * can say you got a trash item when in reality you got the prize."* An
+ * auditable random allocation is worth nothing if the seller can edit the
+ * result afterwards.
+ *
+ * The allocation engine (`clearanceAssignWinner`) is unaffected: it writes the
+ * array through a Firestore transaction on the raw document and never passes
+ * through this action layer. This guard therefore constrains exactly the
+ * human-reachable paths, which is the intent — the engine is the only writer
+ * of `isWon`.
+ *
+ * ## Compares VALUES, never key presence
+ *
+ * Same reasoning as `assertCollectorDropTermsMutable`: the seller editor
+ * round-trips the whole array, so every save resubmits each item unchanged.
+ * Rejecting on presence would make a draw with one won prize entirely
+ * unsaveable and the seller could not fix so much as a typo on an unwon row.
  */
-export function assertPrizeDrawWonItemsImmutable(currentProduct, input) {
+export function assertClearanceWonItemsImmutable(currentProduct, input) {
     if (!Array.isArray(input))
         return;
     const current = currentProduct.prizeDrawItems ?? [];
+    const incomingItems = input;
     for (const currentItem of current) {
         if (!currentItem.isWon)
             continue;
-        const incoming = input.find((it) => it.itemNumber === currentItem.itemNumber);
-        if (!incoming)
-            continue;
+        const incoming = incomingItems.find((it) => it.itemNumber === currentItem.itemNumber);
+        /*
+         * 🛑 THROW on a missing row, do not `continue`. Omitting a won item is a
+         * deletion, and it was the one edit that passed the old guard untouched.
+         */
+        if (!incoming) {
+            throw new ValidationError(`Prize #${currentItem.itemNumber} has already been won and cannot be removed from the draw.`);
+        }
         const changed = incoming.title !== currentItem.title ||
             incoming.description !== currentItem.description ||
             incoming.condition !== currentItem.condition ||
@@ -64,20 +107,43 @@ export function assertPrizeDrawWonItemsImmutable(currentProduct, input) {
         if (changed) {
             throw new ValidationError(`Prize #${currentItem.itemNumber} has already been won and can no longer be edited.`);
         }
+        /*
+         * The allocation fields, checked separately from the descriptive ones so
+         * the refusal says what was actually attempted. Un-winning or re-pointing
+         * a win is tampering with the result, not an edit to a listing.
+         */
+        if (incoming.isWon !== currentItem.isWon ||
+            (incoming.wonByOrderId ?? null) !== (currentItem.wonByOrderId ?? null)) {
+            throw new ValidationError(`Prize #${currentItem.itemNumber} has already been allocated to a buyer. Allocations are recorded by the platform and cannot be changed.`);
+        }
+    }
+    /*
+     * 🛑 And the inverse direction: nothing may become won through this path.
+     * Only `clearanceAssignWinner` marks a win, so any incoming `isWon: true`
+     * on an item the stored document does not already have won is a forged
+     * allocation — including on a brand-new item number.
+     */
+    for (const incoming of incomingItems) {
+        if (!incoming.isWon && !incoming.wonByOrderId)
+            continue;
+        const stored = current.find((it) => it.itemNumber === incoming.itemNumber);
+        if (stored?.isWon)
+            continue; // equality already verified above
+        throw new ValidationError(`Prize #${incoming.itemNumber} cannot be marked as won. Winners are drawn by the platform, never set by hand.`);
     }
 }
 /**
- * Anti-scam guard — an auction's economic terms (starting bid, reserve, close
+ * Anti-scam guard — a collector drop's economic terms (starting bid, reserve, close
  * time) stop being editable the moment a real bid exists. Moving the goalposts
- * under a live bidder is the one auction edit that must never pass.
+ * under a live bidder is the one collector drop edit that must never pass.
  *
  * 🛑 It compares VALUES, not key presence. The seller editor round-trips the
- * whole draft, so every save resubmits `startingBid` and `auctionEndDate`
- * unchanged — rejecting on presence alone would make a live auction entirely
+ * whole draft, so every save resubmits `startingBid` and `collectorDropEndDate`
+ * unchanged — rejecting on presence alone would make a live collector drop entirely
  * unsaveable, and the seller could no longer fix so much as a typo.
  */
-export function assertAuctionTermsMutable(existing, input) {
-    if ((existing.listingType ?? "standard") !== "auction")
+export function assertCollectorDropTermsMutable(existing, input) {
+    if ((existing.listingType ?? "standard") !== "collector-drop")
         return;
     const bidding = existing.bidsHaveStarted === true || (existing.bidCount ?? 0) > 0;
     if (!bidding)
@@ -96,11 +162,11 @@ export function assertAuctionTermsMutable(existing, input) {
         changed.push("starting bid");
     if ("reservePrice" in patch && patch.reservePrice !== existing.reservePrice)
         changed.push("reserve price");
-    if ("auctionEndDate" in patch &&
-        time(patch.auctionEndDate) !== time(existing.auctionEndDate))
+    if ("collectorDropEndDate" in patch &&
+        time(patch.collectorDropEndDate) !== time(existing.collectorDropEndDate))
         changed.push("end date");
     if (changed.length > 0) {
-        throw new ValidationError(`Bidding has already started on this auction, so its ${changed.join(" and ")} can no longer be changed. Everything else on the listing is still editable.`);
+        throw new ValidationError(`Bidding has already started on this collector drop, so its ${changed.join(" and ")} can no longer be changed. Everything else on the listing is still editable.`);
     }
 }
 /** Assert the product has available stock for a purchase. */
@@ -109,9 +175,9 @@ export function assertInStock(product, quantity = 1) {
         throw new ProductStockError(`Requested quantity ${quantity} exceeds available stock ${product.availableQuantity ?? 0}`);
     }
 }
-/** Derive effective price (respects currentBid for auctions, base price otherwise). */
+/** Derive effective price (respects currentBid for collector drops, base price otherwise). */
 export function effectivePrice(product) {
-    if (isAuctionListing(product) && product.currentBid)
+    if (isCollectorDropListing(product) && product.currentBid)
         return product.currentBid;
     return product.price;
 }
@@ -121,10 +187,10 @@ export function isAvailableForPurchase(product) {
         return false;
     if (product.isSold)
         return false;
-    if (isAuctionListing(product)) {
-        const endDate = product.auctionEndDate instanceof Date
-            ? product.auctionEndDate
-            : product.auctionEndDate ? new Date(product.auctionEndDate) : null;
+    if (isCollectorDropListing(product)) {
+        const endDate = product.collectorDropEndDate instanceof Date
+            ? product.collectorDropEndDate
+            : product.collectorDropEndDate ? new Date(product.collectorDropEndDate) : null;
         return endDate ? endDate.getTime() > Date.now() : false;
     }
     if (isPreOrderListing(product))

package/dist/_internal/server/features/scams/og.d.ts

@@ -1,5 +1,5 @@
 import type { ReactElement } from "react";
-import type { JsonArray } from "@mohasinac/appkit";
+import type { JsonArray } from "../../../../schemas/types";
 export interface ScamOgData {
     displayName: string;
     scamTypeLabel: string;

package/dist/_internal/server/features/search/entity-index.d.ts

@@ -0,0 +1,14 @@
+export type EntitySearchType = "category" | "brand" | "franchise";
+export interface EntitySearchEntry {
+    id: string;
+    label: string;
+    type: EntitySearchType;
+    href: string;
+}
+/**
+ * Cached per `getFlagSnapshot()`'s own precedent — an admin convenience
+ * feature, not buyer-facing, so a few minutes of staleness after a rename
+ * is an acceptable trade for not re-reading ~1,221 docs on every palette
+ * open. Dev-bypassed so a local taxonomy edit is seen immediately.
+ */
+export declare function getEntitySearchIndex(): Promise<EntitySearchEntry[]>;