@mohasinac/appkit 4.35.1 → 4.35.3

package/dist/_internal/server/jobs/core/dailyStatusDigest.js

@@ -13,6 +13,7 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
  * unbounded-ish order scan below is safe against CLAUDE.md Rule #6's 10s
  * sync ceiling — it has the Function's much larger budget.
  */
+import { Fragment } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { getAdminDb } from "../../../../providers/db-firebase";
 import { sendEmail } from "../../../../features/contact/email";
@@ -20,14 +21,35 @@ import { siteSettingsRepository } from "../../../../features/admin/repository/si
 import { ORDER_COLLECTION, OrderStatusValues } from "../../../../features/orders/schemas/firestore";
 import { PRODUCT_COLLECTION, ProductStatusValues } from "../../../../features/products/schemas/firestore";
 import { ORDER_FIELDS, PRODUCT_FIELDS } from "../../../../constants/field-names";
-import { EmailBold, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailRow, } from "../../../../features/email/primitives";
+import { CONTACT_SUBMISSIONS_COLLECTION } from "../../../../core/contact-submissions.repository";
+import { NEWSLETTER_SUBSCRIBERS_COLLECTION } from "../../../../core/newsletter.repository";
+import { SUPPORT_TICKET_COLLECTION, SUPPORT_TICKET_FIELDS, TicketStatusValues, } from "../../../../features/support/schemas/firestore";
+import { SCAMMER_COLLECTION, SCAMMER_FIELDS } from "../../../../features/scams/schemas/firestore";
+import { ADMIN_AUDIT_LOG_COLLECTION } from "../../../../features/audit-log/schemas/firestore";
+import { ADMIN_NOTIFICATIONS_COLLECTION } from "../../../../features/store-extensions/schemas/rbac";
+import { EmailBold, EmailContainer, EmailDivider, EmailDoc, EmailFooter, EmailHeader, EmailLink, EmailRow, } from "../../../../features/email/primitives";
 import { normalizeError } from "../../../../errors/normalize";
 const DAY_MS = 24 * 60 * 60 * 1000;
+/*
+ * `createdAt` and `isRead` on collections with no feature-specific field-name
+ * constant — contactSubmissions, newsletterSubscribers, adminAuditLog,
+ * adminNotifications.
+ *
+ * audit-field-name-ok: these are BaseDocument fields common to every
+ * collection, not per-feature names. Borrowing ORDER_FIELDS.CREATED_AT here
+ * would assert a relationship to the orders schema that does not exist, so a
+ * rename there would appear to affect queries it has nothing to do with. Named
+ * once, locally, rather than repeated as bare literals at ten call sites.
+ */
+const CREATED_AT = "createdAt";
+const IS_READ = "isRead";
 /** Statuses that shouldn't count toward revenue for the day. */
 const NON_REVENUE_STATUSES = new Set([
     OrderStatusValues.CANCELLED,
     OrderStatusValues.REFUNDED,
 ]);
+/** How many contact messages the digest lists in full before summarising the rest. */
+const CONTACT_PREVIEW_LIMIT = 20;
 function currency(amount) {
     return `₹${amount.toLocaleString("en-IN", { maximumFractionDigits: 2 })}`;
 }
@@ -68,12 +90,90 @@ export async function collectDailyStatusSummary() {
         .where(PRODUCT_FIELDS.STATUS, "==", ProductStatusValues.PUBLISHED)
         .count()
         .get();
+    const safeCount = async (q) => {
+        try {
+            const snap = await q.count().get();
+            return snap.data().count;
+        }
+        catch (err) {
+            void normalizeError(err);
+            return 0;
+        }
+    };
+    /*
+     * audit-field-name-ok: these six collections — contactSubmissions,
+     * supportTickets, scammerProfiles, newsletterSubscribers, adminAuditLog and
+     * adminNotifications — have no shared field-name constant covering
+     * `createdAt`, and borrowing ORDER_FIELDS.CREATED_AT or PRODUCT_FIELDS.STATUS
+     * here would be actively misleading: it would assert a relationship to the
+     * orders/products schemas that does not exist, so a rename of ORDER_FIELDS
+     * would appear to affect a query it has nothing to do with. `createdAt` and
+     * `isRead` are BaseDocument fields common to every collection, not
+     * per-feature names. SUPPORT_TICKET_FIELDS is used below where it genuinely
+     * applies.
+     */
+    const [contactSnap, contactTotal, newTicketCount, ticketsOpen, ticketsInProgress, ticketsWaitingOnUser, newScamReportCount, manualPaymentPendingCount, newSubscriberCount, adminActionCount, unreadAdminNotificationCount,] = await Promise.all([
+        db
+            .collection(CONTACT_SUBMISSIONS_COLLECTION)
+            .where(CREATED_AT, ">=", since)
+            .orderBy(CREATED_AT, "desc")
+            .limit(CONTACT_PREVIEW_LIMIT)
+            .get()
+            .catch((err) => {
+            void normalizeError(err);
+            return null;
+        }),
+        safeCount(db.collection(CONTACT_SUBMISSIONS_COLLECTION).where(CREATED_AT, ">=", since)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.CREATED_AT, ">=", since)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.STATUS, "==", TicketStatusValues.OPEN)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.STATUS, "==", TicketStatusValues.IN_PROGRESS)),
+        safeCount(db.collection(SUPPORT_TICKET_COLLECTION).where(SUPPORT_TICKET_FIELDS.STATUS, "==", TicketStatusValues.WAITING_ON_USER)),
+        safeCount(db.collection(SCAMMER_COLLECTION).where(SCAMMER_FIELDS.CREATED_AT, ">=", since)),
+        safeCount(db
+            .collection(ORDER_COLLECTION)
+            .where(ORDER_FIELDS.STATUS, "==", OrderStatusValues.PENDING)
+            .where(ORDER_FIELDS.PAYMENT_STATUS, "==", "pending")),
+        safeCount(db.collection(NEWSLETTER_SUBSCRIBERS_COLLECTION).where(CREATED_AT, ">=", since)),
+        safeCount(db.collection(ADMIN_AUDIT_LOG_COLLECTION).where(CREATED_AT, ">=", since)),
+        safeCount(db.collection(ADMIN_NOTIFICATIONS_COLLECTION).where(IS_READ, "==", false)),
+    ]);
+    /*
+     * `contactSubmissions` carries NO PII encryption — name, email, subject and
+     * message are stored in plaintext (see `ContactSubmissionDocument`). That is
+     * what lets the digest render a real `mailto:` reply link.
+     *
+     * Newsletter subscribers are the opposite: `email` is encrypted with an HMAC
+     * blind index, so that section is a COUNT and must stay one. Rendering
+     * addresses there would mean decrypting PII into an email body.
+     */
+    const contactMessages = (contactSnap?.docs ?? []).map((d) => {
+        const data = d.data();
+        const message = data.message ?? "";
+        return {
+            id: d.id,
+            name: data.name ?? "Unknown",
+            email: data.email ?? "",
+            subject: data.subject ?? "(no subject)",
+            excerpt: message.length > 200 ? `${message.slice(0, 200)}…` : message,
+        };
+    });
     return {
         orderCount: recentSnap.size,
         revenue,
         statusBreakdown,
         stuckPendingCount: stuckSnap.data().count,
         activeListingCount: activeSnap.data().count,
+        contactMessages,
+        contactTotal,
+        newTicketCount,
+        ticketsOpen,
+        ticketsInProgress,
+        ticketsWaitingOnUser,
+        newScamReportCount,
+        manualPaymentPendingCount,
+        newSubscriberCount,
+        adminActionCount,
+        unreadAdminNotificationCount,
     };
 }
 function renderDigestHtml(summary, siteName, version) {
@@ -81,7 +181,37 @@ function renderDigestHtml(summary, siteName, version) {
     const title = siteName ? `${siteName} — Daily Status` : "Daily Status";
     return `<!DOCTYPE html>${renderToStaticMarkup(_jsx(EmailDoc, { title: title, children: _jsxs(EmailContainer, { children: [_jsx(EmailHeader, { brandName: siteName }), _jsxs(EmailRow, { children: [version
                             ? `Deployment ${version} is live. Activity for the last 24 hours.`
-                            : "Activity for the last 24 hours.", _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Orders placed", value: summary.orderCount }), _jsx(StatLine, { label: "Revenue (excl. cancelled/refunded)", value: currency(summary.revenue) }), _jsx(StatLine, { label: "Active listings", value: summary.activeListingCount }), _jsx(StatLine, { label: "Pending > 24h (needs attention)", value: summary.stuckPendingCount })] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Orders by status" }), _jsx("br", {}), _jsx("br", {}), statusRows.length === 0 ? ("No orders in this window.") : (statusRows.map(([status, count]) => (_jsx(StatLine, { label: status, value: count }, status))))] }), _jsx(EmailFooter, { copyright: `© ${new Date().getFullYear()}${siteName ? ` ${siteName}` : ""}. All rights reserved.` })] }) }))}`;
+                            : "Activity for the last 24 hours.", _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Orders placed", value: summary.orderCount }), _jsx(StatLine, { label: "Revenue (excl. cancelled/refunded)", value: currency(summary.revenue) }), _jsx(StatLine, { label: "Active listings", value: summary.activeListingCount }), _jsx(StatLine, { label: "Pending > 24h (needs attention)", value: summary.stuckPendingCount })] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Orders by status" }), _jsx("br", {}), _jsx("br", {}), statusRows.length === 0 ? ("No orders in this window.") : (statusRows.map(([status, count]) => (_jsx(StatLine, { label: status, value: count }, status))))] }), _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Inbox" }), _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "New contact messages", value: summary.contactTotal }), _jsx(StatLine, { label: "New support tickets", value: summary.newTicketCount }), _jsx(StatLine, { label: "Tickets open / in progress / waiting on user", value: `${summary.ticketsOpen} / ${summary.ticketsInProgress} / ${summary.ticketsWaitingOnUser}` }), _jsx(StatLine, { label: "Unread admin notifications", value: summary.unreadAdminNotificationCount })] }), summary.contactMessages.length > 0 ? (_jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Contact messages" }), _jsx("br", {}), _jsx("br", {}), summary.contactMessages.map((m) => (_jsxs(Fragment, { children: [_jsx(EmailBold, { children: m.subject }), _jsx("br", {}), m.name, " \u2014", " ", _jsxs(EmailLink, { href: `mailto:${m.email}?subject=${encodeURIComponent(`Re: ${m.subject}`)}`, children: ["Reply to ", m.email] }), _jsx("br", {}), m.excerpt, _jsx("br", {}), _jsx("br", {})] }, m.id))), summary.contactTotal > summary.contactMessages.length
+                            ? `…and ${summary.contactTotal - summary.contactMessages.length} more in /admin/contact.`
+                            : null] })) : null, _jsx(EmailDivider, {}), _jsxs(EmailRow, { children: [_jsx(EmailBold, { children: "Needs attention" }), _jsx("br", {}), _jsx("br", {}), _jsx(StatLine, { label: "Manual payments pending", value: summary.manualPaymentPendingCount }), _jsx(StatLine, { label: "New scam reports", value: summary.newScamReportCount }), _jsx(StatLine, { label: "New newsletter subscribers", value: summary.newSubscriberCount }), _jsx(StatLine, { label: "Admin actions logged", value: summary.adminActionCount })] }), _jsx(EmailFooter, { copyright: `© ${new Date().getFullYear()}${siteName ? ` ${siteName}` : ""}. All rights reserved.` })] }) }))}`;
+}
+/**
+ * The plain-text twin of `renderDigestHtml`.
+ *
+ * 🛑 This exists as a real function, beside the renderer, on purpose. The text
+ * part used to be a string concatenated inline at the call site, which meant
+ * every new HTML section silently did NOT appear in the text alternative —
+ * and a mail client showing the text part would render a digest missing
+ * exactly the sections someone had just added. Adding a section now means
+ * editing two adjacent functions rather than one function and one distant
+ * template literal.
+ */
+function renderDigestText(summary, version) {
+    const lines = [];
+    if (version)
+        lines.push(`Deployment ${version} is live.`, "");
+    lines.push(`Orders placed: ${summary.orderCount}`, `Revenue: ${currency(summary.revenue)}`, `Active listings: ${summary.activeListingCount}`, `Pending > 24h: ${summary.stuckPendingCount}`, "", "INBOX", `New contact messages: ${summary.contactTotal}`, `New support tickets: ${summary.newTicketCount}`, `Tickets open/in-progress/waiting: ${summary.ticketsOpen}/${summary.ticketsInProgress}/${summary.ticketsWaitingOnUser}`, `Unread admin notifications: ${summary.unreadAdminNotificationCount}`);
+    if (summary.contactMessages.length > 0) {
+        lines.push("", "CONTACT MESSAGES");
+        for (const m of summary.contactMessages) {
+            lines.push(`- ${m.subject} — ${m.name} <${m.email}>`, `  ${m.excerpt}`);
+        }
+        if (summary.contactTotal > summary.contactMessages.length) {
+            lines.push(`  …and ${summary.contactTotal - summary.contactMessages.length} more in /admin/contact.`);
+        }
+    }
+    lines.push("", "NEEDS ATTENTION", `Manual payments pending: ${summary.manualPaymentPendingCount}`, `New scam reports: ${summary.newScamReportCount}`, `New newsletter subscribers: ${summary.newSubscriberCount}`, `Admin actions logged: ${summary.adminActionCount}`);
+    return lines.join("\n");
 }
 const DEPLOY_MARKER_COLLECTION = "system";
 const DEPLOY_MARKER_DOC = "deployDigest";
@@ -134,23 +264,36 @@ export async function runDailyStatusDigest(ctx, version) {
         ctx.logger.warn("dailyStatusDigest: enabled but no recipients configured — skipping");
         return { sent: false, reason: "no_recipients" };
     }
-    const ccRecipients = (digestConfig.ccRecipients ?? []).filter((r) => r.trim().length > 0);
+    /*
+     * 🛑 No CC, deliberately, and `ccRecipients` is no longer read here.
+     *
+     * Resend bills a CC as a separate delivery, so a three-recipient TO plus one
+     * CC was four of the day's 100 emails for one report. The digest now goes to
+     * a single address. `emailSettings.dailyDigest.ccRecipients` remains on the
+     * schema only so existing documents do not fail validation — nothing reads
+     * it, and the admin UI no longer offers it.
+     */
     const summary = await collectDailyStatusSummary();
     // No hardcoded brand fallback — appkit is consumer-agnostic; the site name
     // comes from settings or the consumer's own env var.
     const siteName = settings?.siteName?.trim() || process.env.NEXT_PUBLIC_SITE_NAME?.trim() || "";
     const { error } = await sendEmail({
         to: recipients,
-        // Spread rather than `cc: undefined` — SendEmailOptions has a
-        // Record<string, JsonValue> index signature that rejects undefined.
-        ...(ccRecipients.length > 0 ? { cc: ccRecipients } : {}),
         subject: "Daily Status",
         html: renderDigestHtml(summary, siteName, version),
-        text: (version ? `Deployment ${version} is live.\n\n` : "") +
-            `Orders placed: ${summary.orderCount}\n` +
-            `Revenue: ${currency(summary.revenue)}\n` +
-            `Active listings: ${summary.activeListingCount}\n` +
-            `Pending > 24h: ${summary.stuckPendingCount}`,
+        text: renderDigestText(summary, version),
+    }, {
+        channel: "email",
+        feature: "daily_digest",
+        /*
+         * STAFF, and this is the single most load-bearing `audience` in the
+         * codebase. The kill switch suppresses user-facing mail only, so turning
+         * email off must never blind the operator — this digest is now the only
+         * way a contact message, a new support ticket or a stuck payment proof
+         * gets noticed at all. Marking it `user` would mean switching off
+         * marketing also switched off the ability to notice an outage.
+         */
+        audience: "staff",
     });
     if (error) {
         ctx.logger.error("dailyStatusDigest: send failed", { error: String(error) });

package/dist/_internal/server/jobs/core/hardBanReinstatement.js

@@ -47,15 +47,27 @@ export async function runHardBanReinstatement(ctx) {
             ctx.logger.error("Failed to reinstate expired hard ban", err, { uid: user.uid });
         }
     }
-    await Promise.allSettled(expired.map((user) => sendNotification({
-        userId: user.uid,
-        type: "account_action",
-        priority: "normal",
-        title: "Account access restored",
-        message: "Your account access has been restored. If your seller store was suspended, contact support to reactivate it.",
-        relatedId: user.uid,
-        relatedType: "user",
-    })));
+    // Sequential: `account_action` is email-eligible — deliberately so, since a
+    // ban or unban has to reach someone outside the app they just lost or
+    // regained. Each send reserves a unit from the single-document daily budget
+    // counter, so a concurrent sweep would contend. See pendingOrderTimeout.
+    for (const user of expired) {
+        try {
+            await sendNotification({
+                userId: user.uid,
+                type: "account_action",
+                priority: "normal",
+                title: "Account access restored",
+                message: "Your account access has been restored. If your seller store was suspended, contact support to reactivate it.",
+                relatedId: user.uid,
+                relatedType: "user",
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.error("Failed to notify user of ban reinstatement (non-fatal)", err, { uid: user.uid });
+        }
+    }
     ctx.logger.info("Hard ban reinstatement sweep complete", {
         scanned: expired.length,
         reinstated,

package/dist/_internal/server/jobs/core/onOrderCreate.js

@@ -1,8 +1,9 @@
 import { normalizeError } from "../../../../errors/normalize";
-import { storeRepository, userRepository } from "../../../../repositories";
+import { adminNotificationsRepository, storeRepository, userRepository } from "../../../../repositories";
 import { decryptPii } from "../../../../security/index";
 import { sendWhatsAppBusinessMessage, buildPurchaseAnnouncementMessage, } from "../../../../features/whatsapp-bot/server";
 import { resolveKeys } from "../../../../core/integration-keys";
+import { guardSend, logSuppressedSend } from "../../notifications/send-guard";
 async function sendAnnouncement(ctx, toPhone, message, phoneNumberId, accessToken, label, orderId) {
     try {
         const sent = await sendWhatsAppBusinessMessage({
@@ -68,21 +69,10 @@ async function resolveWhatsAppCredentials(ctx, orderId) {
     return {
         phoneNumberId: usable(db.whatsappPhoneNumberId) || usable(ctx.env("WHATSAPP_PHONE_NUMBER_ID")),
         accessToken: usable(db.whatsappCloudApiToken) || usable(ctx.env("WHATSAPP_CLOUD_API_TOKEN")),
-        adminNumbersRaw: usable(db.whatsappAdminNotifyNumbers) || usable(ctx.env("WHATSAPP_ADMIN_NOTIFY_NUMBERS")),
     };
 }
 export async function handleOrderCreate(input, ctx) {
     const { orderId, order } = input;
-    // Credentials resolve DB-first (Admin → Site Settings → WhatsApp) with an env
-    // fallback, matching resolveKeys() and every other WhatsApp send path. This
-    // read ctx.env() ONLY until 2026-08-22, so credentials saved in Site Settings
-    // never reached the order-placed announcement — it silently no-op'd unless the
-    // Functions runtime also carried the env vars.
-    const { phoneNumberId, accessToken, adminNumbersRaw } = await resolveWhatsAppCredentials(ctx, orderId);
-    if (!phoneNumberId || !accessToken) {
-        ctx.logger.info("WhatsApp Cloud API not configured — skipping announcement", { orderId });
-        return;
-    }
     const items = order.items ?? [];
     const firstItem = items[0];
     const firstItemName = firstItem?.productTitle ?? "an item";
@@ -95,20 +85,67 @@ export async function handleOrderCreate(input, ctx) {
         totalAmount: order.totalPrice ?? 0,
         orderId,
     });
-    const adminNumbers = adminNumbersRaw
-        .split(",")
-        .map((n) => n.trim().replace(/\D/g, ""))
-        .filter(Boolean);
-    for (const num of adminNumbers) {
-        await sendAnnouncement(ctx, num, message, phoneNumberId, accessToken, "admin", orderId);
+    /*
+     * Staff side: one durable row, not a WhatsApp message per admin number.
+     *
+     * 🛑 This used to loop `whatsappAdminNotifyNumbers` and send the purchase
+     * announcement to every one of them, ON EVERY ORDER — the highest-volume
+     * staff blast in the codebase. It is now an `adminNotifications` row that
+     * the admin inbox reads and the daily digest counts.
+     *
+     * Written BEFORE the credential check on purpose. The old code returned
+     * early when WhatsApp was unconfigured, which meant that with no Meta
+     * credentials — the state this project is actually in — an order produced
+     * no staff signal at all, and no record that it hadn't.
+     */
+    try {
+        await adminNotificationsRepository.create({
+            category: "growth",
+            title: "New order placed",
+            body: message,
+            severity: "info",
+            isRead: false,
+            entityType: "order",
+            entityId: orderId,
+            audienceUserIds: [],
+        });
     }
+    catch (err) {
+        void normalizeError(err);
+        ctx.logger.error("Failed to write admin order notification (non-fatal)", err, { orderId });
+    }
+    /*
+     * Seller side keeps WhatsApp: it is ONE message to ONE person about their
+     * own sale, which is the case the channel is good at. Credentials resolve
+     * DB-first (Admin → Site Settings → WhatsApp) with an env fallback — this
+     * read `ctx.env()` only until 2026-08-22, so credentials saved in Site
+     * Settings never reached the announcement and it silently no-op'd.
+     */
     const storeId = order.storeId;
-    if (storeId) {
-        await notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId);
+    if (!storeId) {
+        ctx.logger.info("Order has no storeId — nothing to announce to a seller", { orderId });
+        return;
     }
-    ctx.logger.info(`Order announcement complete`, {
-        orderId,
-        adminCount: adminNumbers.length,
-        storeId: storeId ?? "unknown",
-    });
+    const { phoneNumberId, accessToken } = await resolveWhatsAppCredentials(ctx, orderId);
+    if (!phoneNumberId || !accessToken) {
+        ctx.logger.info("WhatsApp Cloud API not configured — skipping seller announcement", { orderId });
+        return;
+    }
+    // Audience is "user": a seller receiving news of their own sale is a
+    // marketplace participant, not an operator of the site. Staff exemption is
+    // for the digest and the payout summary, and widening it to "anyone we think
+    // ought to see this" would make the kill switch mean nothing.
+    const guard = {
+        channel: "whatsapp",
+        feature: "order_placed_seller",
+        audience: "user",
+    };
+    const decision = await guardSend(guard);
+    if (!decision.allow) {
+        logSuppressedSend(guard, decision);
+        ctx.logger.info("Seller order announcement suppressed by messaging guard", { orderId, storeId });
+        return;
+    }
+    await notifyStoreOwner(ctx, storeId, message, phoneNumberId, accessToken, orderId);
+    ctx.logger.info(`Order announcement complete`, { orderId, storeId });
 }

package/dist/_internal/server/jobs/core/onScamReportCreate.js

@@ -1,5 +1,5 @@
 import { normalizeError } from "../../../../errors/normalize";
-import { userRepository } from "../../../../repositories";
+import { adminNotificationsRepository, userRepository } from "../../../../repositories";
 import { sendNotification } from "../../../../features/admin/actions/notification-actions";
 import { SCAM_TYPE_LABELS } from "../../../../features/scams/constants/scam-types";
 export async function handleScamReportCreate(input, ctx) {
@@ -12,7 +12,7 @@ export async function handleScamReportCreate(input, ctx) {
             const reporter = await userRepository.findById(reportedBy);
             await sendNotification({
                 userId: reportedBy,
-                type: "account_action",
+                type: "scam_report_update",
                 priority: "normal",
                 title: "Scam report submitted",
                 message: `Your report for "${name}" has been received. Our team will review it within 48 hours.`,
@@ -27,31 +27,42 @@ export async function handleScamReportCreate(input, ctx) {
             ctx.logger.error("Failed to notify reporter (non-fatal)", err, { scammerId, reportedBy });
         }
     }
-    // 2. Notify all employees with admin:scammers:read permission
+    /*
+     * 2. Tell STAFF — once, into the admin inbox.
+     *
+     * 🛑 This used to be `Promise.all` over `userRepository.list({ pageSize: 100 })`,
+     * i.e. **one `sendNotification` per employee, up to 100, per report filed**.
+     * Each of those was a potential email against a 100/day Resend allowance, so
+     * a single scam report could consume the entire day — and it was a hundred
+     * concurrent Firestore writes besides.
+     *
+     * It was also the wrong shape regardless of cost: a scam report is one
+     * event needing one person to action it, not N personal messages. The
+     * `adminNotifications` collection exists for exactly this and is already
+     * read by `GET /api/admin/admin-notifications` and surfaced in the admin
+     * inbox — `audienceUserIds: []` means "all admins" rather than a fan-out.
+     *
+     * The daily digest carries the count as well, so nothing depends on someone
+     * happening to look at the inbox.
+     */
     try {
-        const result = await userRepository.list({
-            filters: "role==employee",
-            page: 1,
-            pageSize: 100,
-        });
         const scamTypeLabel = scamType ? (SCAM_TYPE_LABELS[scamType] ?? scamType) : "Unknown";
         const amountStr = amountLost ? ` ₹${amountLost.toLocaleString("en-IN")}` : "";
         const platformStr = scamPlatform ? ` via ${scamPlatform}` : "";
-        await Promise.all(result.items.filter((e) => !!e.id).map((employee) => sendNotification({
-            userId: employee.id,
-            type: "account_action",
-            priority: "normal",
+        await adminNotificationsRepository.create({
+            category: "fraud",
             title: "New scam report submitted",
-            message: `A report was submitted for "${name}" — ${scamTypeLabel}${platformStr}.${amountStr}`,
-            relatedId: scammerId,
-            relatedType: "scammer",
-            userEmail: employee.email ?? undefined,
-            userPhone: employee.phoneNumber ?? undefined,
-        }).catch((err) => ctx.logger.error("Failed to notify employee (non-fatal)", err, { scammerId, employeeId: employee.id ?? null }))));
+            body: `A report was submitted for "${name}" — ${scamTypeLabel}${platformStr}.${amountStr}`,
+            severity: "warning",
+            isRead: false,
+            entityType: "scammer",
+            entityId: scammerId,
+            audienceUserIds: [],
+        });
     }
     catch (err) {
         void normalizeError(err);
-        ctx.logger.error("Failed to query employees for scam notification (non-fatal)", err, { scammerId });
+        ctx.logger.error("Failed to write admin scam-report notification (non-fatal)", err, { scammerId });
     }
     ctx.logger.info("onScamReportCreate complete", { scammerId, reportedBy: reportedBy ?? null });
 }

package/dist/_internal/server/jobs/core/onScamReportRejected.js

@@ -15,7 +15,7 @@ export async function handleScamReportRejected(input, ctx) {
         const reporter = await userRepository.findById(reportedBy);
         await sendNotification({
             userId: reportedBy,
-            type: "account_action",
+            type: "scam_report_update",
             priority: "normal",
             title: "Scam report not verified",
             message: `Your report for "${name}" could not be verified with the evidence provided. You may submit a new report with additional evidence.`,

package/dist/_internal/server/jobs/core/onScamReportVerified.js

@@ -15,7 +15,7 @@ export async function handleScamReportVerified(input, ctx) {
         const reporter = await userRepository.findById(reportedBy);
         await sendNotification({
             userId: reportedBy,
-            type: "account_action",
+            type: "scam_report_update",
             priority: "normal",
             title: "Your scam report was verified",
             message: `The report for "${name}" has been verified and published to the Scam Registry. Thank you for helping protect the community.`,

package/dist/_internal/server/jobs/core/onSupportTicketCreate.js

@@ -10,7 +10,7 @@ export async function handleSupportTicketCreate(input, ctx) {
     try {
         await sendNotification({
             userId,
-            type: "account_action",
+            type: "support_ticket_update",
             priority: "normal",
             title: "Support ticket received",
             message: `We received your support request: "${ticket.subject ?? "your ticket"}". We'll get back to you soon.`,

package/dist/_internal/server/jobs/core/onSupportTicketUpdate.js

@@ -35,7 +35,7 @@ export async function handleSupportTicketUpdate(input, ctx) {
     try {
         await sendNotification({
             userId,
-            type: "account_action",
+            type: "support_ticket_update",
             priority: "normal",
             title: msg.title,
             message: msg.body(subject),

package/dist/_internal/server/jobs/core/paymentReviewAutoApprove.js

@@ -76,15 +76,27 @@ export async function runPaymentReviewAutoApprove(ctx) {
             ctx.logger.error("Failed to auto-approve payment proof", err, { orderId: entry.id });
         }
     }
-    await Promise.allSettled(unreviewed.map((entry) => sendNotification({
-        userId: entry.data.userId,
-        type: "payment_review",
-        priority: "normal",
-        title: ORDER_MESSAGES.AUTO_APPROVED_TITLE,
-        message: ORDER_MESSAGES.AUTO_APPROVED_MESSAGE(entry.data.productTitle),
-        relatedId: entry.id,
-        relatedType: "order",
-    })));
+    // Sequential: `payment_review` is email-eligible, so each send reserves a
+    // unit from the single-document daily budget counter. See pendingOrderTimeout.
+    for (const entry of unreviewed) {
+        try {
+            await sendNotification({
+                userId: entry.data.userId,
+                type: "payment_review",
+                priority: "normal",
+                title: ORDER_MESSAGES.AUTO_APPROVED_TITLE,
+                message: ORDER_MESSAGES.AUTO_APPROVED_MESSAGE(entry.data.productTitle),
+                relatedId: entry.id,
+                relatedType: "order",
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.error("Failed to notify buyer of auto-approved payment (non-fatal)", err, {
+                orderId: entry.id,
+            });
+        }
+    }
     ctx.logger.info("Payment review auto-approve sweep complete", {
         scanned: unreviewed.length,
         approved,

package/dist/_internal/server/jobs/core/paymentWindowTimeout.js

@@ -43,16 +43,29 @@ export async function runPaymentWindowTimeout(ctx) {
             });
         }
     }
-    await Promise.allSettled(expired.map((entry) => sendNotification({
-        userId: entry.data.userId,
-        type: "order_cancelled",
-        priority: "normal",
-        title: ORDER_MESSAGES.CANCELLED_PAYMENT_WINDOW_TITLE,
-        message: ORDER_MESSAGES.CANCELLED_PAYMENT_WINDOW_MESSAGE(entry.data.productTitle),
-        relatedId: entry.id,
-        relatedType: "order",
-        orderWhatsappAddonPaid: entry.data.whatsappNotifyAddon === true,
-    })));
+    // Sequential: `order_cancelled` is email-eligible, so each send reserves a
+    // unit from the single-document daily budget counter and a concurrent sweep
+    // would contend on it. See pendingOrderTimeout for the full reasoning.
+    for (const entry of expired) {
+        try {
+            await sendNotification({
+                userId: entry.data.userId,
+                type: "order_cancelled",
+                priority: "normal",
+                title: ORDER_MESSAGES.CANCELLED_PAYMENT_WINDOW_TITLE,
+                message: ORDER_MESSAGES.CANCELLED_PAYMENT_WINDOW_MESSAGE(entry.data.productTitle),
+                relatedId: entry.id,
+                relatedType: "order",
+                orderWhatsappAddonPaid: entry.data.whatsappNotifyAddon === true,
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.error("Failed to notify buyer of expired payment window (non-fatal)", err, {
+                orderId: entry.id,
+            });
+        }
+    }
     ctx.logger.info("Payment window timeout sweep complete", {
         scanned: expired.length,
         restored,

package/dist/_internal/server/jobs/core/pendingOrderTimeout.js

@@ -41,15 +41,41 @@ export async function runPendingOrderTimeout(ctx) {
             });
         }
     }
-    await Promise.allSettled(timedOut.map((entry) => sendNotification({
-        userId: entry.data.userId,
-        type: "order_cancelled",
-        priority: "normal",
-        title: ORDER_MESSAGES.CANCELLED_TITLE,
-        message: ORDER_MESSAGES.CANCELLED_TIMEOUT_MESSAGE(entry.data.productTitle, timeoutHours),
-        relatedId: entry.id,
-        relatedType: "order",
-        orderWhatsappAddonPaid: entry.data.whatsappNotifyAddon === true,
-    })));
+    /*
+     * Sequential, not `Promise.allSettled`.
+     *
+     * 🛑 `order_cancelled` is email-ELIGIBLE, so each of these reserves a unit
+     * from the daily budget — a single Firestore document. Firestore sustains
+     * roughly one write per second on one document, so a concurrent sweep would
+     * contend on it, retry, and slow the job down more than the serial version
+     * it replaced. Awaiting in a loop is the cheap fix; the alternative is
+     * sharding the counter to defend a fan-out nobody needs.
+     *
+     * Safe on latency: this runs in a Firebase Function with a 300s budget, and
+     * the set is bounded by however many orders timed out in one window.
+     *
+     * Failures stay non-fatal per order — a notification that will not send must
+     * not stop the remaining cancellations being announced.
+     */
+    for (const entry of timedOut) {
+        try {
+            await sendNotification({
+                userId: entry.data.userId,
+                type: "order_cancelled",
+                priority: "normal",
+                title: ORDER_MESSAGES.CANCELLED_TITLE,
+                message: ORDER_MESSAGES.CANCELLED_TIMEOUT_MESSAGE(entry.data.productTitle, timeoutHours),
+                relatedId: entry.id,
+                relatedType: "order",
+                orderWhatsappAddonPaid: entry.data.whatsappNotifyAddon === true,
+            });
+        }
+        catch (err) {
+            void normalizeError(err);
+            ctx.logger.error("Failed to notify buyer of timed-out order (non-fatal)", err, {
+                orderId: entry.id,
+            });
+        }
+    }
     ctx.logger.info("Pending order timeout complete", { cancelled: timedOut.length, restored });
 }