@mohasinac/appkit 4.35.0 → 4.35.2

package/dist/features/admin/components/AdminSiteSettingsView.js

@@ -306,7 +306,17 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
     // Daily ops digest — recipients are edited as one-per-line text, split on save.
     const [digestEnabled, setDigestEnabled] = React.useState(false);
     const [digestRecipients, setDigestRecipients] = React.useState("");
-    const [digestCcRecipients, setDigestCcRecipients] = React.useState("");
+    /*
+     * Outbound messaging: the kill switch and the daily ceiling.
+     *
+     * `emailEnabled` suppresses USER-facing mail only. Staff mail — the daily
+     * digest, the payout summary — keeps flowing regardless, because switching
+     * off customer email must never also blind the operator.
+     */
+    const [msgEmailEnabled, setMsgEmailEnabled] = React.useState(false);
+    const [msgWhatsappEnabled, setMsgWhatsappEnabled] = React.useState(false);
+    const [msgCeilingEmail, setMsgCeilingEmail] = React.useState(80);
+    const [msgCeilingWhatsapp, setMsgCeilingWhatsapp] = React.useState(200);
     // Snapshot of the masked placeholder strings the server returned for every
     // credentials.* field, captured once per load. A combined single-save has
     // to send the FULL credentials object on every save (not just the group the
@@ -490,7 +500,13 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
         setNotifFromName(s.emailSettings?.fromName ?? "");
         setDigestEnabled(s.emailSettings?.dailyDigest?.enabled ?? false);
         setDigestRecipients((s.emailSettings?.dailyDigest?.recipients ?? []).join("\n"));
-        setDigestCcRecipients((s.emailSettings?.dailyDigest?.ccRecipients ?? []).join("\n"));
+        // Defaults mirror MESSAGE_BUDGET_DEFAULTS — both channels OFF, so a
+        // settings document written before this feature existed reads as quiet
+        // rather than as "on and unmetered".
+        setMsgEmailEnabled(s.messaging?.emailEnabled ?? false);
+        setMsgWhatsappEnabled(s.messaging?.whatsappEnabled ?? false);
+        setMsgCeilingEmail(s.messaging?.dailyCeiling?.email ?? 80);
+        setMsgCeilingWhatsapp(s.messaging?.dailyCeiling?.whatsapp ?? 200);
         originalMaskedRef.current = {
             razorpayKeyId: s.credentialsMasked?.razorpayKeyId ?? "",
             razorpayKeySecret: s.credentialsMasked?.razorpayKeySecret ?? "",
@@ -630,7 +646,21 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
                 dailyDigest: {
                     enabled: digestEnabled,
                     recipients: splitEmailList(digestRecipients),
-                    ccRecipients: splitEmailList(digestCcRecipients),
+                    // Always empty — the CC field is gone (see the Notifications tab).
+                    // Sent explicitly rather than omitted so a save clears any CC list a
+                    // pre-existing document still carries.
+                    ccRecipients: [],
+                },
+            },
+            messaging: {
+                emailEnabled: msgEmailEnabled,
+                whatsappEnabled: msgWhatsappEnabled,
+                dailyCeiling: {
+                    email: msgCeilingEmail,
+                    whatsapp: msgCeilingWhatsapp,
+                    // No SMS sender exists; the ceiling is carried so one cannot ship
+                    // uncapped if somebody adds a provider later.
+                    sms: 50,
                 },
             },
             integrations: { googleAnalyticsId: gaMeasurementId, facebookPixelId: fbPixelId, gtmContainerId },
@@ -744,7 +774,7 @@ export function AdminSiteSettingsView({ labels = {}, ...rest }) {
                                                         ...bidIncrementTiers.slice(0, -1),
                                                         { upTo: 100, increment: 10 },
                                                         bidIncrementTiers[bidIncrementTiers.length - 1] ?? { upTo: null, increment: 1000 },
-                                                    ]), children: "+ Add tier" })] }), _jsx(Input, { label: "Auto-extend window (minutes before end)", value: String(autoExtendWindow), onChange: (e) => setAutoExtendWindow(parseInt(e.target.value) || 0), type: "number", min: 0, helperText: "Extend auction end time if a bid arrives within this window." }), _jsx(Input, { label: "Settlement grace period (hours)", value: String(settlementGrace), onChange: (e) => setSettlementGrace(parseInt(e.target.value) || 0), type: "number", min: 1, helperText: "Time winner has to pay before the auction is re-listed." })] }) }), _jsx(TabsContent, { value: "limits", children: _jsx(SettingsTabForm, { id: "limits", label: "Limits", children: _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Max products per store", value: String(maxProductsPerStore), onChange: (e) => setMaxProductsPerStore(parseInt(e.target.value) || 0), type: "number", min: 1 }), _jsx(Input, { label: "Max custom fields per product", value: String(maxCustomFields), onChange: (e) => setMaxCustomFields(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Max custom sections per product", value: String(maxCustomSections), onChange: (e) => setMaxCustomSections(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Order cancellation window (hours)", value: String(orderCancelWindow), onChange: (e) => setOrderCancelWindow(parseInt(e.target.value) || 0), type: "number", min: 0 })] }) }) }), _jsx(TabsContent, { value: "whatsapp", children: _jsxs(SettingsTabForm, { id: "whatsapp", label: "Whatsapp", children: [_jsx(Text, { size: "xs", color: "muted", children: "Platform-level WhatsApp Business Cloud API credentials. Used for automated purchase announcements to admin numbers when orders are placed. Store owners configure their own credentials in Store \u2192 WhatsApp." }), _jsx(Input, { label: "Phone Number ID", value: waPhoneNumberId, onChange: (e) => setWaPhoneNumberId(e.target.value), placeholder: "987654321098765", helperText: "From Meta for Developers \u2192 App \u2192 WhatsApp \u2192 API Setup" }), _jsx(MaskedInput, { label: "Cloud API System User Token", value: waCloudApiToken, onChange: setWaCloudApiToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived system user access token with WhatsApp Business permissions" }), _jsx(Input, { label: "Admin Notify Numbers", value: waAdminNotifyNumbers, onChange: (e) => setWaAdminNotifyNumbers(e.target.value), placeholder: "919876543210,918765432109", helperText: "Comma-separated, digits-only, include country code. These receive a WhatsApp message when any order is placed." }), _jsx(Text, { size: "xs", color: "muted", children: "Approved Meta message templates for the buyer-facing WhatsApp order-updates addon (Fees tab). Meta rejects business-initiated free-text WhatsApp messages outside a 24h customer-service window \u2014 a real template name here is required for that notification type to actually deliver. Leave blank to skip WhatsApp for that type (in-app + email still fire)." }), _jsx(Input, { label: "Template language code", value: waTemplateLanguage, onChange: (e) => setWaTemplateLanguage(e.target.value), placeholder: "en", helperText: "BCP-47 code the templates below were approved in, e.g. en or en_US." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Order placed template name", value: waTemplateOrderPlaced, onChange: (e) => setWaTemplateOrderPlaced(e.target.value), placeholder: "order_placed_update" }), _jsx(Input, { label: "Order confirmed template name", value: waTemplateOrderConfirmed, onChange: (e) => setWaTemplateOrderConfirmed(e.target.value), placeholder: "order_confirmed_update" }), _jsx(Input, { label: "Order shipped template name", value: waTemplateOrderShipped, onChange: (e) => setWaTemplateOrderShipped(e.target.value), placeholder: "order_shipped_update" }), _jsx(Input, { label: "Order delivered template name", value: waTemplateOrderDelivered, onChange: (e) => setWaTemplateOrderDelivered(e.target.value), placeholder: "order_delivered_update" }), _jsx(Input, { label: "Order cancelled template name", value: waTemplateOrderCancelled, onChange: (e) => setWaTemplateOrderCancelled(e.target.value), placeholder: "order_cancelled_update" }), _jsx(Input, { label: "Refund initiated template name", value: waTemplateRefundInitiated, onChange: (e) => setWaTemplateRefundInitiated(e.target.value), placeholder: "refund_initiated_update" })] })] }) }), _jsx(TabsContent, { value: "notifications", children: _jsxs(SettingsTabForm, { id: "notifications", label: "Notifications", children: [_jsx(Text, { size: "xs", color: "muted", children: "In-app notifications are always on. Enable external channels below to let the platform fan out to email, WhatsApp, or SMS. Users can further restrict which types they receive." }), _jsxs(Stack, { gap: "xs", surface: "muted", rounded: "lg", border: "default", padding: "md", children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "In-app (notification bell)" }), _jsx(Span, { color: "success", surface: "success-surface", size: "xs", weight: "semibold", rounded: "full", padding: "pill-xs", children: "Always on" })] }), _jsx(Text, { size: "xs", color: "muted", children: "Displayed in the notification bell and inbox. Cannot be disabled." })] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-email-notifications", children: _jsx(Toggle, { label: "Email notifications", checked: notifEmailEnabled, onChange: setNotifEmailEnabled }) }), notifEmailEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send email", options: PRIORITY_OPTIONS, value: notifEmailMinPriority, onValueChange: setNotifEmailMinPriority }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Resend API (for transactional email)" }), _jsx(MaskedInput, { label: "Resend API Key", value: resendApiKey, onChange: setResendApiKey, placeholder: "re_live_\u2026", helperText: "Get your key at resend.com \u2014 used for all transactional notifications." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "From email", value: notifFromEmail, onChange: (e) => setNotifFromEmail(e.target.value), placeholder: "noreply@letitrip.in", type: "email" }), _jsx(Input, { label: "From name", value: notifFromName, onChange: (e) => setNotifFromName(e.target.value), placeholder: "LetItRip" })] }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifEmailTypes, onChange: (values) => setNotifEmailTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-daily-digest", children: _jsx(Toggle, { label: "Daily status digest", checked: digestEnabled, onChange: setDigestEnabled }) }), digestEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Text, { size: "xs", color: "muted", children: "Sent every morning at 10:00 IST with the previous 24 hours of order activity. Its arrival doubles as the platform health check \u2014 if it stops landing, something needs a look." }), _jsx(Textarea, { label: "Recipients (To)", value: digestRecipients, onChange: (e) => setDigestRecipients(e.target.value), placeholder: "support@letitrip.in\nmohasin@letitrip.in", rows: 4, helperText: "One address per line." }), _jsx(Textarea, { label: "CC recipients", value: digestCcRecipients, onChange: (e) => setDigestCcRecipients(e.target.value), placeholder: "One address per line", rows: 3, helperText: "Optional \u2014 anyone else who should receive a copy." })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-whatsapp-notifications", children: _jsx(Toggle, { label: "WhatsApp notifications", checked: notifWhatsappEnabled, onChange: setNotifWhatsappEnabled }) }), notifWhatsappEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send WhatsApp", options: PRIORITY_OPTIONS, value: notifWhatsappMinPriority, onValueChange: setNotifWhatsappMinPriority }), _jsx(Toggle, { label: "Enable WhatsApp OTP (for login and verification)", checked: notifWhatsappOtpEnabled, onChange: setNotifWhatsappOtpEnabled }), _jsx(Text, { size: "xs", color: "muted", children: "WhatsApp credentials are configured in the WhatsApp tab (\u246C). OTP messages use the same phone number." }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifWhatsappTypes, onChange: (values) => setNotifWhatsappTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Toggle, { label: "SMS notifications", checked: notifSmsEnabled, onChange: setNotifSmsEnabled }), notifSmsEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send SMS", options: PRIORITY_OPTIONS, value: notifSmsMinPriority, onValueChange: setNotifSmsMinPriority }), _jsx(Text, { size: "xs", color: "muted", children: "SMS gateway credentials (e.g. Twilio, MSG91) can be configured in the Integrations tab once an SMS provider is connected." })] }))] })] }) }), _jsx(TabsContent, { value: "legal", children: _jsx(SettingsTabForm, { id: "legal", label: "Legal", children: [
+                                                    ]), children: "+ Add tier" })] }), _jsx(Input, { label: "Auto-extend window (minutes before end)", value: String(autoExtendWindow), onChange: (e) => setAutoExtendWindow(parseInt(e.target.value) || 0), type: "number", min: 0, helperText: "Extend auction end time if a bid arrives within this window." }), _jsx(Input, { label: "Settlement grace period (hours)", value: String(settlementGrace), onChange: (e) => setSettlementGrace(parseInt(e.target.value) || 0), type: "number", min: 1, helperText: "Time winner has to pay before the auction is re-listed." })] }) }), _jsx(TabsContent, { value: "limits", children: _jsx(SettingsTabForm, { id: "limits", label: "Limits", children: _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Max products per store", value: String(maxProductsPerStore), onChange: (e) => setMaxProductsPerStore(parseInt(e.target.value) || 0), type: "number", min: 1 }), _jsx(Input, { label: "Max custom fields per product", value: String(maxCustomFields), onChange: (e) => setMaxCustomFields(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Max custom sections per product", value: String(maxCustomSections), onChange: (e) => setMaxCustomSections(parseInt(e.target.value) || 0), type: "number", min: 0 }), _jsx(Input, { label: "Order cancellation window (hours)", value: String(orderCancelWindow), onChange: (e) => setOrderCancelWindow(parseInt(e.target.value) || 0), type: "number", min: 0 })] }) }) }), _jsx(TabsContent, { value: "whatsapp", children: _jsxs(SettingsTabForm, { id: "whatsapp", label: "Whatsapp", children: [_jsx(Text, { size: "xs", color: "muted", children: "Platform-level WhatsApp Business Cloud API credentials. Used for automated purchase announcements to admin numbers when orders are placed. Store owners configure their own credentials in Store \u2192 WhatsApp." }), _jsx(Input, { label: "Phone Number ID", value: waPhoneNumberId, onChange: (e) => setWaPhoneNumberId(e.target.value), placeholder: "987654321098765", helperText: "From Meta for Developers \u2192 App \u2192 WhatsApp \u2192 API Setup" }), _jsx(MaskedInput, { label: "Cloud API System User Token", value: waCloudApiToken, onChange: setWaCloudApiToken, placeholder: "EAAxxxxxxxx\u2026", helperText: "Long-lived system user access token with WhatsApp Business permissions" }), _jsx(Input, { label: "Admin Notify Numbers", value: waAdminNotifyNumbers, onChange: (e) => setWaAdminNotifyNumbers(e.target.value), placeholder: "919876543210,918765432109", helperText: "Comma-separated, digits-only, include country code. These receive a WhatsApp message when any order is placed." }), _jsx(Text, { size: "xs", color: "muted", children: "Approved Meta message templates for the buyer-facing WhatsApp order-updates addon (Fees tab). Meta rejects business-initiated free-text WhatsApp messages outside a 24h customer-service window \u2014 a real template name here is required for that notification type to actually deliver. Leave blank to skip WhatsApp for that type (in-app + email still fire)." }), _jsx(Input, { label: "Template language code", value: waTemplateLanguage, onChange: (e) => setWaTemplateLanguage(e.target.value), placeholder: "en", helperText: "BCP-47 code the templates below were approved in, e.g. en or en_US." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Order placed template name", value: waTemplateOrderPlaced, onChange: (e) => setWaTemplateOrderPlaced(e.target.value), placeholder: "order_placed_update" }), _jsx(Input, { label: "Order confirmed template name", value: waTemplateOrderConfirmed, onChange: (e) => setWaTemplateOrderConfirmed(e.target.value), placeholder: "order_confirmed_update" }), _jsx(Input, { label: "Order shipped template name", value: waTemplateOrderShipped, onChange: (e) => setWaTemplateOrderShipped(e.target.value), placeholder: "order_shipped_update" }), _jsx(Input, { label: "Order delivered template name", value: waTemplateOrderDelivered, onChange: (e) => setWaTemplateOrderDelivered(e.target.value), placeholder: "order_delivered_update" }), _jsx(Input, { label: "Order cancelled template name", value: waTemplateOrderCancelled, onChange: (e) => setWaTemplateOrderCancelled(e.target.value), placeholder: "order_cancelled_update" }), _jsx(Input, { label: "Refund initiated template name", value: waTemplateRefundInitiated, onChange: (e) => setWaTemplateRefundInitiated(e.target.value), placeholder: "refund_initiated_update" })] })] }) }), _jsx(TabsContent, { value: "notifications", children: _jsxs(SettingsTabForm, { id: "notifications", label: "Notifications", children: [_jsx(Text, { size: "xs", color: "muted", children: "In-app notifications are always on. Enable external channels below to let the platform fan out to email, WhatsApp, or SMS. Users can further restrict which types they receive." }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Text, { size: "sm", weight: "semibold", children: "Outbound messaging budget" }), _jsxs(Text, { size: "xs", color: "muted", children: ["The master switches. These suppress ", _jsx(Span, { weight: "semibold", children: "user-facing" }), " messages only \u2014 the daily status digest always reaches staff, so turning customer email off never leaves the site unwatched. Transactional messages (checkout verification codes, order receipts) also keep sending, because suppressing those breaks checkout rather than quietening it."] }), _jsx(Toggle, { label: "Send user-facing email", checked: msgEmailEnabled, onChange: setMsgEmailEnabled }), _jsx(Toggle, { label: "Send user-facing WhatsApp", checked: msgWhatsappEnabled, onChange: setMsgWhatsappEnabled }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "Daily email ceiling", type: "number", value: String(msgCeilingEmail), onChange: (e) => setMsgCeilingEmail(Number(e.target.value) || 0), helperText: "Resend's free tier is 100/day. 80 leaves headroom for password-reset mail and in-flight sends." }), _jsx(Input, { label: "Daily WhatsApp ceiling", type: "number", value: String(msgCeilingWhatsapp), onChange: (e) => setMsgCeilingWhatsapp(Number(e.target.value) || 0), helperText: "A sanity bound. Meta bills per conversation, not per message." })] }), _jsx(Text, { size: "xs", color: "muted", children: "Some notification types never email regardless of these settings \u2014 losing an auction, being outbid, marketing, review activity and ticket updates are shown in the notification bell only. That is deliberate: those were the highest-volume sends and the ones most likely to exhaust the day's allowance. A support reply can still be emailed one-off from the ticket screen." })] }), _jsxs(Stack, { gap: "xs", surface: "muted", rounded: "lg", border: "default", padding: "md", children: [_jsxs(Row, { justify: "between", gap: "sm", children: [_jsx(Text, { size: "sm", weight: "medium", color: "muted", children: "In-app (notification bell)" }), _jsx(Span, { color: "success", surface: "success-surface", size: "xs", weight: "semibold", rounded: "full", padding: "pill-xs", children: "Always on" })] }), _jsx(Text, { size: "xs", color: "muted", children: "Displayed in the notification bell and inbox. Cannot be disabled." })] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-email-notifications", children: _jsx(Toggle, { label: "Email notifications", checked: notifEmailEnabled, onChange: setNotifEmailEnabled }) }), notifEmailEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send email", options: PRIORITY_OPTIONS, value: notifEmailMinPriority, onValueChange: setNotifEmailMinPriority }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Resend API (for transactional email)" }), _jsx(MaskedInput, { label: "Resend API Key", value: resendApiKey, onChange: setResendApiKey, placeholder: "re_live_\u2026", helperText: "Get your key at resend.com \u2014 used for all transactional notifications." }), _jsxs(Grid, { cols: 2, gap: "md", children: [_jsx(Input, { label: "From email", value: notifFromEmail, onChange: (e) => setNotifFromEmail(e.target.value), placeholder: "noreply@letitrip.in", type: "email" }), _jsx(Input, { label: "From name", value: notifFromName, onChange: (e) => setNotifFromName(e.target.value), placeholder: "LetItRip" })] }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifEmailTypes, onChange: (values) => setNotifEmailTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-daily-digest", children: _jsx(Toggle, { label: "Daily status digest", checked: digestEnabled, onChange: setDigestEnabled }) }), digestEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Text, { size: "xs", color: "muted", children: "Sent every morning at 10:00 IST with the previous 24 hours of order activity. Its arrival doubles as the platform health check \u2014 if it stops landing, something needs a look." }), _jsx(Textarea, { label: "Recipients (To)", value: digestRecipients, onChange: (e) => setDigestRecipients(e.target.value), placeholder: "mohasin@letitrip.in", rows: 3, helperText: "One address per line. Each address is billed as a separate send against the daily allowance \u2014 keep this list short." })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Div, { id: "setting-whatsapp-notifications", children: _jsx(Toggle, { label: "WhatsApp notifications", checked: notifWhatsappEnabled, onChange: setNotifWhatsappEnabled }) }), notifWhatsappEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send WhatsApp", options: PRIORITY_OPTIONS, value: notifWhatsappMinPriority, onValueChange: setNotifWhatsappMinPriority }), _jsx(Toggle, { label: "Enable WhatsApp OTP (for login and verification)", checked: notifWhatsappOtpEnabled, onChange: setNotifWhatsappOtpEnabled }), _jsx(Text, { size: "xs", color: "muted", children: "WhatsApp credentials are configured in the WhatsApp tab (\u246C). OTP messages use the same phone number." }), _jsx(Text, { size: "xs", weight: "medium", color: "muted", className: "pt-[0.25rem]", children: "Notification types (leave empty to send all types)" }), _jsx(PaginatedSelect, { multiple: true, options: NOTIF_TYPE_OPTIONS, value: notifWhatsappTypes, onChange: (values) => setNotifWhatsappTypes(values), placeholder: "All notification types" })] }))] }), _jsxs(Stack, { gap: "md", rounded: "lg", border: "default", padding: "md", children: [_jsx(Toggle, { label: "SMS notifications", checked: notifSmsEnabled, onChange: setNotifSmsEnabled }), notifSmsEnabled && (_jsxs(Stack, { gap: "md", className: NOTIF_CHANNEL_INDENT, children: [_jsx(Select, { label: "Minimum priority to send SMS", options: PRIORITY_OPTIONS, value: notifSmsMinPriority, onValueChange: setNotifSmsMinPriority }), _jsx(Text, { size: "xs", color: "muted", children: "SMS gateway credentials (e.g. Twilio, MSG91) can be configured in the Integrations tab once an SMS provider is connected." })] }))] })] }) }), _jsx(TabsContent, { value: "legal", children: _jsx(SettingsTabForm, { id: "legal", label: "Legal", children: [
                                         ["Terms of Service", termsHtml, setTermsHtml],
                                         ["Privacy Policy", privacyHtml, setPrivacyHtml],
                                         ["Refund Policy", refundHtml, setRefundHtml],

package/dist/features/admin/components/AdminSupportTicketDetailView.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { Code, useApiMutation } from "@mohasinac/appkit/client";
 import React from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import { Button, Div, HorizontalRule, Input, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, Toggle, useToast } from "../../../ui";
+import { Button, Checkbox, Div, HorizontalRule, Input, Label, Row, Select, SideDrawer, Span, Stack, Text, Textarea, Toggle, useToast } from "../../../ui";
 import { apiClient } from "../../../http";
 import { ADMIN_ENDPOINTS, SUPPORT_ENDPOINTS } from "../../../constants/api-endpoints";
 import { supportTicketUpdateSchema, toRelatedPartiesPayload, } from "../schemas/admin-ops-forms";
@@ -65,6 +65,12 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
     const queryClient = useQueryClient();
     const { showToast } = useToast();
     const [replyBody, setReplyBody] = React.useState("");
+    /*
+     * Opt-in per reply, and it RESETS to false after every send (see
+     * `onSuccess`). A sticky "also email" would quietly turn the exception back
+     * into the default — which is the behaviour this whole change removed.
+     */
+    const [alsoEmail, setAlsoEmail] = React.useState(false);
     const [draft, setDraft] = React.useState(() => seedTicketDraft(currentStatus, currentPriority, internalNotes, relatedParties));
     React.useEffect(() => {
         if (open) {
@@ -102,11 +108,12 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
     const replyMutation = useApiMutation({
         errorMessage: "Failed to send reply.",
         mutationFn: async () => {
-            await apiClient.post(SUPPORT_ENDPOINTS.TICKET_MESSAGES(ticketId), { body: replyBody, newStatus: draft.status });
+            await apiClient.post(SUPPORT_ENDPOINTS.TICKET_MESSAGES(ticketId), { body: replyBody, newStatus: draft.status, sendEmail: alsoEmail });
         },
         onSuccess: () => {
-            showToast("Reply sent.", "success");
+            showToast(alsoEmail ? "Reply sent and emailed." : "Reply sent.", "success");
             setReplyBody("");
+            setAlsoEmail(false);
             invalidate();
             onClose();
         },
@@ -257,7 +264,7 @@ export function AdminSupportTicketDetailView({ open, onClose, ticketId, subject,
             setOrderItemsOpen(false);
         },
     });
-    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: subject ?? "Support Ticket", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${STATUS_COLOR[currentStatus ?? "open"] ?? STATUS_COLOR.open}`, rounded: "full", padding: "pill-sm-tall", children: (currentStatus ?? "open").replace(/_/g, " ") }), _jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: category }), orderId && (_jsxs(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: ["Order: ", orderId] }))] }), _jsxs(Div, { textSize: "sm", color: "muted", children: ["From: ", _jsx(Span, { weight: "medium", color: "primary", children: userDisplayName })] }), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), messages.length > 0 && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: ["Messages (", messages.length, ")"] }), _jsx(Stack, { className: `max-h-64 ${__O.yAuto}`, gap: "sm", children: messages.map((msg, i) => (_jsxs(Div, { textSize: "sm", surface: msg.authorRole === "user" ? "default" : "info-surface", className: msg.authorRole === "user" ? "border border-[var(--appkit-color-border)]" : "border border-[var(--appkit-color-info)]", rounded: "lg", padding: "sm", children: [_jsxs(Row, { color: "muted", textSize: "xs", className: "mb-1", align: "center", gap: "sm", children: [_jsx(Span, { weight: "medium", color: "muted", children: ROLE_LABEL[msg.authorRole ?? "user"] ?? msg.authorRole }), msg.createdAt && (_jsx(Span, { children: new Date(msg.createdAt).toLocaleString() }))] }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", children: msg.body })] }, msg.id ?? i))) })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Reply to user" }), _jsx(Textarea, { value: replyBody, onChange: (e) => setReplyBody(e.target.value), rows: 3, placeholder: "Type a reply\u2026" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", isLoading: replyMutation.isPending, disabled: !replyBody.trim() || !ticketId || replyMutation.isPending, onClick: () => replyMutation.mutate(), children: "Send reply" })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(RecordStatusTimeline, { entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
+    return (_jsx(SideDrawer, { isOpen: open, onClose: onClose, title: subject ?? "Support Ticket", children: _jsxs(Stack, { className: `${__P.p4}`, gap: "md", children: [_jsxs(Row, { align: "center", gap: "sm", wrap: true, children: [_jsx(Span, { size: "xs", weight: "medium", className: `inline-flex ${STATUS_COLOR[currentStatus ?? "open"] ?? STATUS_COLOR.open}`, rounded: "full", padding: "pill-sm-tall", children: (currentStatus ?? "open").replace(/_/g, " ") }), _jsx(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: category }), orderId && (_jsxs(Span, { size: "xs", rounded: "full", padding: "pill-sm-tall", surface: "subtle", color: "muted", children: ["Order: ", orderId] }))] }), _jsxs(Div, { textSize: "sm", color: "muted", children: ["From: ", _jsx(Span, { weight: "medium", color: "primary", children: userDisplayName })] }), description && (_jsxs(Div, { className: `${__P.p3}`, rounded: "lg", surface: "muted", border: "default", children: [_jsx(Text, { className: "mb-1 tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: "Description" }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", size: "sm", children: description })] })), messages.length > 0 && (_jsxs(Stack, { gap: "sm", children: [_jsxs(Text, { className: "tracking-wide", color: "muted", size: "xs", weight: "semibold", transform: "uppercase", children: ["Messages (", messages.length, ")"] }), _jsx(Stack, { className: `max-h-64 ${__O.yAuto}`, gap: "sm", children: messages.map((msg, i) => (_jsxs(Div, { textSize: "sm", surface: msg.authorRole === "user" ? "default" : "info-surface", className: msg.authorRole === "user" ? "border border-[var(--appkit-color-border)]" : "border border-[var(--appkit-color-info)]", rounded: "lg", padding: "sm", children: [_jsxs(Row, { color: "muted", textSize: "xs", className: "mb-1", align: "center", gap: "sm", children: [_jsx(Span, { weight: "medium", color: "muted", children: ROLE_LABEL[msg.authorRole ?? "user"] ?? msg.authorRole }), msg.createdAt && (_jsx(Span, { children: new Date(msg.createdAt).toLocaleString() }))] }), _jsx(Text, { className: "whitespace-pre-wrap", color: "primary", children: msg.body })] }, msg.id ?? i))) })] })), _jsxs(Stack, { gap: "xs", children: [_jsx(Label, { className: "uppercase tracking-wide", color: "muted", size: "xs", weight: "semibold", children: "Reply to user" }), _jsx(Textarea, { value: replyBody, onChange: (e) => setReplyBody(e.target.value), rows: 3, placeholder: "Type a reply\u2026" }), _jsx(Checkbox, { checked: alsoEmail, onChange: (e) => setAlsoEmail(e.target.checked), label: "Also email the user about this reply" }), _jsx(Button, { type: "button", variant: "primary", size: "sm", isLoading: replyMutation.isPending, disabled: !replyBody.trim() || !ticketId || replyMutation.isPending, onClick: () => replyMutation.mutate(), children: "Send reply" })] }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsx(RecordStatusTimeline, { entries: statusHistory, truncatedCount: statusHistoryTruncated }), _jsx(HorizontalRule, { tone: "subtle", spacing: "comfortable" }), _jsxs(FormShellContext.Provider, { value: form.shellCtx, children: [_jsx(FormErrorSummary, {}), _jsx(SectionForm, { sections: sections, values: draft, onChange: (partial) => setDraft((d) => ({ ...d, ...partial })), onSubmit: () => {
                                 // SectionForm scrolls to the first erroring section and then
                                 // submits regardless, so the guard lives here.
                                 form.clearErrors();

package/dist/features/admin/schemas/firestore.d.ts

@@ -4,7 +4,7 @@
  */
 import type { AboutContentDocument } from "../../about/schemas/firestore";
 export declare const ADMIN_CHECKOUT_BYPASS_FLAG_KEY: "adminCheckoutBypass";
-export declare const NOTIFICATION_TYPE_VALUES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale"];
+export declare const NOTIFICATION_TYPE_VALUES: readonly ["order_placed", "order_confirmed", "order_shipped", "order_delivered", "order_cancelled", "bid_placed", "bid_outbid", "bid_won", "bid_lost", "auction_ended", "review_approved", "review_replied", "product_available", "promotion", "system", "welcome", "account_action", "support_ticket_update", "scam_report_update", "offer_received", "offer_responded", "offer_expired", "offer_counter_accepted", "refund_initiated", "prize_won", "prize_reveal_expired", "emi_installment_due_soon", "emi_installment_overdue", "payment_review", "catalogue_images_stale"];
 export type NotificationType = (typeof NOTIFICATION_TYPE_VALUES)[number];
 /**
  * What a notification points AT. Drives the shared `actionUrl` resolver, so a
@@ -77,7 +77,7 @@ export type NotificationUpdateInput = Partial<Pick<NotificationDocument, "isRead
 export declare const notificationQueryHelpers: {
     readonly byUser: (userId: string) => readonly ["userId", "==", string];
     readonly unread: (userId: string) => readonly [readonly ["userId", "==", string], readonly ["isRead", "==", false]];
-    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale"];
+    readonly byType: (type: NotificationType) => readonly ["type", "==", "system" | "welcome" | "promotion" | "order_placed" | "order_confirmed" | "order_shipped" | "order_delivered" | "order_cancelled" | "bid_placed" | "bid_outbid" | "bid_won" | "bid_lost" | "auction_ended" | "review_approved" | "review_replied" | "product_available" | "account_action" | "support_ticket_update" | "scam_report_update" | "offer_received" | "offer_responded" | "offer_expired" | "offer_counter_accepted" | "refund_initiated" | "prize_won" | "prize_reveal_expired" | "emi_installment_due_soon" | "emi_installment_overdue" | "payment_review" | "catalogue_images_stale"];
 };
 export interface TrustBarItem {
     icon: string;
@@ -447,6 +447,36 @@ export interface SiteSettingsDocument extends BaseDocument {
         instagram?: string;
         linkedin?: string;
     };
+    /**
+     * The outbound-messaging kill switch and spend ceiling.
+     *
+     * Distinct from `notificationChannels`, which decides WHICH notification
+     * types a channel carries. This decides whether the channel runs at all and
+     * how much of the day's allowance it may spend — a site-wide posture rather
+     * than a per-type routing rule.
+     *
+     * 🛑 Every field here is PRIVATE. It is triaged into
+     * `PRIVATE_SITE_SETTINGS_FIELDS` in the public projection, and must stay
+     * there: the ceiling and the remaining headroom are operational detail, and
+     * publishing "email is currently off" tells an attacker that password-reset
+     * mail is not being watched.
+     */
+    messaging?: {
+        /** User-facing email. Staff mail (daily digest, payout summary) ignores this. */
+        emailEnabled: boolean;
+        /** User-facing WhatsApp. Same exemption for staff. */
+        whatsappEnabled: boolean;
+        /**
+         * Reserved sends allowed per channel per day. Applies to staff and
+         * transactional mail too — the ceiling exists to stay inside the
+         * provider's own limit, and the provider does not exempt anyone.
+         */
+        dailyCeiling: {
+            email: number;
+            whatsapp: number;
+            sms: number;
+        };
+    };
     emailSettings: {
         fromName: string;
         fromEmail: string;

package/dist/features/admin/schemas/firestore.js

@@ -49,7 +49,27 @@ export const NOTIFICATION_TYPE_VALUES = [
     "promotion",
     "system",
     "welcome",
+    /*
+     * 🛑 `account_action` means A BAN OR AN UNBAN, and nothing else.
+     *
+     * It used to also carry support-ticket activity AND scam-report outcomes —
+     * three unrelated concerns on one value, which made them impossible to tell
+     * apart anywhere downstream. That mattered the moment email became
+     * type-gated (see `EMAIL_ELIGIBLE_TYPES`): there was no way to stop emailing
+     * "your ticket got a reply" without also silencing "you have been banned",
+     * and those two have opposite answers. A banned user has to be told outside
+     * the app, because the app is what they just lost.
+     *
+     * Split 2026-09. If you are tempted to route a fourth concern through this
+     * value because it is vaguely account-shaped, add a type instead — the
+     * `Record<NotificationType, …>` maps will tell you everywhere that needs an
+     * answer.
+     */
     "account_action",
+    /** Support ticket created, replied to, or moved status. Bell-only by default — see `EMAIL_ELIGIBLE_TYPES`; staff can opt a single reply into email. */
+    "support_ticket_update",
+    /** Scam report received, verified, or rejected. Bell-only; the admin side rides the daily digest. */
+    "scam_report_update",
     "offer_received",
     "offer_responded",
     "offer_expired",
@@ -199,6 +219,14 @@ export const DEFAULT_SITE_SETTINGS_DATA = {
         smsVerification: false,
         adminCheckoutBypass: false,
     },
+    // Mirrors MESSAGE_BUDGET_DEFAULTS — both channels start OFF. A fresh install
+    // that has made no decision should be quiet, not mailing real people from a
+    // half-configured site.
+    messaging: {
+        emailEnabled: false,
+        whatsappEnabled: false,
+        dailyCeiling: { email: 80, whatsapp: 200, sms: 50 },
+    },
     emi: {
         enabled: false,
         minOrderValue: 10000,

package/dist/features/auth/actions/profile-actions.d.ts

@@ -39,7 +39,20 @@ export declare function getUserSessions(userId: string): Promise<import("..").Se
  * including ones inside sent notification emails.
  */
 export declare function resolveProfileUser(identifier: string): Promise<UserDocument | null>;
-export declare function getPublicUserProfile(userId: string): Promise<Pick<UserDocument, "id" | "slug" | "displayName" | "photoURL" | "role" | "createdAt" | "storeId" | "storeSlug" | "publicProfile" | "stats"> | null>;
+/**
+ * 🛑 React.cache-wrapped because a page and its generateMetadata both read it.
+ *
+ * `resolveProfileUser` tries up to THREE lookups (slug, id, uid), and
+ * `profile/[userId]/page.tsx` called this once in generateMetadata and again in
+ * the page body — so an uncached profile view cost up to six Firestore reads to
+ * answer one question. `sellers/[id]` had the same pair.
+ *
+ * This is the rule the SSR guide already states: every data-fetch exposed to a
+ * page + generateMetadata pair is memoised per argument list, so the second call
+ * is free. Note it caches the NARROW public projection, which is what both
+ * callers want; anything needing the whole document still goes to the repository.
+ */
+export declare const getPublicUserProfile: (userId: string) => Promise<Pick<UserDocument, "id" | "slug" | "displayName" | "photoURL" | "role" | "createdAt" | "storeId" | "storeSlug" | "publicProfile" | "stats"> | null>;
 /** Fetch approved reviews for a store. storeId === storeSlug in this project. */
 export declare function getSellerReviews(storeId: string): Promise<Review[]>;
 export declare function getProfileStoreProducts(storeId: string): Promise<import("../../products").ProductDocument[]>;

package/dist/features/auth/actions/profile-actions.js

@@ -4,6 +4,7 @@
  * Pure business functions for profile CRUD, seller stats, and session reads.
  * Auth, rate-limiting, and Next.js specifics are handled by the consumer.
  */
+import { cache } from "react";
 import { maskPublicReview } from "../../../security";
 import { safeRead } from "../../../errors/safe-read";
 import { finalizeStagedMediaField } from "../../media/finalize";
@@ -47,7 +48,20 @@ export async function resolveProfileUser(identifier) {
         return byId;
     return userRepository.findByUid(identifier);
 }
-export async function getPublicUserProfile(userId) {
+/**
+ * 🛑 React.cache-wrapped because a page and its generateMetadata both read it.
+ *
+ * `resolveProfileUser` tries up to THREE lookups (slug, id, uid), and
+ * `profile/[userId]/page.tsx` called this once in generateMetadata and again in
+ * the page body — so an uncached profile view cost up to six Firestore reads to
+ * answer one question. `sellers/[id]` had the same pair.
+ *
+ * This is the rule the SSR guide already states: every data-fetch exposed to a
+ * page + generateMetadata pair is memoised per argument list, so the second call
+ * is free. Note it caches the NARROW public projection, which is what both
+ * callers want; anything needing the whole document still goes to the repository.
+ */
+export const getPublicUserProfile = cache(async function getPublicUserProfile(userId) {
     const user = await resolveProfileUser(userId);
     if (!user)
         return null;
@@ -63,7 +77,7 @@ export async function getPublicUserProfile(userId) {
         publicProfile: user.publicProfile,
         stats: user.stats,
     };
-}
+});
 /** Fetch approved reviews for a store. storeId === storeSlug in this project. */
 export async function getSellerReviews(storeId) {
     const snapshot = await safeRead(() => reviewRepository.findApprovedByStore(storeId), { route: "/profile/[userId]", key: "reviews.findApprovedByStore", fallback: [] });

package/dist/features/auth/hooks/useAuth.d.ts

@@ -100,6 +100,11 @@ export declare function useResendVerification(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;
 }): import("@tanstack/react-query").UseMutationResult<JsonValue, Error, void | ResendVerificationData, unknown>;
+/** Thrown when the cooldown refuses — carries the wait so the UI can say it. */
+export declare class AuthMailCooldownError extends Error {
+    readonly retryAfterSeconds: number;
+    constructor(retryAfterSeconds: number);
+}
 export declare function useForgotPassword(options?: {
     onSuccess?: (data: JsonValue) => void;
     onError?: (error: Error) => void;

package/dist/features/auth/hooks/useAuth.js

@@ -373,9 +373,51 @@ export function useResendVerification(options) {
         onError: options?.onError,
     });
 }
+/**
+ * Ask the server whether this address may be sent an auth mail right now.
+ *
+ * Firebase's own auth mail goes browser → Firebase with no server hop, so
+ * nothing on our side can see it — including `applyRateLimit`. This gate is the
+ * only throttle these flows have, and it is deliberately advisory: a `false`
+ * from the network, a thrown request, or a missing route all resolve to
+ * "allowed", because a user locked out of their account must never be blocked
+ * from requesting a reset by our own infrastructure failing.
+ *
+ * See `src/app/api/auth/mail-gate/route.ts` for why this is an abuse guard
+ * rather than a security boundary.
+ */
+async function requestAuthMailPermission(email, purpose) {
+    try {
+        const res = await apiClient.post(AUTH_ENDPOINTS.MAIL_GATE, { email, purpose });
+        const data = (res?.data ?? res);
+        return {
+            allowed: data?.allowed !== false,
+            retryAfterSeconds: data?.retryAfterSeconds ?? 0,
+        };
+    }
+    catch (err) {
+        // Normalised then deliberately discarded: an unreachable gate is not an
+        // incident worth reporting, it is the documented fail-open path. The user
+        // still gets their reset mail; only the cooldown is skipped.
+        void normalizeError(err);
+        return { allowed: true, retryAfterSeconds: 0 };
+    }
+}
+/** Thrown when the cooldown refuses — carries the wait so the UI can say it. */
+export class AuthMailCooldownError extends Error {
+    constructor(retryAfterSeconds) {
+        const mins = Math.max(1, Math.ceil(retryAfterSeconds / 60));
+        super(`We've already sent that recently — please check your inbox, including spam. You can request another in ${mins} minute${mins === 1 ? "" : "s"}.`);
+        this.name = "AuthMailCooldownError";
+        this.retryAfterSeconds = retryAfterSeconds;
+    }
+}
 export function useForgotPassword(options) {
     return useMutation({
         mutationFn: async (data) => {
+            const gate = await requestAuthMailPermission(data.email, "password_reset");
+            if (!gate.allowed)
+                throw new AuthMailCooldownError(gate.retryAfterSeconds);
             await getClientAuthProvider().sendPasswordResetEmail(data.email);
             return { success: true };
         },

package/dist/features/checkout/actions/checkout-value-otp-actions.js

@@ -18,6 +18,7 @@ import { addressesRepository } from "../../addresses/repository/addresses.reposi
 import { siteSettingsRepository } from "../../admin/repository/site-settings.repository";
 import { sendWhatsAppBusinessMessage } from "../../whatsapp-bot/helpers/whatsapp";
 import { isChannelHealthy, withChannelRetry } from "../../../_internal/server/notifications/channel-health";
+import { guardSend, logSuppressedSend } from "../../../_internal/server/notifications/send-guard";
 import { CHECKOUT_VALUE_OTP_EXPIRY_MS, CHECKOUT_VALUE_OTP_MAX_ATTEMPTS, hashOtp, generateOtpCode, checkoutValueOtpRef, enforceCheckoutValueOtpRateLimit, buildCheckoutValueOtpMessage, } from "../../auth/checkout-value-otp";
 function maskEmail(userEmail) {
     const [local, domain] = userEmail.split("@");
@@ -82,6 +83,20 @@ export async function sendCheckoutValueOtp(userId, userEmail, channel = "email",
             createdAt: new Date(),
         });
         const message = buildCheckoutValueOtpMessage(code, siteName);
+        // Same guard as the email branch below, same reasoning: transactional, so
+        // the kill switch does not apply (the buyer cannot check out without the
+        // code), but the daily ceiling does.
+        const waGuard = {
+            channel: "whatsapp",
+            feature: "checkout_value_otp",
+            audience: "user",
+            transactional: true,
+        };
+        const waDecision = await guardSend(waGuard);
+        if (!waDecision.allow) {
+            logSuppressedSend(waGuard, waDecision);
+            throw new ValidationError("We couldn't send the verification code via WhatsApp — please try again, or send it by email instead.");
+        }
         try {
             const sent = await withChannelRetry("whatsapp", async () => {
                 const ok = await sendWhatsAppBusinessMessage({ toPhone: phone, message, phoneNumberId, accessToken });
@@ -126,6 +141,23 @@ export async function sendCheckoutValueOtp(userId, userEmail, channel = "email",
             <p style="color:#888;font-size:12px">This code expires in 10 minutes. If you did not request this, please ignore this email.</p>
           </div>
         `,
+            }, {
+                channel: "email",
+                feature: "checkout_value_otp",
+                audience: "user",
+                /*
+                 * The strongest case for `transactional` in the codebase: the buyer
+                 * is mid-checkout above the high-value threshold and CANNOT complete
+                 * the order without this code. Suppressing it does not quieten the
+                 * site, it breaks checkout — so it ignores the kill switch.
+                 *
+                 * It still counts against the daily ceiling, which is the honest
+                 * behaviour: if the provider is going to start rejecting, pretending
+                 * otherwise here just moves the failure somewhere less legible. The
+                 * 15-minute per-user cooldown in `checkout-value-otp.ts` already
+                 * bounds how much of the allowance one buyer can consume.
+                 */
+                transactional: true,
             });
             if (error)
                 throw new Error(String(error));

package/dist/features/contact/email.d.ts

@@ -1,4 +1,5 @@
 import "server-only";
+import type { SendGuardContext } from "../../_internal/shared/features/messaging/config";
 import type { JsonValue } from "@mohasinac/appkit";
 type SendEmailOptions = Record<string, JsonValue> & {
     to: string | string[];
@@ -9,17 +10,37 @@ type SendEmailOptions = Record<string, JsonValue> & {
     cc?: string | string[];
     replyTo?: string;
 };
-export declare function sendEmail(opts: SendEmailOptions): Promise<{
+/**
+ * Everything `sendEmail` needs beyond the message itself.
+ *
+ * 🛑 REQUIRED, and that is the entire enforcement mechanism.
+ *
+ * There is no `guard?:` and no default. A sender that cannot say who this mail
+ * is for and what it is does not compile, so "someone forgot to guard a new
+ * send path" is not a class of bug that can occur — which is what a
+ * suppression-marker-and-audit approach would only have made *detectable*
+ * (CLAUDE.md Rule #22: make the wrong thing unrepresentable).
+ *
+ * Kept as a separate second parameter rather than a field on
+ * `SendEmailOptions` because that type has a `Record<string, JsonValue>` index
+ * signature — a structured object would not satisfy it, and widening the index
+ * signature to accommodate one field would weaken every other field's typing.
+ */
+export type SendEmailGuard = SendGuardContext;
+/**
+ * Send one email, subject to the messaging guard.
+ *
+ * `suppressed` is a THIRD outcome, distinct from both success and failure, and
+ * callers must treat it as such: `{ data: null, error: null }` means the
+ * message was deliberately not sent, so a caller that only checks `error` will
+ * correctly not raise an alarm, and one that wants to know can read
+ * `suppressed`. Returning an `error` for a suppression would have turned every
+ * intentional quiet into a logged incident.
+ */
+export declare function sendEmail(opts: SendEmailOptions, guard: SendEmailGuard): Promise<{
     data: JsonValue;
     error: JsonValue;
-}>;
-export declare function sendVerificationEmailWithLink(email: string, verificationLink: string): Promise<{
-    success: boolean;
-    data?: JsonValue;
-}>;
-export declare function sendPasswordResetEmailWithLink(email: string, resetLink: string): Promise<{
-    success: boolean;
-    data?: JsonValue;
+    suppressed?: string;
 }>;
 export interface OrderConfirmationEmailParams {
     to: string;
@@ -43,15 +64,6 @@ export declare function sendOrderConfirmationEmail(params: OrderConfirmationEmai
     success: boolean;
     data?: JsonValue;
 }>;
-export declare function sendContactEmail(params: {
-    name: string;
-    email: string;
-    subject: string;
-    message: string;
-}): Promise<{
-    success: boolean;
-    data?: JsonValue;
-}>;
 export declare function sendDigitalCodeClaimedEmail(params: {
     to: string;
     userName: string;
@@ -60,12 +72,4 @@ export declare function sendDigitalCodeClaimedEmail(params: {
 }): Promise<{
     success: boolean;
 }>;
-export declare function sendSiteSettingsChangedEmail(params: {
-    adminEmails: string[];
-    changedByEmail: string;
-    changedFields: string[];
-}): Promise<{
-    success: boolean;
-    data?: JsonValue;
-}>;
 export {};