@mohasinac/appkit 4.35.0 → 4.35.2

package/dist/features/contact/email.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import "server-only";
 // Lazy-load `renderToStaticMarkup` via `require()` to avoid Next.js's
 // Server-Component static-trace error. Even with the `server-only`
@@ -12,12 +12,13 @@ function renderToStaticMarkup(el) {
     return m.renderToStaticMarkup(el);
 }
 import { normalizeError } from "../../errors/normalize";
+import { guardSend, logSuppressedSend } from "../../_internal/server/notifications/send-guard";
 import { getProviders } from "../../contracts";
 import { createResendProvider } from "../../providers/email-resend/provider";
 import { siteSettingsRepository } from "../admin/repository/site-settings.repository";
 import { serverLogger } from "../../monitoring";
-import { currentYear, formatCurrency, formatDateTime, nowMs, } from "../../utils";
-import { EmailBold, EmailButton, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailLink, EmailRow, } from "../email/primitives";
+import { currentYear, formatCurrency, } from "../../utils";
+import { EmailBold, EmailButton, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailRow, } from "../email/primitives";
 function getSiteName() {
     return process.env.NEXT_PUBLIC_SITE_NAME?.trim() || "App";
 }
@@ -79,7 +80,22 @@ async function resolveEmailProvider() {
         });
     }
 }
-export async function sendEmail(opts) {
+/**
+ * Send one email, subject to the messaging guard.
+ *
+ * `suppressed` is a THIRD outcome, distinct from both success and failure, and
+ * callers must treat it as such: `{ data: null, error: null }` means the
+ * message was deliberately not sent, so a caller that only checks `error` will
+ * correctly not raise an alarm, and one that wants to know can read
+ * `suppressed`. Returning an `error` for a suppression would have turned every
+ * intentional quiet into a logged incident.
+ */
+export async function sendEmail(opts, guard) {
+    const decision = await guardSend(guard);
+    if (!decision.allow) {
+        logSuppressedSend(guard, decision);
+        return { data: null, error: null, suppressed: decision.reason };
+    }
     try {
         const provider = await resolveEmailProvider();
         const data = await provider.send({
@@ -103,54 +119,12 @@ export async function sendEmail(opts) {
         return { data: null, error: error instanceof Error ? error.message : String(error) };
     }
 }
-async function sendConfiguredEmail(opts) {
-    return sendEmail(opts);
+async function sendConfiguredEmail(opts, guard) {
+    return sendEmail(opts, guard);
 }
 const PARA_STYLE = { margin: "0 0 12px", fontSize: "14px", lineHeight: "1.6" };
 const LABEL_STYLE = { color: "#71717a", fontSize: "13px" };
 const VALUE_STYLE = { color: "#18181b", fontSize: "14px", fontWeight: 600 };
-export async function sendVerificationEmailWithLink(email, verificationLink) {
-    const siteName = getSiteName();
-    const html = `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: `Verify your ${siteName} email`, children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName }), _jsxs(EmailRow, { children: [_jsx("p", { style: PARA_STYLE, children: "Click the link below to verify your email address. This link expires in 24 hours." }), _jsx(EmailButton, { href: verificationLink, children: "Verify email" })] }), _jsx(EmailFooter, { copyright: `© ${currentYear()} ${siteName}. All rights reserved.` })] }) }))}`;
-    try {
-        const { data, error } = await sendConfiguredEmail({
-            to: email,
-            subject: `Verify your ${siteName} email address`,
-            html,
-            text: `Verify your email: ${verificationLink}\n\nThis link expires in 24 hours.`,
-        });
-        if (error) {
-            serverLogger.error("Failed to send verification email (link)", { error });
-            throw error;
-        }
-        return { success: true, data };
-    }
-    catch (error) {
-        serverLogger.error("Error sending verification email (link)", { error });
-        throw error;
-    }
-}
-export async function sendPasswordResetEmailWithLink(email, resetLink) {
-    const siteName = getSiteName();
-    const html = `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: `Reset your ${siteName} password`, children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName }), _jsxs(EmailRow, { children: [_jsx("p", { style: PARA_STYLE, children: "Click the link below to reset your password. This link expires in 1 hour." }), _jsx(EmailButton, { href: resetLink, children: "Reset password" }), _jsx("p", { style: { ...PARA_STYLE, color: "#71717a" }, children: "If you didn't request this, you can safely ignore this email." })] }), _jsx(EmailFooter, { copyright: `© ${currentYear()} ${siteName}. All rights reserved.` })] }) }))}`;
-    try {
-        const { data, error } = await sendConfiguredEmail({
-            to: email,
-            subject: `Reset your ${siteName} password`,
-            html,
-            text: `Reset your password: ${resetLink}\n\nThis link expires in 1 hour.\n\nIf you didn't request this, ignore this email.`,
-        });
-        if (error) {
-            serverLogger.error("Failed to send password reset email (link)", { error });
-            throw error;
-        }
-        return { success: true, data };
-    }
-    catch (error) {
-        serverLogger.error("Error sending password reset email (link)", { error });
-        throw error;
-    }
-}
 function renderOrderItems(items, productTitle, quantity, currency) {
     if (items && items.length > 1) {
         return (_jsxs(_Fragment, { children: [_jsxs("p", { style: { ...PARA_STYLE, fontWeight: 600 }, children: ["Items (", items.length, ")"] }), items.map((item, idx) => (_jsxs("p", { style: PARA_STYLE, children: [item.productTitle, " \u00D7 ", item.quantity, " \u2014", " ", _jsx(EmailBold, { children: formatCurrency(item.totalPrice, currency) })] }, item.productId ?? idx)))] }));
@@ -176,6 +150,18 @@ export async function sendOrderConfirmationEmail(params) {
             subject: `Order Confirmed — ${orderId}`,
             html,
             text: `Hi ${userName},\n\nYour order ${orderId} has been confirmed!\n\n${itemsText}\nTotal: ${formattedTotal}\nPayment: ${paymentLabel}\nShip to: ${shippingAddress ?? "-"}\n\nView your order: ${orderUrl}\n\n© ${currentYear()} ${siteName}`,
+        }, {
+            channel: "email",
+            feature: "order_confirmation",
+            audience: "user",
+            /*
+             * Transactional: this is the buyer's receipt for money already taken.
+             * It ignores the kill switch — a site that has quietened its marketing
+             * must still confirm the orders it accepted — but it is still counted
+             * against the daily ceiling, because the ceiling exists to stay inside
+             * the provider's limit and the provider does not exempt receipts.
+             */
+            transactional: true,
         });
         if (error) {
             serverLogger.error("Failed to send order confirmation email", { error });
@@ -189,31 +175,29 @@ export async function sendOrderConfirmationEmail(params) {
         return { success: false };
     }
 }
-export async function sendContactEmail(params) {
-    const siteName = getSiteName();
-    const supportEmail = getSupportEmail();
-    const { name, email, subject, message } = params;
-    const html = `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: "New contact message", children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName, children: "New Contact Message" }), _jsxs(EmailRow, { children: [_jsxs("p", { style: PARA_STYLE, children: [_jsx("span", { style: LABEL_STYLE, children: "From:" }), " ", _jsxs("span", { style: VALUE_STYLE, children: [name, " <", _jsx(EmailLink, { href: `mailto:${email}`, children: email }), ">"] })] }), _jsxs("p", { style: PARA_STYLE, children: [_jsx("span", { style: LABEL_STYLE, children: "Subject:" }), " ", _jsx("span", { style: VALUE_STYLE, children: subject })] }), _jsx(EmailDivider, { spacing: "md" }), _jsx("p", { style: { ...PARA_STYLE, whiteSpace: "pre-wrap" }, children: message })] }), _jsx(EmailFooter, { copyright: `© ${currentYear()} ${siteName}` })] }) }))}`;
-    try {
-        const { data, error } = await sendConfiguredEmail({
-            to: supportEmail,
-            replyTo: email,
-            subject: `[Contact] ${subject}`,
-            html,
-            text: `From: ${name} <${email}>\nSubject: ${subject}\n\n${message}`,
-        });
-        if (error) {
-            serverLogger.error("Failed to send contact email", { error });
-            return { success: false };
-        }
-        return { success: true, data };
-    }
-    catch (error) {
-        void normalizeError(error);
-        serverLogger.error("Error sending contact email", { error });
-        return { success: false };
-    }
-}
+/*
+ * `sendContactEmail` was deleted here 2026-09. A contact-form submission is now
+ * a RECORD, not an email.
+ *
+ * It already wrote to `contactSubmissions` and already had a full admin inbox
+ * at `/admin/contact` with read/resolve flags — the email was a duplicate
+ * signal on top of a queue that existed. Each submission now appears in the
+ * daily digest with a `mailto:` reply link, which costs nothing and puts the
+ * reply in the operator's own mailbox rather than routing it back out through
+ * a 100/day allowance.
+ *
+ * 🛑 Two things had to change together for this to be safe, and the second is
+ * the one that bites:
+ *
+ *   1. `/api/contact` must AWAIT the Firestore write and fail the request when
+ *      it fails. It was fire-and-forget `.catch()`-and-continue, with the email
+ *      as the de-facto backup — so with the email gone, a dropped write would
+ *      have silently lost a customer's message.
+ *   2. `getSupportEmail()` went with it. Its fallback was
+ *      `"support@example.com"` and `EMAIL_SUPPORT` was never set in any
+ *      runtime, so every contact email this function ever "sent" went to a
+ *      domain nobody owns. That is a bug this deletion happens to fix.
+ */
 export async function sendDigitalCodeClaimedEmail(params) {
     const siteName = getSiteName();
     const siteUrl = getSiteUrl();
@@ -226,6 +210,14 @@ export async function sendDigitalCodeClaimedEmail(params) {
             subject: `Your digital code for "${productTitle}" is ready`,
             html,
             text: `Hi ${userName},\n\nYour digital code for "${productTitle}" (Order: ${orderId}) is ready to reveal.\n\nVisit your order: ${orderUrl}\n\nFor security, the code is only shown inside your ${siteName} account.\n\n© ${currentYear()} ${siteName}`,
+        }, {
+            channel: "email",
+            feature: "digital_code_claimed",
+            audience: "user",
+            // Transactional: the buyer has paid and this is how they learn the
+            // thing they bought is available to collect. Suppressing it would be
+            // taking money and saying nothing.
+            transactional: true,
         });
         if (error) {
             serverLogger.error("Failed to send digital code claimed email", { error });
@@ -239,35 +231,3 @@ export async function sendDigitalCodeClaimedEmail(params) {
         return { success: false };
     }
 }
-export async function sendSiteSettingsChangedEmail(params) {
-    const siteName = getSiteName();
-    const siteUrl = getSiteUrl();
-    const { adminEmails, changedByEmail, changedFields } = params;
-    if (adminEmails.length === 0)
-        return { success: false };
-    const settingsUrl = `${siteUrl}/admin/site-settings`;
-    const timestamp = formatDateTime(nowMs());
-    const html = `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: "Site settings changed", children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName, children: "Site Settings Changed \u2699\uFE0F" }), _jsxs(EmailRow, { children: [_jsxs("p", { style: PARA_STYLE, children: [_jsx(EmailBold, { children: changedByEmail }), " has updated the following site settings:"] }), _jsxs("p", { style: PARA_STYLE, children: [_jsx("span", { style: LABEL_STYLE, children: "Changed fields:" }), " ", _jsx("span", { style: VALUE_STYLE, children: changedFields.join(", ") })] }), _jsxs("p", { style: PARA_STYLE, children: [_jsx("span", { style: LABEL_STYLE, children: "Changed by:" }), " ", _jsx("span", { style: VALUE_STYLE, children: changedByEmail })] }), _jsxs("p", { style: PARA_STYLE, children: [_jsx("span", { style: LABEL_STYLE, children: "Timestamp:" }), " ", _jsx("span", { style: VALUE_STYLE, children: timestamp })] }), _jsx(EmailDivider, { spacing: "md" }), _jsx(EmailButton, { href: settingsUrl, children: "View settings" })] }), _jsx(EmailFooter, { copyright: `© ${currentYear()} ${siteName}. Automated notification — do not reply.` })] }) }))}`;
-    try {
-        const { data, error } = await sendConfiguredEmail({
-            to: adminEmails,
-            subject: `Site settings updated by ${changedByEmail}`,
-            html,
-            text: `Site settings updated by ${changedByEmail}\n\nChanged fields: ${changedFields.join(", ")}\n\nView at: ${settingsUrl}`,
-        });
-        if (error) {
-            serverLogger.error("Failed to send settings change notification email", {
-                error,
-            });
-            return { success: false };
-        }
-        return { success: true, data };
-    }
-    catch (error) {
-        void normalizeError(error);
-        serverLogger.error("Error sending settings change notification email", {
-            error,
-        });
-        return { success: false };
-    }
-}

package/dist/features/email/notification-templates.js

@@ -76,6 +76,17 @@ export const NOTIFICATION_EMAIL_TEMPLATES = {
     // No CTA for the same reason — a system announcement has no record behind
     // it, and `resolveNotificationActionUrl` correctly returns undefined.
     system: { lead: "A message from the team." },
+    /*
+     * Both types are email-INELIGIBLE (`EMAIL_ELIGIBLE_TYPES`), so neither
+     * renders in the ordinary course — but they still need real entries rather
+     * than placeholders, because `support_ticket_update` DOES reach this
+     * renderer whenever a staff replier ticks "also email the user".
+     * `scam_report_update` cannot reach it today; it gets an honest entry anyway
+     * so that a future override path finds a written template instead of
+     * inventing one under time pressure.
+     */
+    support_ticket_update: { lead: "There's an update on your support ticket.", cta: "View ticket" },
+    scam_report_update: { lead: "There's an update on a scam report you filed.", cta: "View report" },
 };
 /**
  * Render one notification as an email.

package/dist/features/messaging/repository/message-budget.repository.d.ts

@@ -0,0 +1,73 @@
+import { BaseRepository } from "../../../providers/db-firebase";
+import { type AuthMailCooldownDocument, type AuthMailPurpose, type MessageBudgetDocument } from "../schemas/firestore";
+import type { MessageChannel } from "../../../_internal/shared/features/messaging/config";
+/**
+ * `en-CA` because it formats as YYYY-MM-DD natively — the alternative is
+ * hand-assembling parts from `formatToParts`, which is the same thing with
+ * more places to get it wrong.
+ */
+export declare function budgetDateString(now?: Date): string;
+export declare class MessageBudgetRepository extends BaseRepository<MessageBudgetDocument> {
+    constructor();
+    /**
+     * Claim one unit of today's allowance for `channel`.
+     *
+     * ## Reserve-then-send, on purpose
+     *
+     * The unit is consumed BEFORE the provider call, so a send that then fails
+     * still costs the budget. That is the conservative direction and it is the
+     * right one here: on an 80/day allowance, over-counting means we stop a
+     * little early, while under-counting means the provider starts rejecting and
+     * every subsequent message — including the transactional ones — is lost.
+     *
+     * There is deliberately no `release()`. A failing channel is already handled
+     * one layer up by the circuit breaker in
+     * `_internal/server/notifications/channel-health.ts`, which halts the channel
+     * after 3 failures; adding a compensating decrement here would mean a
+     * partially-failed send could double-refund, which is exactly the kind of
+     * subtle accounting bug a quota guard must not have.
+     *
+     * ## Why a single document and not a sharded counter
+     *
+     * Firestore sustains roughly one write per second on one document, so a
+     * concurrent burst would contend. There is no such burst left: the
+     * `EMAIL_ELIGIBLE_TYPES` gate in `sendNotification` returns before this
+     * function is ever reached for the two fan-outs that had one (`bid_lost`,
+     * 50-way, and the old scam-report employee blast, 100-way), and every
+     * remaining email-eligible caller loops sequentially with `await`.
+     *
+     * 🛑 If a concurrent fan-out of an email-ELIGIBLE type is ever added —
+     * `Promise.all`/`Promise.allSettled` over sends is the tell — this must be
+     * sharded before it merges. `scripts/audit-unguarded-send.mjs` fails the
+     * build on that pattern precisely so the decision cannot be made by
+     * accident.
+     */
+    reserveSend(channel: MessageChannel, ceiling: number, now?: Date): Promise<{
+        allowed: boolean;
+        count: number;
+        ceiling: number;
+    }>;
+    /** Read-only, for the daily digest. Never creates the document. */
+    getCount(channel: MessageChannel, now?: Date): Promise<number>;
+}
+export declare class AuthMailCooldownRepository extends BaseRepository<AuthMailCooldownDocument> {
+    constructor();
+    /**
+     * Has this address already asked for this kind of mail recently?
+     *
+     * 🛑 `emailHash` must already be hashed by the caller — this function never
+     * sees a real address, and the collection stores none. Passing a plaintext
+     * email here would put an unencrypted identity into a collection with no PII
+     * handling, which is exactly the leak `SUPPORT_TICKET_PII_FIELDS` and
+     * friends exist to prevent.
+     *
+     * Transactional check-and-set rather than read-then-write: two tabs hitting
+     * "resend" at once must not both pass.
+     */
+    checkAndSet(purpose: AuthMailPurpose, emailHash: string, now?: Date): Promise<{
+        allowed: boolean;
+        retryAfterSeconds: number;
+    }>;
+}
+export declare const messageBudgetRepository: MessageBudgetRepository;
+export declare const authMailCooldownRepository: AuthMailCooldownRepository;

package/dist/features/messaging/repository/message-budget.repository.js

@@ -0,0 +1,138 @@
+import { BaseRepository } from "../../../providers/db-firebase";
+import { AUTH_MAIL_COOLDOWN_COLLECTION, AUTH_MAIL_COOLDOWN_MS, MESSAGE_BUDGET_COLLECTION, MESSAGE_BUDGET_FIELDS, } from "../schemas/firestore";
+/**
+ * Reporting timezone for "which day is it". Fixed rather than server-local
+ * because a Vercel lambda runs in UTC and a Firebase Function in whatever
+ * region it was deployed to — two runtimes disagreeing about the date would
+ * silently give the site two partial budgets around midnight IST.
+ *
+ * Matches the daily digest's own cron timezone, so "today" means the same
+ * thing in the counter and in the report of the counter.
+ */
+const BUDGET_TIMEZONE = "Asia/Kolkata";
+/**
+ * `en-CA` because it formats as YYYY-MM-DD natively — the alternative is
+ * hand-assembling parts from `formatToParts`, which is the same thing with
+ * more places to get it wrong.
+ */
+export function budgetDateString(now = new Date()) {
+    return new Intl.DateTimeFormat("en-CA", {
+        timeZone: BUDGET_TIMEZONE,
+        year: "numeric",
+        month: "2-digit",
+        day: "2-digit",
+    }).format(now);
+}
+export class MessageBudgetRepository extends BaseRepository {
+    constructor() {
+        super(MESSAGE_BUDGET_COLLECTION);
+    }
+    /**
+     * Claim one unit of today's allowance for `channel`.
+     *
+     * ## Reserve-then-send, on purpose
+     *
+     * The unit is consumed BEFORE the provider call, so a send that then fails
+     * still costs the budget. That is the conservative direction and it is the
+     * right one here: on an 80/day allowance, over-counting means we stop a
+     * little early, while under-counting means the provider starts rejecting and
+     * every subsequent message — including the transactional ones — is lost.
+     *
+     * There is deliberately no `release()`. A failing channel is already handled
+     * one layer up by the circuit breaker in
+     * `_internal/server/notifications/channel-health.ts`, which halts the channel
+     * after 3 failures; adding a compensating decrement here would mean a
+     * partially-failed send could double-refund, which is exactly the kind of
+     * subtle accounting bug a quota guard must not have.
+     *
+     * ## Why a single document and not a sharded counter
+     *
+     * Firestore sustains roughly one write per second on one document, so a
+     * concurrent burst would contend. There is no such burst left: the
+     * `EMAIL_ELIGIBLE_TYPES` gate in `sendNotification` returns before this
+     * function is ever reached for the two fan-outs that had one (`bid_lost`,
+     * 50-way, and the old scam-report employee blast, 100-way), and every
+     * remaining email-eligible caller loops sequentially with `await`.
+     *
+     * 🛑 If a concurrent fan-out of an email-ELIGIBLE type is ever added —
+     * `Promise.all`/`Promise.allSettled` over sends is the tell — this must be
+     * sharded before it merges. `scripts/audit-unguarded-send.mjs` fails the
+     * build on that pattern precisely so the decision cannot be made by
+     * accident.
+     */
+    async reserveSend(channel, ceiling, now = new Date()) {
+        const date = budgetDateString(now);
+        const docRef = this.db.collection(this.collection).doc(`${channel}_${date}`);
+        return this.db.runTransaction(async (tx) => {
+            const snap = await tx.get(docRef);
+            const current = snap.exists
+                ? (snap.data()?.[MESSAGE_BUDGET_FIELDS.COUNT] ?? 0)
+                : 0;
+            if (current >= ceiling) {
+                return { allowed: false, count: current, ceiling };
+            }
+            const next = current + 1;
+            tx.set(docRef, {
+                [MESSAGE_BUDGET_FIELDS.CHANNEL]: channel,
+                [MESSAGE_BUDGET_FIELDS.DATE]: date,
+                [MESSAGE_BUDGET_FIELDS.COUNT]: next,
+                [MESSAGE_BUDGET_FIELDS.UPDATED_AT]: now,
+            }, { merge: true });
+            return { allowed: true, count: next, ceiling };
+        });
+    }
+    /** Read-only, for the daily digest. Never creates the document. */
+    async getCount(channel, now = new Date()) {
+        const snap = await this.db
+            .collection(this.collection)
+            .doc(`${channel}_${budgetDateString(now)}`)
+            .get();
+        return snap.exists
+            ? (snap.data()?.[MESSAGE_BUDGET_FIELDS.COUNT] ?? 0)
+            : 0;
+    }
+}
+export class AuthMailCooldownRepository extends BaseRepository {
+    constructor() {
+        super(AUTH_MAIL_COOLDOWN_COLLECTION);
+    }
+    /**
+     * Has this address already asked for this kind of mail recently?
+     *
+     * 🛑 `emailHash` must already be hashed by the caller — this function never
+     * sees a real address, and the collection stores none. Passing a plaintext
+     * email here would put an unencrypted identity into a collection with no PII
+     * handling, which is exactly the leak `SUPPORT_TICKET_PII_FIELDS` and
+     * friends exist to prevent.
+     *
+     * Transactional check-and-set rather than read-then-write: two tabs hitting
+     * "resend" at once must not both pass.
+     */
+    async checkAndSet(purpose, emailHash, now = new Date()) {
+        const docRef = this.db
+            .collection(this.collection)
+            .doc(`${purpose}_${emailHash}`);
+        return this.db.runTransaction(async (tx) => {
+            const snap = await tx.get(docRef);
+            const lastRequestedAt = snap.exists
+                ? (snap.data()?.lastRequestedAt?.toDate?.() ?? null)
+                : null;
+            // `Infinity` when there is no prior request, so the single comparison
+            // below covers both "never asked" and "asked long enough ago" — flatter
+            // than nesting the null check around the elapsed check.
+            const elapsed = lastRequestedAt
+                ? now.getTime() - lastRequestedAt.getTime()
+                : Number.POSITIVE_INFINITY;
+            if (elapsed < AUTH_MAIL_COOLDOWN_MS) {
+                return {
+                    allowed: false,
+                    retryAfterSeconds: Math.ceil((AUTH_MAIL_COOLDOWN_MS - elapsed) / 1000),
+                };
+            }
+            tx.set(docRef, { purpose, lastRequestedAt: now }, { merge: true });
+            return { allowed: true, retryAfterSeconds: 0 };
+        });
+    }
+}
+export const messageBudgetRepository = new MessageBudgetRepository();
+export const authMailCooldownRepository = new AuthMailCooldownRepository();

package/dist/features/messaging/schemas/firestore.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The daily send counter.
+ *
+ * One document per channel per calendar day. It exists because the only other
+ * rate limiter in this codebase cannot do this job: `appkit/src/security/rate-limit.ts`
+ * falls back to a module-scope `Map` when Upstash is unconfigured (it is), so
+ * on Vercel the count is per-lambda-instance and resets on every cold start.
+ * That is fine for "slow down this IP" and useless for "we have 100 of these
+ * to spend today".
+ *
+ * Firestore is the only shared, durable counter this project already pays for.
+ * The shape is copied deliberately from `SmsCounterDocument` — same
+ * date-keyed-document, same transactional increment — because that pattern has
+ * been in production on the OTP path and there is no reason to invent a second
+ * one.
+ */
+import type { BaseDocument } from "../../../_internal/shared/types/base-document";
+import type { MessageChannel } from "../../../_internal/shared/features/messaging/config";
+/**
+ * The document ID is `{channel}_{YYYY-MM-DD}` — composite rather than a
+ * subcollection so the whole thing is one `.doc()` lookup with no query, no
+ * index, and no fan-out. `id` itself comes from `BaseDocument`.
+ */
+export interface MessageBudgetDocument extends BaseDocument {
+    channel: MessageChannel;
+    /** Calendar date in the site's reporting timezone — YYYY-MM-DD. */
+    date: string;
+    /** Messages RESERVED today. Reserved, not delivered — see `reserveSend`. */
+    count: number;
+}
+export declare const MESSAGE_BUDGET_COLLECTION: "messageBudget";
+export declare const MESSAGE_BUDGET_FIELDS: {
+    readonly CHANNEL: "channel";
+    readonly DATE: "date";
+    readonly COUNT: "count";
+    readonly UPDATED_AT: "updatedAt";
+};
+/**
+ * Cooldown ledger for the Firebase-side auth mails (password reset, email
+ * verification), which never touch this app's server and so cannot be guarded
+ * where the others are.
+ *
+ * 🛑 `id` is a HASH of the email address, never the address itself. This
+ * collection is not PII-encrypted and does not need to be — the whole point is
+ * that it stores no identity, only the fact that *something* asked recently.
+ */
+export interface AuthMailCooldownDocument extends BaseDocument {
+    /** Document ID is `{purpose}_{hmac(email)}`; `id` comes from BaseDocument. */
+    purpose: AuthMailPurpose;
+    lastRequestedAt: Date;
+}
+export declare const AUTH_MAIL_COOLDOWN_COLLECTION: "authMailCooldowns";
+export declare const AUTH_MAIL_PURPOSE_VALUES: readonly ["password_reset", "verify_email"];
+export type AuthMailPurpose = (typeof AUTH_MAIL_PURPOSE_VALUES)[number];
+/**
+ * How long a given address must wait between requests of the same kind.
+ *
+ * 15 minutes matches the two cooldowns already in this codebase — the checkout
+ * value OTP and the SMS OTP — so a user who hits two of them in one session
+ * meets one consistent rule rather than three different ones.
+ */
+export declare const AUTH_MAIL_COOLDOWN_MS: number;

package/dist/features/messaging/schemas/firestore.js

@@ -0,0 +1,36 @@
+/**
+ * The daily send counter.
+ *
+ * One document per channel per calendar day. It exists because the only other
+ * rate limiter in this codebase cannot do this job: `appkit/src/security/rate-limit.ts`
+ * falls back to a module-scope `Map` when Upstash is unconfigured (it is), so
+ * on Vercel the count is per-lambda-instance and resets on every cold start.
+ * That is fine for "slow down this IP" and useless for "we have 100 of these
+ * to spend today".
+ *
+ * Firestore is the only shared, durable counter this project already pays for.
+ * The shape is copied deliberately from `SmsCounterDocument` — same
+ * date-keyed-document, same transactional increment — because that pattern has
+ * been in production on the OTP path and there is no reason to invent a second
+ * one.
+ */
+export const MESSAGE_BUDGET_COLLECTION = "messageBudget";
+export const MESSAGE_BUDGET_FIELDS = {
+    CHANNEL: "channel",
+    DATE: "date",
+    COUNT: "count",
+    UPDATED_AT: "updatedAt",
+};
+export const AUTH_MAIL_COOLDOWN_COLLECTION = "authMailCooldowns";
+export const AUTH_MAIL_PURPOSE_VALUES = [
+    "password_reset",
+    "verify_email",
+];
+/**
+ * How long a given address must wait between requests of the same kind.
+ *
+ * 15 minutes matches the two cooldowns already in this codebase — the checkout
+ * value OTP and the SMS OTP — so a user who hits two of them in one session
+ * meets one consistent rule rather than three different ones.
+ */
+export const AUTH_MAIL_COOLDOWN_MS = 15 * 60 * 1000;

package/dist/features/tester/seed-data/carts-tester-seed-data.d.ts

@@ -0,0 +1,3 @@
+import type { CartDocument } from "../../cart/schemas/firestore";
+/** The cart document id IS the user id — one cart per account. */
+export declare const cartsTesterSeedData: Partial<CartDocument>[];

package/dist/features/tester/seed-data/carts-tester-seed-data.js

@@ -0,0 +1,70 @@
+/*
+ * WHY: Shared tester sandbox — the LOCKED cart line a settled auction leaves behind.
+ * WHAT: One cart for user-tester-qa holding the win from auction-tester-sandbox-won.
+ *
+ * 🛑 WHY THIS FILE HAD TO EXIST.
+ *
+ * The sandbox seeded a won auction, its winning bid, and a delivered order made
+ * from it — the shape settlement produced BEFORE Root Cause #60, when it wrote an
+ * order document directly. That order was in a shape no orders list could render
+ * and no checkout could accept, so a winner had no way to pay at all; the fix
+ * routed a win through the CART as a locked line instead.
+ *
+ * The fixtures were never updated to match. So `win-auction` — the case whose
+ * label is literally "creates a payable locked cart line, not a stuck order" —
+ * could not pass: /user/bids offered "Pay now", it led to /checkout?lane=auction,
+ * and the cart was empty. Found by the tester 2026-09-06, which is exactly the
+ * kind of thing a case can only prove by being run.
+ *
+ * The delivered order fixture STAYS. It is the "win already completed" state and
+ * other cases read it. This adds the missing "win awaiting payment" state.
+ *
+ * 🛑 `isAuctionWin` is not decoration. `laneOf()` keys on `isAuctionWin || bidId`
+ * and ignores `listingType` and `locked` entirely — a line without it lands in the
+ * STANDARD lane, so the Won Auctions tab stays empty while a non-removable line
+ * sits in the ordinary cart. Both fields are set here so the lane is unambiguous.
+ *
+ * @tag domain:tester
+ * @tag layer:seed
+ * @tag pattern:none
+ * @tag access:server-only
+ * @tag consumers:seed/index.ts,seed/manifest.ts
+ * @tag sideEffects:none
+ */
+import { testDataExpiresAt } from "./tester-ttl";
+const NOW = new Date();
+const hoursAgo = (n) => new Date(NOW.getTime() - n * 3600000);
+/** The cart document id IS the user id — one cart per account. */
+export const cartsTesterSeedData = [
+    {
+        id: "user-tester-qa",
+        userId: "user-tester-qa",
+        items: [
+            {
+                itemId: "cartitem-tester-sandbox-auction-won",
+                productId: "auction-tester-sandbox-won",
+                productTitle: "Test Auction — Already Won",
+                price: 15000,
+                currency: "INR",
+                quantity: 1,
+                storeId: "store-tester-qa-seller",
+                storeName: "Tester QA Seller",
+                listingType: "auction",
+                // Both, deliberately — see the lane note in the header.
+                isAuctionWin: true,
+                bidId: "bid-tester-sandbox-won-tester-qa",
+                // A win is non-removable and fixed-quantity: settlement is the only writer
+                // of this line, and declining to pay is handled by the forfeit sweep rather
+                // than by the buyer deleting it.
+                locked: true,
+                lockedPrice: 15000,
+                addedAt: hoursAgo(2),
+                updatedAt: hoursAgo(2),
+            },
+        ],
+        isTestData: true,
+        testDataExpiresAt: testDataExpiresAt(),
+        createdAt: hoursAgo(2),
+        updatedAt: hoursAgo(2),
+    },
+];

package/dist/features/tester/seed-data/index.d.ts

@@ -6,5 +6,6 @@ export { blogTesterSeedData } from "./blog-tester-seed-data";
 export { eventsTesterSeedData } from "./events-tester-seed-data";
 export { couponsTesterSeedData } from "./coupons-tester-seed-data";
 export { bidsTesterSeedData } from "./bids-tester-seed-data";
+export { cartsTesterSeedData } from "./carts-tester-seed-data";
 export { ordersTesterSeedData } from "./orders-tester-seed-data";
 export { offersTesterSeedData } from "./offers-tester-seed-data";

package/dist/features/tester/seed-data/index.js

@@ -6,5 +6,6 @@ export { blogTesterSeedData } from "./blog-tester-seed-data";
 export { eventsTesterSeedData } from "./events-tester-seed-data";
 export { couponsTesterSeedData } from "./coupons-tester-seed-data";
 export { bidsTesterSeedData } from "./bids-tester-seed-data";
+export { cartsTesterSeedData } from "./carts-tester-seed-data";
 export { ordersTesterSeedData } from "./orders-tester-seed-data";
 export { offersTesterSeedData } from "./offers-tester-seed-data";