chore: pre-existing uncommitted platform/event changes

event/event.go

@@ -76,7 +76,38 @@ const (
 	TrackPageEngaged    Type = "track.page_engaged"
 	TrackPageAction     Type = "track.page_action"
 	TrackExperiment     Type = "track.experiment"
+// TrackPurchase — cut 23. Post-checkout funnel closure; emitted by
+// event_handlers.go::TrackPurchase on a purchase request. Replaces
+// 5 hand-written `pevent.Type("track.purchase")` literals with this
+// typed constant.
+	TrackPurchase       Type = "track.purchase"
 )
+// KnownTypes lists every event that has a declared Track* constant above.
+// New pevent constants MUST also be added here so IsKnownType stays in
+// sync. Used by HTTP handlers' forward-validation (e.g. SessionsPanel
+// ?event_types= param, cut 25) so caller's typo's surface as a 400
+// rather than silently dropping unknown tokens.
+var KnownTypes = []Type{
+	TrackSession, TrackSearch, TrackClick, TrackCart, TrackPurchase,
+	TrackImpression, TrackAction, TrackPageView, TrackPageEngaged,
+	TrackPageAction, TrackExperiment,
+}
+
+// IsKnownType reports whether s matches one of the declared Track*
+// constants. Case-sensitive + exact-match. Callers MUST pass the canonical
+// lowercase form (e.g. "track.search", NOT "Track.Search" or
+// "TRACK.SEARCH"). Track* constants are declared lowercase in this file,
+// and this function matches the literal string value of each constant.
+// Callers should validate with this BEFORE casting untrusted input to Type.
+func IsKnownType(s string) bool {
+	for _, t := range KnownTypes {
+		if string(t) == s {
+			return true
+		}
+	}
+	return false
+}
+
 
 // Event is the one envelope. Payload is per-Type, agreed between producer and
 // consumer (json.RawMessage, not a god-struct). A nil Payload means "the subject