@mohasinac/appkit 4.71.2 → 4.73.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.71.2",
-  "head": "2f712f0de777c8205b4dd33037754c70c5d9074d",
+  "version": "4.73.0",
+  "head": "be53458929a89f0a763476ca3082d1bfe65b3bcb",
   "branch": "main",
   "dirty": true,
-  "builtAt": "2026-11-08T17:02:06.024Z"
+  "builtAt": "2026-11-09T00:57:51.740Z"
 }

package/dist/_internal/server/features/seo/sitemap.d.ts

@@ -1,5 +1,62 @@
 import type { MetadataRoute } from "next";
+/**
+ * Every section this builder can emit. The names are the same keys the
+ * per-section count digest logs and `scripts/deploy.mjs` asserts against, so
+ * there is one vocabulary for "which part of the sitemap".
+ */
+export declare const SITEMAP_SECTIONS: readonly ["static", "category", "brand", "franchise", "bundle", "group", "blog", "product", "collectorDrop", "preOrder", "clearance", "classified", "digitalCode", "live", "event", "store", "scammer"];
+export type SitemapSection = (typeof SITEMAP_SECTIONS)[number];
 export interface SitemapOptions {
     baseUrl: string;
+    /**
+     * Emit ONLY these sections. Omit for all of them, which is what the main
+     * shop wants.
+     *
+     * ## 🛑 Why this exists, and why it is not a nice-to-have
+     *
+     * The blog and events surfaces now live on their own deployments
+     * (`blogs.`/`events.`). Each needs a sitemap carrying **its own** URLs on
+     * **its own** host, and the shop needs to stop advertising them — because the
+     * moment the shop 301s `/blog/*` to the subdomain, every `/blog` URL left in
+     * the shop's sitemap becomes a redirecting entry.
+     *
+     * That is not a hypothetical. This file's own note at the `disabledRoutes`
+     * filter records the measured version: on 2026-10-27 the production sitemap
+     * advertised **17 `/blog` URLs and one `/reviews` URL** that already 404'd at
+     * the edge — 18 crawl errors on pages we had explicitly asked Google to
+     * fetch. And `seo.server.ts` in the consumer records the worse outcome, when
+     * half the URL surface followed one host and half another: *every URL in the
+     * sitemap 307-redirected and Google dropped the site.*
+     *
+     * So a host must be able to say "my sitemap is these sections and nothing
+     * else", and the two halves must be derived from one list rather than two
+     * hand-maintained ones. Hence an allowlist here instead of a second sitemap
+     * builder in each extracted app.
+     *
+     * 🛑 A section NOT selected is not fetched at all — the point is to avoid the
+     * Firestore reads too, not merely to filter the result. A subdomain querying
+     * the entire product catalogue to throw it away would make every sitemap
+     * request pay for sixteen collections it never emits.
+     *
+     * 🛑 `static` is a section like any other, so an allowlist that omits it
+     * emits no static pages. That is deliberate: the shop's static pages
+     * (`/about`, `/contact`, the browse routes) belong to the shop, and a
+     * subdomain advertising them under its own host would be inventing URLs that
+     * do not exist there.
+     */
+    sections?: readonly SitemapSection[];
+    /**
+     * Emit everything EXCEPT these. Mutually exclusive with `sections` in
+     * practice; if both are given, `sections` is applied first and this narrows
+     * it further.
+     *
+     * This is the shop's half of the split — `excludeSections: ["blog", "event"]`
+     * — and it is spelled as an exclusion rather than a 15-name allowlist so that
+     * a NEW section added to this file is carried by the shop automatically. An
+     * allowlist there would silently drop the next surface somebody adds, which
+     * is the same "measured as empty → looks intentional" failure the digest
+     * below exists to catch.
+     */
+    excludeSections?: readonly SitemapSection[];
 }
-export declare function buildSitemap({ baseUrl }: SitemapOptions): Promise<MetadataRoute.Sitemap>;
+export declare function buildSitemap({ baseUrl, sections: only, excludeSections, }: SitemapOptions): Promise<MetadataRoute.Sitemap>;

package/dist/_internal/server/features/seo/sitemap.js

@@ -67,6 +67,30 @@ function sitemapSectionFailed(label, err) {
     serverLogger.error(`sitemap: section "${label}" failed and returned 0 URLs`, { section: label, error: err });
     return [];
 }
+/**
+ * Every section this builder can emit. The names are the same keys the
+ * per-section count digest logs and `scripts/deploy.mjs` asserts against, so
+ * there is one vocabulary for "which part of the sitemap".
+ */
+export const SITEMAP_SECTIONS = [
+    "static",
+    "category",
+    "brand",
+    "franchise",
+    "bundle",
+    "group",
+    "blog",
+    "product",
+    "collectorDrop",
+    "preOrder",
+    "clearance",
+    "classified",
+    "digitalCode",
+    "live",
+    "event",
+    "store",
+    "scammer",
+];
 /**
  * Read every document a query matches, in pages.
  *
@@ -512,26 +536,39 @@ async function fetchScammerUrls(baseUrl) {
         return sitemapSectionFailed("scammer", err);
     }
 }
-export async function buildSitemap({ baseUrl }) {
+export async function buildSitemap({ baseUrl, sections: only, excludeSections, }) {
+    /*
+     * Which sections this host emits. See `SitemapOptions.sections` for why a
+     * host must be able to answer this at all.
+     *
+     * 🛑 `wants()` gates the FETCH, not the output. An unselected section issues
+     * no Firestore query — a subdomain must not pay for sixteen collections it
+     * throws away on every sitemap request.
+     */
+    const excluded = new Set(excludeSections ?? []);
+    const allowed = only ? new Set(only) : null;
+    const wants = (s) => !excluded.has(s) && (allowed === null || allowed.has(s));
+    /** `[]` for a section this host does not emit, without running its query. */
+    const ifWanted = (s, run) => wants(s) ? run() : Promise.resolve([]);
     const [productUrls, categoryUrls, brandUrls, franchiseUrls, bundleUrls, groupedListingUrls, eventUrls, blogUrls, collectorDropUrls, preOrderUrls, clearanceUrls, classifiedUrls, digitalCodeUrls, liveUrls, storeUrls, scammerUrls,] = await Promise.all([
-        fetchProductUrls(baseUrl),
-        fetchCategoryUrls(baseUrl),
-        fetchBrandUrls(baseUrl),
-        fetchFranchiseUrls(baseUrl),
-        fetchBundleUrls(baseUrl),
-        fetchGroupedListingUrls(baseUrl),
-        fetchEventUrls(baseUrl),
-        fetchBlogPostUrls(baseUrl),
-        fetchCollectorDropUrls(baseUrl),
-        fetchPreOrderUrls(baseUrl),
-        fetchClearanceUrls(baseUrl),
-        fetchClassifiedUrls(baseUrl),
-        fetchDigitalCodeUrls(baseUrl),
-        fetchLiveUrls(baseUrl),
-        fetchStoreUrls(baseUrl),
-        fetchScammerUrls(baseUrl),
+        ifWanted("product", () => fetchProductUrls(baseUrl)),
+        ifWanted("category", () => fetchCategoryUrls(baseUrl)),
+        ifWanted("brand", () => fetchBrandUrls(baseUrl)),
+        ifWanted("franchise", () => fetchFranchiseUrls(baseUrl)),
+        ifWanted("bundle", () => fetchBundleUrls(baseUrl)),
+        ifWanted("group", () => fetchGroupedListingUrls(baseUrl)),
+        ifWanted("event", () => fetchEventUrls(baseUrl)),
+        ifWanted("blog", () => fetchBlogPostUrls(baseUrl)),
+        ifWanted("collectorDrop", () => fetchCollectorDropUrls(baseUrl)),
+        ifWanted("preOrder", () => fetchPreOrderUrls(baseUrl)),
+        ifWanted("clearance", () => fetchClearanceUrls(baseUrl)),
+        ifWanted("classified", () => fetchClassifiedUrls(baseUrl)),
+        ifWanted("digitalCode", () => fetchDigitalCodeUrls(baseUrl)),
+        ifWanted("live", () => fetchLiveUrls(baseUrl)),
+        ifWanted("store", () => fetchStoreUrls(baseUrl)),
+        ifWanted("scammer", () => fetchScammerUrls(baseUrl)),
     ]);
-    const staticUrls = staticPages(baseUrl);
+    const staticUrls = wants("static") ? staticPages(baseUrl) : [];
     // Per-section count digest. A section that drops to zero is otherwise
     // indistinguishable from a site that genuinely has none of that thing — which
     // is exactly how `category: 0` survived unnoticed while every other section
@@ -715,6 +752,28 @@ export async function buildSitemap({ baseUrl }) {
         if (page && closed.has(page))
             sections[name] = 0;
     }
+    /*
+     * 🛑 A section this host does not EMIT is dropped from the digest entirely,
+     * not reported as zero.
+     *
+     * The comment above this block is the reason, and it was written about the
+     * `closed` case: *"a warning that fires every build for a reason everyone
+     * knows about is how the next real zero gets ignored. 'Closed on purpose'
+     * and 'broken' must not look the same in the log."* Section scoping is the
+     * same hazard one axis over — without this, the blogs deployment would warn
+     * about fifteen empty sections on every single sitemap request, and the shop
+     * would warn about `blog` and `event` forever. Two permanent false alarms is
+     * how the alarm stops being read.
+     *
+     * Deleting the key rather than zeroing it also keeps the digest honest for
+     * `scripts/deploy.mjs`, which asserts these counts against the deployed
+     * sitemap: a section that is absent from the response should be absent here
+     * too, not present-and-zero.
+     */
+    for (const name of Object.keys(sections)) {
+        if (!wants(name))
+            delete sections[name];
+    }
     const empty = Object.entries(sections)
         .filter(([name, n]) => n === 0 && !closed.has(sectionPage[name]))
         .map(([name]) => name);
@@ -724,6 +783,18 @@ export async function buildSitemap({ baseUrl }) {
             closed: [...closed],
         });
     }
+    /*
+     * Logged so a host's scope is visible in production, not just in its source.
+     * "Why is /blog missing from the sitemap" is otherwise answerable only by
+     * reading the caller.
+     */
+    if (only || excludeSections?.length) {
+        serverLogger.info("sitemap: section scope applied", {
+            ...(only ? { only: [...only] } : {}),
+            ...(excludeSections?.length ? { excluded: [...excludeSections] } : {}),
+            emitting: Object.keys(sections),
+        });
+    }
     if (empty.length > 0) {
         serverLogger.warn(`sitemap: ${empty.length} section(s) produced 0 URLs`, { empty, sections, total });
     }

package/dist/constants/api-endpoints.d.ts

@@ -450,6 +450,7 @@ export declare const EVENT_ENDPOINTS: {
     readonly LIST: "/api/events";
     readonly BY_ID: (id: string) => string;
     readonly ENTRIES: (id: string) => string;
+    readonly ENTRY_VOTE: (id: string, entryId: string) => string;
     readonly LEADERBOARD: (id: string, limit?: number) => string;
     readonly SPIN: (id: string) => string;
     /**
@@ -1046,6 +1047,7 @@ export declare const API_ENDPOINTS: {
         readonly LIST: "/api/events";
         readonly BY_ID: (id: string) => string;
         readonly ENTRIES: (id: string) => string;
+        readonly ENTRY_VOTE: (id: string, entryId: string) => string;
         readonly LEADERBOARD: (id: string, limit?: number) => string;
         readonly SPIN: (id: string) => string;
         /**
@@ -1660,6 +1662,7 @@ export declare const API_ROUTES: {
         readonly LIST: "/api/events";
         readonly BY_ID: (id: string) => string;
         readonly ENTRIES: (id: string) => string;
+        readonly ENTRY_VOTE: (id: string, entryId: string) => string;
         readonly LEADERBOARD: (id: string, limit?: number) => string;
         readonly SPIN: (id: string) => string;
         /**

package/dist/constants/api-endpoints.js

@@ -569,6 +569,12 @@ export const EVENT_ENDPOINTS = {
     LIST: "/api/events",
     BY_ID: (id) => `/api/events/${id}`,
     ENTRIES: (id) => `/api/events/${id}/entries`,
+    /*
+     * Voting on a contest entry. The response carries COUNTS only — the voter
+     * list is admin-only and comes from a different handler, so a public caller
+     * cannot reach it by changing a query string.
+     */
+    ENTRY_VOTE: (id, entryId) => `/api/events/${id}/entries/${entryId}/vote`,
     LEADERBOARD: (id, limit) => `/api/events/${id}/leaderboard${limit !== undefined ? `?limit=${limit}` : ""}`,
     // SB9-E user spin assignment
     SPIN: (id) => `/api/events/${id}/spin`,

package/dist/features/classified/components/ClassifiedDetailPageView.js

@@ -18,7 +18,7 @@ import { Heading, Span, Text } from "../../../ui/components/Typography.js";
 import { Main, Nav, Section } from "../../../ui/components/Semantic.js";
 import { RichText } from "../../../ui/rich-text/RichText.js";
 import { SpecTable } from "../../../ui/components/SpecTable.js";
-import { PreOrderDetailView } from "../../products/components/PreOrderDetailView.js";
+import { ListingDetailShell } from "../../../ui/components/ListingDetailShell.js";
 import { ProductGalleryClient } from "../../products/components/ProductGalleryClient.js";
 import { ProductTabsShell } from "../../products/components/ProductTabsShell.js";
 import { toCustomSectionTabs } from "../../products/components/CustomSectionTabContent.js";
@@ -127,7 +127,7 @@ export async function ClassifiedDetailPageView({ slug, initialProduct, renderOff
                     price: price ?? undefined,
                     storeId: typeof p.storeId === "string" ? p.storeId : undefined,
                     storeName: storeName ?? undefined,
-                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CLASSIFIED), className: CLS_BREADCRUMB_LINK, children: "Classifieds" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(PreOrderDetailView, { renderGallery: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "gallery", initialVisible: pdpSectionVisibility.gallery !== false, children: _jsx(ProductGalleryClient, { images: images, productName: title }) })), renderInfo: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "info", initialVisible: pdpSectionVisibility.info !== false, children: _jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_CLASSIFIED_BADGE, children: "Classified" }), meta?.negotiable && (_jsx(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: "Negotiable" })), meta?.acceptsShipping && (_jsx(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: "Shipping available" }))] }), _jsx(OwnerQuickActions, { resource: "PRODUCT", placement: "detail", recordLabel: String(p.title ?? p.slug ?? p.id), storeId: p.storeId ? String(p.storeId) : undefined, editHref: String(ROUTES.STORE.PRODUCTS_EDIT(String(p.id))) }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), price !== null && (_jsx(Text, { size: "2xl", weight: "bold", color: "primary", children: _jsx(GatedPrice, { children: formatCurrency(price, currency) }) })), location && (_jsxs(Row, { color: "muted", textSize: "sm", align: "center", gap: "xs", children: [_jsx(Span, { children: "\uD83D\uDCCD" }), _jsx(Span, { children: location }), meta?.meetupArea?.pincode && _jsxs(Span, { children: ["\u00B7 ", meta.meetupArea.pincode] })] })), descriptionHtml && (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" })), safeSeller && (_jsx(Div, { border: "subtle", rounded: "xl", surface: "muted", padding: "md", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Sold by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && (_jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" }))] }) }))] }) })), renderTabs: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "tabs", initialVisible: pdpSectionVisibility.tabs !== false, children: _jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(SpecTable, { rows: specs })) : undefined, customTabs: toCustomSectionTabs(p.customSections) }) })), renderBuyBar: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "actions", initialVisible: pdpSectionVisibility.actions !== false, children: _jsx(Stack, { id: "classified-contact-bar", className: "p-[var(--appkit-space-5)]", border: "subtle", gap: "md", rounded: "xl", surface: "muted", children: !hasOfferSlotOverride &&
+                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CLASSIFIED), className: CLS_BREADCRUMB_LINK, children: "Classifieds" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(ListingDetailShell, { layout: "grid-2", renderGallery: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "gallery", initialVisible: pdpSectionVisibility.gallery !== false, children: _jsx(ProductGalleryClient, { images: images, productName: title }) })), renderInfo: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "info", initialVisible: pdpSectionVisibility.info !== false, children: _jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_CLASSIFIED_BADGE, children: "Classified" }), meta?.negotiable && (_jsx(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: "Negotiable" })), meta?.acceptsShipping && (_jsx(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: "Shipping available" }))] }), _jsx(OwnerQuickActions, { resource: "PRODUCT", placement: "detail", recordLabel: String(p.title ?? p.slug ?? p.id), storeId: p.storeId ? String(p.storeId) : undefined, editHref: String(ROUTES.STORE.PRODUCTS_EDIT(String(p.id))) }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), price !== null && (_jsx(Text, { size: "2xl", weight: "bold", color: "primary", children: _jsx(GatedPrice, { children: formatCurrency(price, currency) }) })), location && (_jsxs(Row, { color: "muted", textSize: "sm", align: "center", gap: "xs", children: [_jsx(Span, { children: "\uD83D\uDCCD" }), _jsx(Span, { children: location }), meta?.meetupArea?.pincode && _jsxs(Span, { children: ["\u00B7 ", meta.meetupArea.pincode] })] })), descriptionHtml && (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" })), safeSeller && (_jsx(Div, { border: "subtle", rounded: "xl", surface: "muted", padding: "md", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Sold by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && (_jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" }))] }) }))] }) })), renderTabs: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "tabs", initialVisible: pdpSectionVisibility.tabs !== false, children: _jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(SpecTable, { rows: specs })) : undefined, customTabs: toCustomSectionTabs(p.customSections) }) })), renderAside: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "actions", initialVisible: pdpSectionVisibility.actions !== false, children: _jsx(Stack, { id: "classified-contact-bar", className: "p-[var(--appkit-space-5)]", border: "subtle", gap: "md", rounded: "xl", surface: "muted", children: !hasOfferSlotOverride &&
                                     (offerActionNode ?? (
                                     /*
                                      * Reachable only when the listing has no price at all: a

package/dist/features/digital-codes/components/DigitalCodeDetailPageView.js

@@ -18,7 +18,7 @@ import { Heading, Span, Text } from "../../../ui/components/Typography.js";
 import { Main, Nav, Section } from "../../../ui/components/Semantic.js";
 import { RichText } from "../../../ui/rich-text/RichText.js";
 import { SpecTable } from "../../../ui/components/SpecTable.js";
-import { PreOrderDetailView } from "../../products/components/PreOrderDetailView.js";
+import { ListingDetailShell } from "../../../ui/components/ListingDetailShell.js";
 import { ProductGalleryClient } from "../../products/components/ProductGalleryClient.js";
 import { ProductTabsShell } from "../../products/components/ProductTabsShell.js";
 import { toCustomSectionTabs } from "../../products/components/CustomSectionTabContent.js";
@@ -101,5 +101,5 @@ export async function DigitalCodeDetailPageView({ slug, initialProduct, renderPr
                     price: price ?? undefined,
                     storeId: typeof p.storeId === "string" ? p.storeId : undefined,
                     storeName: storeName ?? undefined,
-                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.DIGITAL_CODES), className: CLS_BREADCRUMB_LINK, children: "Digital Codes" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(PreOrderDetailView, { renderGallery: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "gallery", initialVisible: pdpSectionVisibility.gallery !== false, children: _jsx(ProductGalleryClient, { images: images, productName: title }) })), renderInfo: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "info", initialVisible: pdpSectionVisibility.info !== false, children: _jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_DIGITALCODE_BADGE, children: "Digital Code" }), codesLeft > 0 ? (_jsxs(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: [codesLeft, " available"] })) : (_jsx(Span, { size: "xs", weight: "semibold", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "danger-surface", color: "error", children: "Sold out" }))] }), _jsx(OwnerQuickActions, { resource: "PRODUCT", placement: "detail", recordLabel: String(p.title ?? p.slug ?? p.id), storeId: p.storeId ? String(p.storeId) : undefined, editHref: String(ROUTES.STORE.PRODUCTS_EDIT(String(p.id))) }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), price !== null && (_jsx(Text, { size: "2xl", weight: "bold", color: "primary", children: _jsx(GatedPrice, { children: formatCurrency(price, currency) }) })), meta?.redemptionInstructions && (_jsx(Text, { size: "xs", color: "muted", children: meta.redemptionInstructions })), descriptionHtml && (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" })), safeSeller && (_jsx(Div, { border: "subtle", rounded: "xl", surface: "muted", padding: "md", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Sold by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && (_jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" }))] }) }))] }) })), renderTabs: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "tabs", initialVisible: pdpSectionVisibility.tabs !== false, children: _jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(SpecTable, { rows: specs })) : undefined, reviewsContent: _jsx(ReviewsListingPanel, { source: { kind: "product", productId: product.id }, stateMode: "local", context: "listing", initialData: initialReviews, emptyLabel: "No reviews yet \u2014 be the first to review this product." }), customTabs: toCustomSectionTabs(p.customSections) }) })), renderBuyBar: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "actions", initialVisible: pdpSectionVisibility.actions !== false, children: _jsx(Div, { id: "digital-code-buy-bar", children: !hasPrimaryActionsSlotOverride && primaryActionsNode }) })), renderRelated: () => (_jsxs(Stack, { gap: "xl", children: [_jsx(PurchaseReviewAffordance, { productId: String(product.id), storeId: product.storeId ? String(product.storeId) : undefined }), _jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "grouped-listings", initialVisible: pdpSectionVisibility["grouped-listings"] !== false, children: _jsx(GroupedListingsCarousel, { groups: groups }) }), _jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "related", initialVisible: pdpSectionVisibility.related !== false, children: _jsx(RelatedItemsSection, { relatedItems: relatedItems, relatedByBrand: relatedByBrand, relatedByTags: relatedByTags, relatedByStore: relatedByStore, categoryLabel: categoryName || category || undefined, brandLabel: brand, storeLabel: storeName ?? undefined }) })] })) }), _jsx(Div, { className: "mt-8", children: _jsx(AdminComposableRegion, { pageId: "digital-codes-slug", initialCards: pageRegionCards, functionalSlots: { "pdp-primary-actions": primaryActionsNode } }) }), _jsx(ListingBottomActions, { listingType: "digital-code", anchorId: "digital-code-buy-bar", price: price, currency: currency, unavailable: codesLeft <= 0 })] })] }));
+                } }), _jsxs(Container, { size: "xl", padding: "y-lg", children: [_jsxs(Row, { className: "mb-4", align: "center", justify: "between", gap: "sm", wrap: true, children: [_jsxs(Nav, { "aria-label": "Breadcrumb", layout: "flex-wrap", gap: "2xs", textSize: "xs", color: "muted", children: [_jsx(Link, { href: String(ROUTES.HOME), className: CLS_BREADCRUMB_LINK, children: "Home" }), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.DIGITAL_CODES), className: CLS_BREADCRUMB_LINK, children: "Digital Codes" }), category && (_jsxs(_Fragment, { children: [_jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Link, { href: String(ROUTES.PUBLIC.CATEGORY_DETAIL(category)), className: CLS_BREADCRUMB_LINK, children: categoryName || category })] })), _jsx(Span, { "aria-hidden": true, children: "/" }), _jsx(Span, { className: "truncate max-w-[200px]", color: "muted", children: title })] }), _jsx(ShareButton, { title: title })] }), _jsx(ListingDetailShell, { layout: "grid-2", renderGallery: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "gallery", initialVisible: pdpSectionVisibility.gallery !== false, children: _jsx(ProductGalleryClient, { images: images, productName: title }) })), renderInfo: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "info", initialVisible: pdpSectionVisibility.info !== false, children: _jsxs(Stack, { gap: "md", children: [_jsxs(Div, { children: [_jsxs(Row, { gap: "xs", wrap: true, className: "mb-2", children: [_jsx(Span, { size: "xs", weight: "semibold", className: CLS_DIGITALCODE_BADGE, children: "Digital Code" }), codesLeft > 0 ? (_jsxs(Span, { size: "xs", weight: "medium", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "subtle", color: "muted", children: [codesLeft, " available"] })) : (_jsx(Span, { size: "xs", weight: "semibold", className: "inline-block", padding: "pill-sm", rounded: "full", surface: "danger-surface", color: "error", children: "Sold out" }))] }), _jsx(OwnerQuickActions, { resource: "PRODUCT", placement: "detail", recordLabel: String(p.title ?? p.slug ?? p.id), storeId: p.storeId ? String(p.storeId) : undefined, editHref: String(ROUTES.STORE.PRODUCTS_EDIT(String(p.id))) }), _jsx(Heading, { level: 1, className: "leading-snug", smSize: "2xl", color: "primary", size: "xl", weight: "bold", children: title })] }), price !== null && (_jsx(Text, { size: "2xl", weight: "bold", color: "primary", children: _jsx(GatedPrice, { children: formatCurrency(price, currency) }) })), meta?.redemptionInstructions && (_jsx(Text, { size: "xs", color: "muted", children: meta.redemptionInstructions })), descriptionHtml && (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm max-w-none dark:prose-invert prose-p:my-0", className: "text-[length:var(--appkit-text-sm)] leading-relaxed text-[var(--appkit-color-text-muted)] line-clamp-4" })), safeSeller && (_jsx(Div, { border: "subtle", rounded: "xl", surface: "muted", padding: "md", children: _jsxs(Row, { justify: "between", align: "center", children: [_jsxs(Div, { children: [_jsx(Text, { className: "text-[10px] tracking-wide mb-0.5", color: "faint", transform: "uppercase", children: "Sold by" }), _jsx(Text, { size: "sm", weight: "semibold", color: "primary", children: safeSeller })] }), storeHref && (_jsx(Link, { href: storeHref, className: "shrink-0 rounded-lg bg-primary/10 dark:bg-primary/20 px-[var(--appkit-space-3)] py-[var(--appkit-space-1-5)] text-[length:var(--appkit-text-xs)] font-semibold text-primary-700 dark:text-primary-300 hover:bg-primary/20 dark:hover:bg-primary/30 transition-colors", children: "Visit Store \u2192" }))] }) }))] }) })), renderTabs: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "tabs", initialVisible: pdpSectionVisibility.tabs !== false, children: _jsx(ProductTabsShell, { descriptionContent: descriptionHtml ? (_jsx(RichText, { html: descriptionHtml, proseClass: "prose prose-sm sm:prose max-w-none dark:prose-invert", className: "text-[var(--appkit-color-text-muted)]" })) : undefined, specsContent: specs.length > 0 ? (_jsx(SpecTable, { rows: specs })) : undefined, reviewsContent: _jsx(ReviewsListingPanel, { source: { kind: "product", productId: product.id }, stateMode: "local", context: "listing", initialData: initialReviews, emptyLabel: "No reviews yet \u2014 be the first to review this product." }), customTabs: toCustomSectionTabs(p.customSections) }) })), renderAside: () => (_jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "actions", initialVisible: pdpSectionVisibility.actions !== false, children: _jsx(Div, { id: "digital-code-buy-bar", children: !hasPrimaryActionsSlotOverride && primaryActionsNode }) })), renderRelated: () => (_jsxs(Stack, { gap: "xl", children: [_jsx(PurchaseReviewAffordance, { productId: String(product.id), storeId: product.storeId ? String(product.storeId) : undefined }), _jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "grouped-listings", initialVisible: pdpSectionVisibility["grouped-listings"] !== false, children: _jsx(GroupedListingsCarousel, { groups: groups }) }), _jsx(SectionVisibilityGate, { surfaceId: "pdp-sections", sectionKey: "related", initialVisible: pdpSectionVisibility.related !== false, children: _jsx(RelatedItemsSection, { relatedItems: relatedItems, relatedByBrand: relatedByBrand, relatedByTags: relatedByTags, relatedByStore: relatedByStore, categoryLabel: categoryName || category || undefined, brandLabel: brand, storeLabel: storeName ?? undefined }) })] })) }), _jsx(Div, { className: "mt-8", children: _jsx(AdminComposableRegion, { pageId: "digital-codes-slug", initialCards: pageRegionCards, functionalSlots: { "pdp-primary-actions": primaryActionsNode } }) }), _jsx(ListingBottomActions, { listingType: "digital-code", anchorId: "digital-code-buy-bar", price: price, currency: currency, unavailable: codesLeft <= 0 })] })] }));
 }

package/dist/features/events/components/EntryVoteButtons.d.ts

@@ -0,0 +1,19 @@
+import type { EntryVoteValue } from "../schemas/entry-votes";
+export interface EntryVoteButtonsProps {
+    likes: number;
+    dislikes: number;
+    /** How the signed-in user has already voted, if at all. */
+    myVote: EntryVoteValue | null;
+    /** From the rule set. When false, no dislike control is rendered at all. */
+    allowsDislike: boolean;
+    /** Signed-out visitors see counts and a prompt, never a dead button. */
+    canVote: boolean;
+    /** Returns the authoritative counts; the component reverts if it throws. */
+    onVote: (value: EntryVoteValue) => Promise<{
+        likes: number;
+        dislikes: number;
+        myVote: EntryVoteValue | null;
+    }>;
+    signInHref?: string;
+}
+export declare function EntryVoteButtons({ likes, dislikes, myVote, allowsDislike, canVote, onVote, signInHref, }: EntryVoteButtonsProps): import("react").JSX.Element;

package/dist/features/events/components/EntryVoteButtons.js

@@ -0,0 +1,65 @@
+"use client";
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+/**
+ * Vote controls for a contest entry.
+ *
+ * 🛑 WHAT RENDERS IS DECIDED BY CONFIG, NOT BY THIS FILE.
+ *
+ * `allowsDislike` comes from the event's `entryRanking` rule set. A like-only
+ * popularity contest and a net-score vote are the same component with a
+ * different rule row — the dislike button is ABSENT, not disabled, when the
+ * rule does not use it, so there is nothing to click and nothing in the DOM.
+ *
+ * 🛑 COUNTS ONLY. This never receives or renders who voted. The voter list is
+ * admin-only and comes from a different handler; the public summary type does
+ * not carry it, so a leak here would be a compile error.
+ *
+ * Optimistic, with a revert. A vote is a single click on a page that may be
+ * showing forty entries, so waiting for a round trip before the number moves
+ * feels broken — but a failed request puts the previous state back rather than
+ * leaving a number the server disagrees with.
+ */
+import { useCallback, useState } from "react";
+import { Button } from "../../../ui/components/Button.js";
+import { Div } from "../../../ui/components/Div.js";
+import { Span } from "../../../ui/components/Typography.js";
+export function EntryVoteButtons({ likes, dislikes, myVote, allowsDislike, canVote, onVote, signInHref, }) {
+    const [state, setState] = useState({ likes, dislikes, myVote });
+    const [busy, setBusy] = useState(false);
+    const cast = useCallback(async (value) => {
+        if (!canVote || busy)
+            return;
+        const previous = state;
+        /*
+         * Mirror the server's own rules so the optimistic number matches what
+         * the transaction will do: pressing the same button again RETRACTS, and
+         * switching sides moves both counters.
+         */
+        const retracting = state.myVote === value;
+        const next = {
+            likes: state.likes +
+                (value === "like" ? (retracting ? -1 : 1) : 0) +
+                (!retracting && state.myVote === "like" ? -1 : 0),
+            dislikes: state.dislikes +
+                (value === "dislike" ? (retracting ? -1 : 1) : 0) +
+                (!retracting && state.myVote === "dislike" ? -1 : 0),
+            myVote: retracting ? null : value,
+        };
+        setState({ ...next, likes: Math.max(0, next.likes), dislikes: Math.max(0, next.dislikes) });
+        setBusy(true);
+        try {
+            // The server's numbers win — it read the row inside a transaction.
+            setState(await onVote(value));
+        }
+        catch {
+            setState(previous);
+        }
+        finally {
+            setBusy(false);
+        }
+    }, [busy, canVote, onVote, state]);
+    if (!canVote) {
+        return (_jsxs(Div, { className: "flex items-center gap-2", children: [_jsxs(Span, { children: ["\u2665 ", state.likes] }), allowsDislike ? _jsxs(Span, { children: ["\u2661 ", state.dislikes] }) : null, signInHref ? (_jsx(Span, { children: _jsx("a", { href: signInHref, children: "Sign in to vote" }) })) : null] }));
+    }
+    return (_jsxs(Div, { className: "flex items-center gap-2", children: [_jsxs(Button, { variant: state.myVote === "like" ? "primary" : "secondary", size: "sm", disabled: busy, onClick: () => void cast("like"), "aria-pressed": state.myVote === "like", "aria-label": state.myVote === "like" ? "Remove your like" : "Like this entry", children: ["\u2665 ", state.likes] }), allowsDislike ? (_jsxs(Button, { variant: state.myVote === "dislike" ? "primary" : "secondary", size: "sm", disabled: busy, onClick: () => void cast("dislike"), "aria-pressed": state.myVote === "dislike", "aria-label": state.myVote === "dislike" ? "Remove your dislike" : "Dislike this entry", children: ["\u2661 ", state.dislikes] })) : null] }));
+}

package/dist/features/events/repository/entry-votes.repository.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Entry votes — cast, change, retract, and summarise.
+ *
+ * See `../schemas/entry-votes.ts` for why the document id is the idempotency
+ * key, why only `userId` is stored on the row, and why ranking is a config
+ * rule rather than arithmetic in this file.
+ *
+ * @tag domain:events
+ * @tag layer:repository
+ * @tag access:server-only
+ */
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type EntryVoteAudit, type EntryVoteSummary, type EntryVoteValue, type EventEntryVoteDocument } from "../schemas/entry-votes";
+export declare class EventEntryVotesRepository extends BaseRepository<EventEntryVoteDocument> {
+    constructor();
+    /**
+     * Cast, change or retract a vote.
+     *
+     * 🛑 ONE TRANSACTION, and the counters are adjusted by the DELTA the vote
+     * actually caused — never by a bare increment beside a bare set. The three
+     * cases differ and each would corrupt the count if treated as one:
+     *
+     *   none  → like      likes +1
+     *   like  → dislike   likes -1 AND dislikes +1   (the case a toggle misses)
+     *   like  → like      retraction: likes -1, row deleted
+     *
+     * Reading the vote row inside the transaction is what makes each adjustment
+     * conditional on the membership really changing, so a double-click or a
+     * replayed request cannot double-count.
+     */
+    cast(eventId: string, entryId: string, userId: string, value: EntryVoteValue): Promise<EntryVoteSummary>;
+    /** How this user voted. One document read — no query, no index. */
+    myVote(entryId: string, userId: string): Promise<EntryVoteValue | null>;
+    /**
+     * ADMIN ONLY — who voted, and which way.
+     *
+     * 🛑 The public path never calls this. `EntryVoteAudit` and
+     * `EntryVoteSummary` are separate, non-overlapping types precisely so a
+     * public handler returning the wrong one is a compile error rather than a
+     * leak of who voted. Owner rule: *"only admins see who voted, rest see
+     * numbers"*.
+     */
+    audit(entryId: string, summary: EntryVoteSummary, max?: number): Promise<EntryVoteAudit>;
+}
+export declare const eventEntryVotesRepository: EventEntryVotesRepository;

package/dist/features/events/repository/entry-votes.repository.js

@@ -0,0 +1,154 @@
+/**
+ * Entry votes — cast, change, retract, and summarise.
+ *
+ * See `../schemas/entry-votes.ts` for why the document id is the idempotency
+ * key, why only `userId` is stored on the row, and why ranking is a config
+ * rule rather than arithmetic in this file.
+ *
+ * @tag domain:events
+ * @tag layer:repository
+ * @tag access:server-only
+ */
+import { normalizeError } from "../../../errors/normalize.js";
+import { DatabaseError } from "../../../errors/index.js";
+import { serverLogger } from "../../../monitoring/index.js";
+import { BaseRepository } from "../../../providers/db-firebase/index.js";
+import { EVENT_ENTRY_VOTES_COLLECTION, EVENT_ENTRY_VOTE_FIELDS, eventEntryVoteId, } from "../schemas/entry-votes.js";
+import { EVENT_ENTRIES_COLLECTION } from "../schemas/firestore.js";
+export class EventEntryVotesRepository extends BaseRepository {
+    constructor() {
+        super(EVENT_ENTRY_VOTES_COLLECTION);
+    }
+    /**
+     * Cast, change or retract a vote.
+     *
+     * 🛑 ONE TRANSACTION, and the counters are adjusted by the DELTA the vote
+     * actually caused — never by a bare increment beside a bare set. The three
+     * cases differ and each would corrupt the count if treated as one:
+     *
+     *   none  → like      likes +1
+     *   like  → dislike   likes -1 AND dislikes +1   (the case a toggle misses)
+     *   like  → like      retraction: likes -1, row deleted
+     *
+     * Reading the vote row inside the transaction is what makes each adjustment
+     * conditional on the membership really changing, so a double-click or a
+     * replayed request cannot double-count.
+     */
+    async cast(eventId, entryId, userId, value) {
+        try {
+            const db = this.db;
+            const voteRef = this.getCollection().doc(eventEntryVoteId(entryId, userId));
+            const entryRef = db.collection(EVENT_ENTRIES_COLLECTION).doc(entryId);
+            return await db.runTransaction(async (tx) => {
+                const [voteSnap, entrySnap] = await Promise.all([tx.get(voteRef), tx.get(entryRef)]);
+                if (!entrySnap.exists) {
+                    // Voting on a deleted entry would strand a row the cascade cannot
+                    // find — the cleanup keys on the entry existing.
+                    throw new DatabaseError(`Entry not found: ${entryId}`);
+                }
+                const counters = entrySnap.data() ?? {};
+                let likes = Number(counters.likeCount ?? 0);
+                let dislikes = Number(counters.dislikeCount ?? 0);
+                const previous = voteSnap.exists
+                    ? voteSnap.data().value
+                    : null;
+                let myVote;
+                const now = new Date();
+                if (previous === value) {
+                    // Same direction twice is a RETRACTION — the second press of a
+                    // pressed button. Matches how the like button already behaves.
+                    tx.delete(voteRef);
+                    if (value === "like")
+                        likes -= 1;
+                    else
+                        dislikes -= 1;
+                    myVote = null;
+                }
+                else {
+                    if (previous === "like")
+                        likes -= 1;
+                    if (previous === "dislike")
+                        dislikes -= 1;
+                    if (value === "like")
+                        likes += 1;
+                    else
+                        dislikes += 1;
+                    tx.set(voteRef, {
+                        eventId,
+                        entryId,
+                        userId,
+                        value,
+                        createdAt: voteSnap.exists
+                            ? (voteSnap.data().createdAt ?? now)
+                            : now,
+                        updatedAt: now,
+                    }, { merge: true });
+                    myVote = value;
+                }
+                /*
+                 * 🛑 Floor at zero, the same call `eventLikes.toggle` makes. A count
+                 * can only go negative if it has drifted — a row removed by a cascade
+                 * without the counter moving — and a public "-1" is worse than an
+                 * understated 0.
+                 */
+                likes = Math.max(0, likes);
+                dislikes = Math.max(0, dislikes);
+                tx.update(entryRef, { likeCount: likes, dislikeCount: dislikes, updatedAt: now });
+                /*
+                 * `score` is NOT computed here. The ranking rule is config
+                 * (`entryRanking` rule sets) and `resolveEntryRanking` is the one
+                 * place it is interpreted — a second formula in a repository is how
+                 * two screens come to disagree about who is winning.
+                 */
+                return { likes, dislikes, score: likes - dislikes, myVote };
+            });
+        }
+        catch (err) {
+            const e = normalizeError(err);
+            serverLogger.error("entryVotes.cast failed", { entryId, userId, value, message: e.message });
+            throw new DatabaseError(`Failed to record vote: ${e.message}`);
+        }
+    }
+    /** How this user voted. One document read — no query, no index. */
+    async myVote(entryId, userId) {
+        try {
+            const snap = await this.getCollection().doc(eventEntryVoteId(entryId, userId)).get();
+            if (!snap.exists)
+                return null;
+            return snap.data().value;
+        }
+        catch (err) {
+            const e = normalizeError(err);
+            serverLogger.error("entryVotes.myVote failed", { entryId, userId, message: e.message });
+            throw new DatabaseError(`Failed to read vote: ${e.message}`);
+        }
+    }
+    /**
+     * ADMIN ONLY — who voted, and which way.
+     *
+     * 🛑 The public path never calls this. `EntryVoteAudit` and
+     * `EntryVoteSummary` are separate, non-overlapping types precisely so a
+     * public handler returning the wrong one is a compile error rather than a
+     * leak of who voted. Owner rule: *"only admins see who voted, rest see
+     * numbers"*.
+     */
+    async audit(entryId, summary, max = 500) {
+        try {
+            const snap = await this.getCollection()
+                .where(EVENT_ENTRY_VOTE_FIELDS.ENTRY_ID, "==", entryId)
+                .limit(max)
+                .get();
+            const voters = snap.docs.map((d) => {
+                const v = d.data();
+                return { userId: v.userId, value: v.value, at: v.updatedAt ?? v.createdAt };
+            });
+            return { ...summary, voters };
+        }
+        catch (err) {
+            const e = normalizeError(err);
+            serverLogger.error("entryVotes.audit failed", { entryId, message: e.message });
+            throw new DatabaseError(`Failed to read voters: ${e.message}`);
+        }
+    }
+}
+export const eventEntryVotesRepository = new EventEntryVotesRepository();