@mohasinac/appkit 4.35.0 → 4.35.2

package/dist/_internal/server/features/checkout/actions.js

@@ -12,7 +12,7 @@ import { roundRupees } from "../../../../utils/number.formatter";
 import { ApiError, ValidationError, NotFoundError, ERROR_MESSAGES } from "../../../../errors";
 import { ORDER_FIELDS } from "../../../../constants/field-names";
 import { serverLogger } from "../../../../monitoring";
-import { unitOfWork, siteSettingsRepository, userRepository, storeRepository, couponsRepository, claimedCouponsRepository, addressesRepository, productRepository, } from "../../../../repositories";
+import { unitOfWork, adminNotificationsRepository, siteSettingsRepository, userRepository, storeRepository, couponsRepository, claimedCouponsRepository, addressesRepository, productRepository, } from "../../../../repositories";
 import { computePreOrderDepositAmount, lineTotalFor, sumGroupGst, unitPriceFor, } from "../../../shared/checkout/order-math";
 import { failedCheckoutRepository } from "../../../../features/checkout/repository/failed-checkout.repository";
 import { sendOrderConfirmationEmail } from "../../../../features/contact/server";
@@ -1099,28 +1099,34 @@ async function refundDroppedItemsForRazorpayCheckout(input) {
             void normalizeError(updErr);
             serverLogger.error("verifyAndPlaceRazorpayOrderAction: failed to flag refundPending after auto-refund failure", { orderId: primaryOrderId, err: updErr instanceof Error ? updErr.message : String(updErr) });
         });
-        // Best-effort admin fan-out — mirrors onScamReportCreate's employee
-        // notification pattern. Never allowed to throw past this point.
-        try {
-            const admins = await userRepository.list({ filters: "role==admin", page: 1, pageSize: 100 });
-            await Promise.all(admins.items
-                .filter((a) => !!a.id)
-                .map((admin) => sendNotification({
-                userId: admin.id,
-                type: "system",
-                priority: "high",
-                title: "Automatic refund failed",
-                message: `Automatic refund failed for order ${primaryOrderId} (${unavailablePaid.length} unavailable item(s)) — manual refund required.`,
-                relatedId: primaryOrderId,
-                relatedType: "order",
-                userEmail: admin.email ?? undefined,
-                userPhone: admin.phoneNumber ?? undefined,
-            }).catch((notifErr) => serverLogger.error("Failed to notify admin of failed auto-refund (non-fatal)", notifErr))));
-        }
-        catch (notifyErr) {
+        /*
+         * One admin-inbox row, not one notification per admin.
+         *
+         * 🛑 The comment that used to sit here said this "mirrors
+         * onScamReportCreate's employee notification pattern" — and it did, which
+         * is exactly the problem: that pattern was a 100-way concurrent fan-out of
+         * an email-eligible type, and it has been removed. A failed auto-refund is
+         * ONE event needing ONE person to act, not N personal messages.
+         *
+         * It also no longer queries the admin list at all, so the failure mode
+         * where "we couldn't look up the admins" silently swallowed the alert is
+         * gone with it.
+         */
+        await adminNotificationsRepository
+            .create({
+            category: "payouts",
+            title: "Automatic refund failed",
+            body: `Automatic refund failed for order ${primaryOrderId} (${unavailablePaid.length} unavailable item(s)) — manual refund required.`,
+            severity: "error",
+            isRead: false,
+            entityType: "order",
+            entityId: primaryOrderId,
+            audienceUserIds: [],
+        })
+            .catch((notifyErr) => {
             void normalizeError(notifyErr);
-            serverLogger.error("verifyAndPlaceRazorpayOrderAction: failed to query admins for failed auto-refund notification", { orderId: primaryOrderId });
-        }
+            serverLogger.error("verifyAndPlaceRazorpayOrderAction: failed to write admin notification for failed auto-refund", { orderId: primaryOrderId });
+        });
     }
 }
 /**

package/dist/_internal/server/features/orders/actions.js

@@ -1,6 +1,6 @@
 "use server";
 import { wrapAction } from "@mohasinac/appkit/server";
-import { orderRepository, storeRepository, userRepository } from "../../../../repositories";
+import { adminNotificationsRepository, orderRepository, storeRepository } from "../../../../repositories";
 import { requireRoleUser } from "../../../../providers/auth-firebase/helpers";
 import { createOrderSchema, updateOrderStatusSchema, cancelOrderSchema, returnRequestSchema, } from "../../../shared/features/orders/schema";
 import { isFinalSaleExempt } from "../../../shared/features/orders/return-reasons";
@@ -115,51 +115,44 @@ function normalizeUpi(vpa) {
 }
 const REASON_REQUIRED_MSG = "A reason is required";
 /**
- * Fast-review WhatsApp push — fans out to every configured admin number so
- * a payment proof can be acted on within the 2-hour auto-approve window
- * without hunting through the orders list. Fire-and-forget, non-fatal on
- * failure (mirrors the existing `onOrderCreate.ts` purchase-announcement
- * pattern) — skips silently if the WhatsApp Cloud API isn't configured.
+ * Fast-review signal — a payment proof needs acting on inside the 2-hour
+ * auto-approve window, and the admin should not have to hunt the orders list
+ * to find it.
+ *
+ * 🛑 This used to `Promise.allSettled` a WhatsApp message to EVERY number in
+ * `whatsappAdminNotifyNumbers`, on every proof upload. Three problems, in
+ * increasing order of importance:
+ *
+ *   1. it was an unbounded fan-out on a metered channel;
+ *   2. WhatsApp free-form messages are rejected by Meta outside the 24-hour
+ *      customer-service window, so the alert most likely to matter — the one
+ *      arriving after a quiet period — is precisely the one that would fail;
+ *   3. it left no record. A missed push was simply gone, whereas the queue at
+ *      `/admin/orders` is the thing an admin actually works from.
+ *
+ * One `adminNotifications` row instead: durable, deduplicated by nature, read
+ * by the admin inbox, and counted in the daily digest. Still fire-and-forget
+ * and still non-fatal — the buyer's upload already succeeded, and a failure to
+ * announce it must never surface as an upload error.
  */
 function notifyAdminsOfPaymentProof(order) {
     void (async () => {
         try {
-            const [{ resolveKeys }, { sendWhatsAppBusinessMessage, buildPaymentProofReviewMessage }] = await Promise.all([
-                import("../../../../core/integration-keys"),
-                import("../../../../features/whatsapp-bot/server"),
-            ]);
-            const keys = await resolveKeys();
-            if (!keys.whatsappPhoneNumberId || !keys.whatsappCloudApiToken)
-                return;
-            const adminNumbers = keys.whatsappAdminNotifyNumbers
-                .split(",")
-                .map((n) => n.trim().replace(/\D/g, ""))
-                .filter(Boolean);
-            if (adminNumbers.length === 0)
-                return;
-            // No hardcoded domain fallback here (audit-ssr-in-appkit) — every
-            // consumer sets NEXT_PUBLIC_SITE_URL; skip the review link rather than
-            // guessing a brand-specific domain from inside appkit/_internal/.
-            const baseUrl = process.env.NEXT_PUBLIC_SITE_URL ?? "";
-            const message = buildPaymentProofReviewMessage({
-                orderId: order.id,
-                buyerName: order.userName,
-                productTitle: order.productTitle,
-                totalAmount: order.totalPrice,
-                reviewUrl: `${baseUrl}/admin/orders`,
+            const { adminNotificationsRepository } = await import("../../../../repositories");
+            await adminNotificationsRepository.create({
+                category: "payouts",
+                title: "Payment proof awaiting review",
+                body: `${order.userName} uploaded proof for "${order.productTitle}" (₹${order.totalPrice.toLocaleString("en-IN")}). Review before the 2-hour auto-approve window closes.`,
+                severity: "warning",
+                isRead: false,
+                entityType: "order",
+                entityId: order.id,
+                audienceUserIds: [],
             });
-            await Promise.allSettled(adminNumbers.map((toPhone) => sendWhatsAppBusinessMessage({
-                toPhone,
-                message,
-                phoneNumberId: keys.whatsappPhoneNumberId,
-                accessToken: keys.whatsappCloudApiToken,
-            })));
         }
         catch (err) {
             void normalizeError(err);
-            // Non-fatal — the order itself already saved successfully; a WhatsApp
-            // Cloud API hiccup here must never surface as a proof-upload failure.
-            serverLogger.warn("Payment-proof admin WhatsApp push failed (non-fatal)", {
+            serverLogger.warn("Payment-proof admin notification failed (non-fatal)", {
                 orderId: order.id,
                 error: err instanceof Error ? err.message : String(err),
             });
@@ -384,17 +377,33 @@ export async function raiseOrderDisputeAction(orderId, reason) {
             disputeReason: reason,
             disputeStatus: "open",
         });
-        // Notify every admin for manual investigation — a dispute on an
-        // auto-approved order means nobody has looked at it yet.
-        const admins = await userRepository.findByRole("admin");
-        await Promise.allSettled(admins.map((admin) => sendNotification({
-            userId: admin.uid,
-            type: "payment_review",
-            priority: "high",
+        /*
+         * One admin-inbox row, not one notification per admin.
+         *
+         * 🛑 This was `Promise.allSettled` over `userRepository.findByRole("admin")`
+         * sending `payment_review` — an email-ELIGIBLE type — so a single disputed
+         * order cost one email per admin, concurrently. Same defect as the
+         * scam-report employee blast (removed in the same change), and the comment
+         * on that one said it was copying this pattern.
+         *
+         * `adminNotifications` is durable, appears in the admin inbox, is counted
+         * in the daily digest, and costs exactly one write regardless of how many
+         * admins exist.
+         */
+        await adminNotificationsRepository
+            .create({
+            category: "fraud",
             title: "Dispute raised on auto-approved order",
-            message: `A dispute was raised on order "${order.productTitle}" (auto-approved payment). Reason: ${reason}.`,
-            relatedId: orderId,
-            relatedType: "order",
-        })));
+            body: `A dispute was raised on order "${order.productTitle}" (auto-approved payment). Reason: ${reason}.`,
+            severity: "error",
+            isRead: false,
+            entityType: "order",
+            entityId: orderId,
+            audienceUserIds: [],
+        })
+            .catch((err) => {
+            void normalizeError(err);
+            serverLogger.error("Failed to write dispute admin notification (non-fatal)", { orderId });
+        });
     });
 }

package/dist/_internal/server/features/site-settings/adapters.d.ts

@@ -39,7 +39,7 @@ import type { PublicSiteSettings } from "../../../shared/features/site-settings/
  */
 export declare const PUBLIC_SITE_SETTINGS_FIELDS: readonly ["contact", "payment", "listings", "notificationChannels", "announcementBar", "navConfig", "actionConfig", "background", "watermark"];
 /** Everything else, with the reason it stays server-side. */
-export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "disabledRoutes", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults"];
+export declare const PRIVATE_SITE_SETTINGS_FIELDS: readonly ["id", "createdAt", "updatedAt", "credentials", "emailSettings", "legalPages", "commissions", "emi", "gst", "laborRate", "adSettings", "integrations", "platformLimits", "auctionConfig", "disabledRoutes", "siteName", "tagline", "motto", "logo", "favicon", "seo", "socialLinks", "features", "shipping", "returns", "faq", "aboutContent", "navbarConfig", "footerConfig", "theme", "featuredResults", "messaging"];
 export interface ToPublicSiteSettingsOptions {
     /**
      * The resolved marker → wordmark → text watermark chain. Injected because

package/dist/_internal/server/features/site-settings/adapters.js

@@ -47,6 +47,14 @@ export const PRIVATE_SITE_SETTINGS_FIELDS = [
     "footerConfig", // rendered server-side
     "theme", // delivered as an SSR prop to ThemeProvider by app/[locale]/layout.tsx
     "featuredResults", // rendered server-side by search
+    // Kill switch + daily send ceiling. Read ONLY by guardSend, server-side. Two
+    // reasons it stays private beyond "no client reader": the ceiling and the
+    // headroom left in it are operational detail, and publishing "user email is
+    // currently off" tells an attacker that password-reset traffic is going
+    // unwatched. The one client that arguably wants it — the admin ticket-reply
+    // checkbox, which disables itself when email is off — is behind the admin
+    // API, which returns the full document.
+    "messaging",
 ];
 export function toPublicSiteSettings(doc, opts) {
     return {

package/dist/_internal/server/jobs/core/auctionSettlement.js

@@ -112,6 +112,10 @@ async function settleAuction(ctx, product) {
                 relatedType: "product",
             });
         }
+        // audit-unguarded-send-ok: `bid_lost` is email-INELIGIBLE — these return at
+        // the eligibility gate having written only the bell row, so they never
+        // reach the budget counter. Same reasoning as the settled-auction fan-out
+        // below.
         await Promise.allSettled(activeBids.slice(0, 50).map(({ data: bid }) => sendNotification({
             userId: bid.userId,
             type: "bid_lost",
@@ -181,6 +185,15 @@ async function settleAuction(ctx, product) {
         actionUrl: AUCTION_CHECKOUT_URL,
         actionLabel: AUCTION_MESSAGES.WON_ACTION_LABEL,
     });
+    // audit-unguarded-send-ok: `bid_lost` is email-INELIGIBLE, so every one of
+    // these returns at the eligibility gate in sendNotification having written
+    // only the in-app bell row — it never reaches guardSend or the daily budget
+    // counter, so there is nothing here to contend on. This was THE fan-out that
+    // motivated the whole change (50 concurrent emails per settled auction, with
+    // every expired auction settling at once); it is now 50 concurrent Firestore
+    // writes to 50 DIFFERENT notification documents, which is what this loop
+    // always was underneath. If `bid_lost` is ever made eligible, this must
+    // become sequential and the counter must be sharded first.
     await Promise.allSettled(loserEntries.slice(0, 50).map(({ data: bid }) => sendNotification({
         userId: bid.userId,
         type: "bid_lost",

package/dist/_internal/server/jobs/core/dailyStatusDigest.d.ts

@@ -13,12 +13,37 @@
  * sync ceiling — it has the Function's much larger budget.
  */
 import type { JobContext } from "../runtime/types";
+/** One inbound contact message, rendered with a mailto: reply link. */
+export interface DigestContactMessage {
+    id: string;
+    name: string;
+    email: string;
+    subject: string;
+    /** First ~200 chars. The full text is in /admin/contact. */
+    excerpt: string;
+}
 export interface DailyStatusDigestSummary {
     orderCount: number;
     revenue: number;
     statusBreakdown: Record<string, number>;
     stuckPendingCount: number;
     activeListingCount: number;
+    /** New in the last 24h, listed in full up to CONTACT_PREVIEW_LIMIT. */
+    contactMessages: DigestContactMessage[];
+    contactTotal: number;
+    /** New tickets in 24h, plus the standing backlog by status. */
+    newTicketCount: number;
+    ticketsOpen: number;
+    ticketsInProgress: number;
+    ticketsWaitingOnUser: number;
+    newScamReportCount: number;
+    /** Orders sitting in the manual-payment pending state (proof upload / review). */
+    manualPaymentPendingCount: number;
+    /** Count only — subscriber emails are PII-encrypted with an HMAC blind index. */
+    newSubscriberCount: number;
+    /** Privileged admin actions recorded in 24h — replaces the per-save settings email. */
+    adminActionCount: number;
+    unreadAdminNotificationCount: number;
 }
 /** Gathers the last-24h numbers. Exported so the admin manual-trigger route can reuse it. */
 export declare function collectDailyStatusSummary(): Promise<DailyStatusDigestSummary>;

package/dist/_internal/server/jobs/core/dailyStatusDigest.js

@@ -13,6 +13,7 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
  * unbounded-ish order scan below is safe against CLAUDE.md Rule #6's 10s
  * sync ceiling — it has the Function's much larger budget.
  */
+import { Fragment } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { getAdminDb } from "../../../../providers/db-firebase";
 import { sendEmail } from "../../../../features/contact/email";
@@ -20,14 +21,35 @@ import { siteSettingsRepository } from "../../../../features/admin/repository/si
 import { ORDER_COLLECTION, OrderStatusValues } from "../../../../features/orders/schemas/firestore";
 import { PRODUCT_COLLECTION, ProductStatusValues } from "../../../../features/products/schemas/firestore";
 import { ORDER_FIELDS, PRODUCT_FIELDS } from "../../../../constants/field-names";
-import { EmailBold, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailRow, } from "../../../../features/email/primitives";
+import { CONTACT_SUBMISSIONS_COLLECTION } from "../../../../core/contact-submissions.repository";
+import { NEWSLETTER_SUBSCRIBERS_COLLECTION } from "../../../../core/newsletter.repository";
+import { SUPPORT_TICKET_COLLECTION, SUPPORT_TICKET_FIELDS, TicketStatusValues, } from "../../../../features/support/schemas/firestore";
+import { SCAMMER_COLLECTION, SCAMMER_FIELDS } from "../../../../features/scams/schemas/firestore";
+import { ADMIN_AUDIT_LOG_COLLECTION } from "../../../../features/audit-log/schemas/firestore";
+import { ADMIN_NOTIFICATIONS_COLLECTION } from "../../../../features/store-extensions/schemas/rbac";
+import { EmailBold, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailLink, EmailRow, } from "../../../../features/email/primitives";
 import { normalizeError } from "../../../../errors/normalize";
 const DAY_MS = 24 * 60 * 60 * 1000;
+/*
+ * `createdAt` and `isRead` on collections with no feature-specific field-name
+ * constant — contactSubmissions, newsletterSubscribers, adminAuditLog,
+ * adminNotifications.
+ *
+ * audit-field-name-ok: these are BaseDocument fields common to every
+ * collection, not per-feature names. Borrowing ORDER_FIELDS.CREATED_AT here
+ * would assert a relationship to the orders schema that does not exist, so a
+ * rename there would appear to affect queries it has nothing to do with. Named
+ * once, locally, rather than repeated as bare literals at ten call sites.
+ */
+const CREATED_AT = "createdAt";
+const IS_READ = "isRead";
 /** Statuses that shouldn't count toward revenue for the day. */
 const NON_REVENUE_STATUSES = new Set([
     OrderStatusValues.CANCELLED,
     OrderStatusValues.REFUNDED,
 ]);
+/** How many contact messages the digest lists in full before summarising the rest. */
+const CONTACT_PREVIEW_LIMIT = 20;
 function currency(amount) {
     return `₹${amount.toLocaleString("en-IN", { maximumFractionDigits: 2 })}`;
 }
@@ -68,12 +90,90 @@ export async function collectDailyStatusSummary() {
         .where(PRODUCT_FIELDS.STATUS, "==", ProductStatusValues.PUBLISHED)
         .count()
         .get();
+    const safeCount = async (q) => {
+        try {
+            const snap = await q.count().get();
+            return snap.data().count;
+        }
+        catch (err) {
+            void normalizeError(err);
+            return 0;
+        }
+    };
+    /*
+     * audit-field-name-ok: these six collections — contactSubmissions,
+     * supportTickets, scammerProfiles, newsletterSubscribers, adminAuditLog and
+     * adminNotifications — have no shared field-name constant covering
+     * `createdAt`, and borrowing ORDER_FIELDS.CREATED_AT or PRODUCT_FIELDS.STATUS
+     * here would be actively misleading: it would assert a relationship to the
+     * orders/products schemas that does not exist, so a rename of ORDER_FIELDS
+     * would appear to affect a query it has nothing to do with. `createdAt` and
+     * `isRead` are BaseDocument fields common to every collection, not
+     * per-feature names. SUPPORT_TICKET_FIELDS is used below where it genuinely
+     * applies.
+     */
+    const [contactSnap, contactTotal, newTicketCount, ticketsOpen, ticketsInProgress, ticketsWaitingOnUser, newScamReportCount, manualPaymentPendingCount, newSubscriberCount, adminActionCount, unreadAdminNotificationCount,] = await Promise.all([
+        db
+            .collection(CONTACT_SUBMISSIONS_COLLECTION)
+            .where(CREATED_AT, ">=", since)
+            .orderBy(CREATED_AT, "desc")
+            .limit(CONTACT_PREVIEW_LIMIT)
+            .get()
+            .catch((err) => {
+            void normalizeError(err);
+            return null;
+        }),
+        safeCount(db.collection(CONTACT_SUBMISSIONS_COLLECTION).where(CREATED_AT, ">=", since)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.CREATED_AT, ">=", since)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.STATUS, "==", TicketStatusValues.OPEN)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.STATUS, "==", TicketStatusValues.IN_PROGRESS)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.STATUS, "==", TicketStatusValues.WAITING_ON_USER)),
+        safeCount(db.collection(SCAMMER_COLLECTION).where(SCAMMER_FIELDS.CREATED_AT, ">=", since)),
+        safeCount(db
+            .collection(ORDER_COLLECTION)
+            .where(ORDER_FIELDS.STATUS, "==", OrderStatusValues.PENDING)
+            .where(ORDER_FIELDS.PAYMENT_STATUS, "==", "pending")),
+        safeCount(db.collection(NEWSLETTER_SUBSCRIBERS_COLLECTION).where(CREATED_AT, ">=", since)),
+        safeCount(db.collection(ADMIN_AUDIT_LOG_COLLECTION).where(CREATED_AT, ">=", since)),
+        safeCount(db.collection(ADMIN_NOTIFICATIONS_COLLECTION).where(IS_READ, "==", false)),
+    ]);
+    /*
+     * `contactSubmissions` carries NO PII encryption — name, email, subject and
+     * message are stored in plaintext (see `ContactSubmissionDocument`). That is
+     * what lets the digest render a real `mailto:` reply link.
+     *
+     * Newsletter subscribers are the opposite: `email` is encrypted with an HMAC
+     * blind index, so that section is a COUNT and must stay one. Rendering
+     * addresses there would mean decrypting PII into an email body.
+     */
+    const contactMessages = (contactSnap?.docs ?? []).map((d) => {
+        const data = d.data();
+        const message = data.message ?? "";
+        return {
+            id: d.id,
+            name: data.name ?? "Unknown",
+            email: data.email ?? "",
+            subject: data.subject ?? "(no subject)",
+            excerpt: message.length > 200 ? `${message.slice(0, 200)}…` : message,
+        };
+    });
     return {
         orderCount: recentSnap.size,
         revenue,
         statusBreakdown,
         stuckPendingCount: stuckSnap.data().count,
         activeListingCount: activeSnap.data().count,
+        contactMessages,
+        contactTotal,
+        newTicketCount,
+        ticketsOpen,
+        ticketsInProgress,
+        ticketsWaitingOnUser,
+        newScamReportCount,
+        manualPaymentPendingCount,
+        newSubscriberCount,
+        adminActionCount,
+        unreadAdminNotificationCount,
     };
 }
 function renderDigestHtml(summary, siteName, version) {
@@ -81,7 +181,37 @@ function renderDigestHtml(summary, siteName, version) {
     const title = siteName ? `${siteName} — Daily Status` : "Daily Status";
     return `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: title, children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName }), _jsxs(EmailRow, { children: [version
                             ? `Deployment ${version} is live. Activity for the last 24 hours.`
-                            : "Activity for the last 24 hours.", _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Orders placed", value: summary.orderCount }), _jsx(StatLine, { label: "Revenue (excl. cancelled/refunded)", value: currency(summary.revenue) }), _jsx(StatLine, { label: "Active listings", value: summary.activeListingCount }), _jsx(StatLine, { label: "Pending > 24h (needs attention)", value: summary.stuckPendingCount })] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Orders by status" }), _jsx("br", {}), _jsx("br", {}), statusRows.length === 0 ? ("No orders in this window.") : (statusRows.map(([status, count]) => (_jsx(StatLine, { label: status, value: count }, status))))] }), _jsx(EmailFooter, { copyright: `© ${new Date().getFullYear()}${siteName ? ` ${siteName}` : ""}. All rights reserved.` })] }) }))}`;
+                            : "Activity for the last 24 hours.", _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Orders placed", value: summary.orderCount }), _jsx(StatLine, { label: "Revenue (excl. cancelled/refunded)", value: currency(summary.revenue) }), _jsx(StatLine, { label: "Active listings", value: summary.activeListingCount }), _jsx(StatLine, { label: "Pending > 24h (needs attention)", value: summary.stuckPendingCount })] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Orders by status" }), _jsx("br", {}), _jsx("br", {}), statusRows.length === 0 ? ("No orders in this window.") : (statusRows.map(([status, count]) => (_jsx(StatLine, { label: status, value: count }, status))))] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Inbox" }), _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "New contact messages", value: summary.contactTotal }), _jsx(StatLine, { label: "New support tickets", value: summary.newTicketCount }), _jsx(StatLine, { label: "Tickets open / in progress / waiting on user", value: `${summary.ticketsOpen} / ${summary.ticketsInProgress} / ${summary.ticketsWaitingOnUser}` }), _jsx(StatLine, { label: "Unread admin notifications", value: summary.unreadAdminNotificationCount })] }), summary.contactMessages.length > 0 ? (_jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Contact messages" }), _jsx("br", {}), _jsx("br", {}), summary.contactMessages.map((m) => (_jsxs(Fragment, { children: [_jsx(EmailBold, { children: m.subject }), _jsx("br", {}), m.name, " \u2014", " ", _jsxs(EmailLink, { href: `mailto:${m.email}?subject=${encodeURIComponent(`Re: ${m.subject}`)}`, children: ["Reply to ", m.email] }), _jsx("br", {}), m.excerpt, _jsx("br", {}), _jsx("br", {})] }, m.id))), summary.contactTotal > summary.contactMessages.length
+                            ? `…and ${summary.contactTotal - summary.contactMessages.length} more in /admin/contact.`
+                            : null] })) : null, _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Needs attention" }), _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Manual payments pending", value: summary.manualPaymentPendingCount }), _jsx(StatLine, { label: "New scam reports", value: summary.newScamReportCount }), _jsx(StatLine, { label: "New newsletter subscribers", value: summary.newSubscriberCount }), _jsx(StatLine, { label: "Admin actions logged", value: summary.adminActionCount })] }), _jsx(EmailFooter, { copyright: `© ${new Date().getFullYear()}${siteName ? ` ${siteName}` : ""}. All rights reserved.` })] }) }))}`;
+}
+/**
+ * The plain-text twin of `renderDigestHtml`.
+ *
+ * 🛑 This exists as a real function, beside the renderer, on purpose. The text
+ * part used to be a string concatenated inline at the call site, which meant
+ * every new HTML section silently did NOT appear in the text alternative —
+ * and a mail client showing the text part would render a digest missing
+ * exactly the sections someone had just added. Adding a section now means
+ * editing two adjacent functions rather than one function and one distant
+ * template literal.
+ */
+function renderDigestText(summary, version) {
+    const lines = [];
+    if (version)
+        lines.push(`Deployment ${version} is live.`, "");
+    lines.push(`Orders placed: ${summary.orderCount}`, `Revenue: ${currency(summary.revenue)}`, `Active listings: ${summary.activeListingCount}`, `Pending > 24h: ${summary.stuckPendingCount}`, "", "INBOX", `New contact messages: ${summary.contactTotal}`, `New support tickets: ${summary.newTicketCount}`, `Tickets open/in-progress/waiting: ${summary.ticketsOpen}/${summary.ticketsInProgress}/${summary.ticketsWaitingOnUser}`, `Unread admin notifications: ${summary.unreadAdminNotificationCount}`);
+    if (summary.contactMessages.length > 0) {
+        lines.push("", "CONTACT MESSAGES");
+        for (const m of summary.contactMessages) {
+            lines.push(`- ${m.subject} — ${m.name} <${m.email}>`, `  ${m.excerpt}`);
+        }
+        if (summary.contactTotal > summary.contactMessages.length) {
+            lines.push(`  …and ${summary.contactTotal - summary.contactMessages.length} more in /admin/contact.`);
+        }
+    }
+    lines.push("", "NEEDS ATTENTION", `Manual payments pending: ${summary.manualPaymentPendingCount}`, `New scam reports: ${summary.newScamReportCount}`, `New newsletter subscribers: ${summary.newSubscriberCount}`, `Admin actions logged: ${summary.adminActionCount}`);
+    return lines.join("\n");
 }
 const DEPLOY_MARKER_COLLECTION = "system";
 const DEPLOY_MARKER_DOC = "deployDigest";
@@ -134,23 +264,36 @@ export async function runDailyStatusDigest(ctx, version) {
         ctx.logger.warn("dailyStatusDigest: enabled but no recipients configured — skipping");
         return { sent: false, reason: "no_recipients" };
     }
-    const ccRecipients = (digestConfig.ccRecipients ?? []).filter((r) => r.trim().length > 0);
+    /*
+     * 🛑 No CC, deliberately, and `ccRecipients` is no longer read here.
+     *
+     * Resend bills a CC as a separate delivery, so a three-recipient TO plus one
+     * CC was four of the day's 100 emails for one report. The digest now goes to
+     * a single address. `emailSettings.dailyDigest.ccRecipients` remains on the
+     * schema only so existing documents do not fail validation — nothing reads
+     * it, and the admin UI no longer offers it.
+     */
     const summary = await collectDailyStatusSummary();
     // No hardcoded brand fallback — appkit is consumer-agnostic; the site name
     // comes from settings or the consumer's own env var.
     const siteName = settings?.siteName?.trim() || process.env.NEXT_PUBLIC_SITE_NAME?.trim() || "";
     const { error } = await sendEmail({
         to: recipients,
-        // Spread rather than `cc: undefined` — SendEmailOptions has a
-        // Record<string, JsonValue> index signature that rejects undefined.
-        ...(ccRecipients.length > 0 ? { cc: ccRecipients } : {}),
         subject: "Daily Status",
         html: renderDigestHtml(summary, siteName, version),
-        text: (version ? `Deployment ${version} is live.\n\n` : "") +
-            `Orders placed: ${summary.orderCount}\n` +
-            `Revenue: ${currency(summary.revenue)}\n` +
-            `Active listings: ${summary.activeListingCount}\n` +
-            `Pending > 24h: ${summary.stuckPendingCount}`,
+        text: renderDigestText(summary, version),
+    }, {
+        channel: "email",
+        feature: "daily_digest",
+        /*
+         * STAFF, and this is the single most load-bearing `audience` in the
+         * codebase. The kill switch suppresses user-facing mail only, so turning
+         * email off must never blind the operator — this digest is now the only
+         * way a contact message, a new support ticket or a stuck payment proof
+         * gets noticed at all. Marking it `user` would mean switching off
+         * marketing also switched off the ability to notice an outage.
+         */
+        audience: "staff",
     });
     if (error) {
         ctx.logger.error("dailyStatusDigest: send failed", { error: String(error) });

package/dist/_internal/server/jobs/core/hardBanReinstatement.js

@@ -47,15 +47,27 @@ export async function runHardBanReinstatement(ctx) {
             ctx.logger.error("Failed to reinstate expired hard ban", err, { uid: user.uid });
         }
     }
-    await Promise.allSettled(expired.map((user) => sendNotification({
-        userId: user.uid,
-        type: "account_action",
-        priority: "normal",
-        title: "Account access restored",
-        message: "Your account access has been restored. If your seller store was suspended, contact support to reactivate it.",
-        relatedId: user.uid,
-        relatedType: "user",
-    })));
+    // Sequential: `account_action` is email-eligible — deliberately so, since a
+    // ban or unban has to reach someone outside the app they just lost or
+    // regained. Each send reserves a unit from the single-document daily budget
+    // counter, so a concurrent sweep would contend. See pendingOrderTimeout.
+    for (const user of expired) {
+        try {
+            await sendNotification({
+                userId: user.uid,
+                type: "account_action",
+                priority: "normal",
+                title: "Account access restored",
+                message: "Your account access has been restored. If your seller store was suspended, contact support to reactivate it.",
+                relatedId: user.uid,
+                relatedType: "user",
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.error("Failed to notify user of ban reinstatement (non-fatal)", err, { uid: user.uid });
+        }
+    }
     ctx.logger.info("Hard ban reinstatement sweep complete", {
         scanned: expired.length,
         reinstated,